[keycloak-dev] Migration to 4.2.1 extracting RESOURCE_URIs fails with fine-grained admin permissions

[Schuster Sebastian (INST/ESY1)]

Hi everybody,

I just noticed that 4.2.1 contains a migration (jpa-changelog-authz-4.2.0.Final.xml) that extracts the URI column from the RESOURCE_SERVER_RESOURCE table and puts it into a separate table RESOURCE_URIS. This table has a NOT NULL constraint on the new uri column (called VALUE). The accompanying data migration AuthzResourceUseMoreURIs.java selects rows from the old table and inserts URIs it into the new. This fails for all resources that did not have a URI before because of the NOT NULL constraint, for example for Keycloak-internal resources like groups that don’t have a URI.

Is this intended behavior?

Best regards,
Sebastian

Mit freundlichen Grüßen / Best regards

Dr.-Ing. Sebastian Schuster

Engineering and Support (INST/ESY1)
Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com>
Tel. +49 30 726112-485 | Fax +49 30 726112-100 | Sebastian.Schuster at bosch-si.com<mailto:Sebastian.Schuster at bosch-si.com>

Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B
Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn