9:54 a.m.
I’m using Keycloak version 4.8.3 with a custom user federation plugin. I created a new
realm, configured my user federation plugin and created a new client. I tried to
authenticate and I got an error 500 from keycloak.
In Keycloak log I found this NullPointerException:
14:09:15,472 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-1)
Uncaught server error: java.lang.NullPointerException
at
org.keycloak.models.utils.KeycloakModelUtils.resolveAttribute(KeycloakModelUtils.java:414)
at
org.keycloak.models.utils.KeycloakModelUtils.resolveAttribute(KeycloakModelUtils.java:415)
at
org.keycloak.protocol.oidc.mappers.UserAttributeMapper.setClaim(UserAttributeMapper.java:93)
at
org.keycloak.protocol.oidc.mappers.UserAttributeMapper.setClaim(UserAttributeMapper.java:101)
at
org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.setClaim(AbstractOIDCProtocolMapper.java:117)
at
org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.setClaim(AbstractOIDCProtocolMapper.java:119)
at
org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.transformAccessToken(AbstractOIDCProtocolMapper.java:81)
at org.keycloak.protocol.oidc.TokenManager.transformAccessToken(TokenManager.java:606)
at
org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.transformAccessToken(AbstractOIDCProtocolMapper.java:81)
at
org.keycloak.protocol.oidc.TokenManager.createClientAccessToken(TokenManager.java:422)
at
org.keycloak.protocol.oidc.TokenManager$AccessTokenResponseBuilder.generateAccessToken(TokenManager.java:795)
at org.keycloak.protocol.oidc.TokenManager.transformAccessToken(TokenManager.java:544)
at
org.keycloak.protocol.oidc.endpoints.TokenEndpoint.resourceOwnerPasswordCredentialsGrant(TokenEndpoint.java:569)
at
org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:186)
at
org.keycloak.protocol.oidc.TokenManager.createClientAccessToken(TokenManager.java:402)
…..
After some tests I found the problem: the “Assigned Default Client Scopes” list, in my
newly created client, includes the “profile” scope.
The “profile” scope includes a lot of attributes and not all of them are exported from my
federation plugin for my users. Removing profile scope solve the problem and now I can
successfully authenticate my federeted users.
In class KeycloakModelUtils the are two implementation of the method resolveAttribute:
public static List<String> resolveAttribute(GroupModel group, String name) {
List<String> values = group.getAttribute(name);
if (values != null && !values.isEmpty()) return values;
if (group.getParentId() == null) return null;
return resolveAttribute(group.getParent(), name);
}
public static Collection<String> resolveAttribute(UserModel user, String name,
boolean aggregateAttrs) {
List<String> values = user.getAttribute(name);
Set<String> aggrValues = new HashSet<String>();
if (!values.isEmpty()) {
if (!aggregateAttrs) {
return values;
}
aggrValues.addAll(values);
}
for (GroupModel group : user.getGroups()) {
values = resolveAttribute(group, name);
if (values != null && !values.isEmpty()) {
if (!aggregateAttrs) {
return values;
}
aggrValues.addAll(values);
}
}
return aggrValues;
}
As you can see the first implementation checks if values is null, but not the second one
where I got NPE.
In my UserModel implementation I override the getAttrubute method:
public class UserAdapter extends AbstractUserAdapterFederatedStorage {
…..
@Override
public List<String> getAttribute(String name) {
if (attributes.containsKey(name)) {
return attributes.get(name);
}
return super.getAttribute(name);
}
}
If I force this method to return an empty list instead of null value, this solve the
problem. Is this the right fix? getAttribute method must not returns a null value?
I hope this helps.
Thanks,
Lorenzo