[keycloak-user] Violation in Password Change Form results in System Error using a user defined jpa storage provider

[Andreas Sättler]

Hello,

we are using a user defined storage provider for our application 
postgres db defined as ejb similar to 
https://github.com/keycloak/keycloak-quickstarts/tree/latest/user-storage-jpa.
<https://github.com/keycloak/keycloak-quickstarts/tree/latest/user-storage-jpa>

On the other hand we want to use keycloaks's password update forms 
including password policy configured in keycloak.

The policies are checked in the upgradeCredential method and in case of 
violation a ModelException is thrown.

But unfortunately the exception is caught as 
javax.ejb.EJBTransactionRolledbackException in 
org.keycloak.services.resources.account.AccountFormService#processPasswordUpdate:

2019-08-14 17:16:54,973 ERROR [org.keycloak.services] (default task-2) 
KC-SERVICES0065: Failed to update Password: 
javax.ejb.EJBTransactionRolledbackException: invalidPasswordMinLengthMessage
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInCallerTx(CMTTxInterceptor.java:203)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.tx.CMTTxInterceptor.required(CMTTxInterceptor.java:364)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:144)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.component.invocationmetrics.WaitTimeInterceptor.processInvocation(WaitTimeInterceptor.java:47)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:100)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.deployment.processors.StartupAwaitInterceptor.processInvocation(StartupAwaitInterceptor.java:22)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ejb3 at 16.0.0.Final//org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:67)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.as.ee at 16.0.0.Final//org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.ContextClassLoaderInterceptor.processInvocation(ContextClassLoaderInterceptor.java:60)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:438)
         at 
org.wildfly.security.elytron-private at 1.8.0.Final//org.wildfly.security.manager.WildFlySecurityManager.doChecked(WildFlySecurityManager.java:618)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.AccessCheckingInterceptor.processInvocation(AccessCheckingInterceptor.java:57)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422)
         at 
org.jboss.invocation at 1.5.2.Final//org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:53)
         at 
org.jboss.as.ee at 16.0.0.Final//org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:198)
         at 
org.jboss.as.ee at 16.0.0.Final//org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:185)
         at 
org.jboss.as.ee at 16.0.0.Final//org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:81)
         at 
deployment.keycloak-ofbiz-provider-ear.ear.keycloak-ofbiz-provider.jar//com.zyres.keycloak.storage.OFBizUserStorageProvider$$$view2.updateCredential(Unknown 
Source)
         at 
org.keycloak.keycloak-services at 6.0.1//org.keycloak.credential.UserCredentialStoreManager.updateCredential(UserCredentialStoreManager.java:168)
         at 
org.keycloak.keycloak-services at 6.0.1//org.keycloak.services.resources.account.AccountFormService.processPasswordUpdate(AccountFormService.java:577)
    ...

Caused by: org.keycloak.models.ModelException: 
invalidPasswordMinLengthMessage
         at 
deployment.keycloak-ofbiz-provider-ear.ear.keycloak-ofbiz-provider.jar//com.zyres.keycloak.storage.OFBizUserStorageProvider.updateCredential(OFBizUserStorageProvider.java:256)
         at 
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native 
Method)
         at 
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  ...


Therefore the account password change form results in a system error 
instead of a model validation.

Do you have any suggestions how to avoid this or is i a bug ?

(we are using keycloak server 6.0.1)

Kind regards

Andreas