Querying of LDAP failed org.keycloak.storage.ldap.idm.query.internal.LDAPQuery@56aa92dd #38489

f1-outsourcing · 2025-03-27T09:29:37Z

f1-outsourcing
Mar 27, 2025

I have updated to 26.1.4 and my impression was that showing ldap users is faster now[1], however when testing a bit in listing them in realms I am getting this error

No users found due to unknown_error

Querying of LDAP failed org.keycloak.storage.ldap.idm.query.internal.LDAPQuery@56aa92dd

[1]
#37183

f1-outsourcing · 2025-03-28T12:50:47Z

f1-outsourcing
Mar 28, 2025
Author

I think this is not limited to just listing users. Getting jwt tokens is often giving me null.

0 replies

sguilhen · 2025-03-31T12:06:04Z

sguilhen
Mar 31, 2025
Collaborator

Do you see any exceptions in the logs?

3 replies

f1-outsourcing Mar 31, 2025
Author

I am not really checking the logs of keycloak because my remote logging is not working as it requires the use of /dev/log. Now seeing this dump, I already know what the issue is. I was trying to fix this in some app a while ago pingidentity/ldapsdk#166

I have two ldap containers both are multi homed, so they have an ip in the range of keycloak and they have an ip in some other range. Keycloak is resolving the results and just using whatever ip comes first (dns alternating this). I don't really know who's responsibility it is to handle this correctly, I would think the os or container should know what network is reachable or not.

Anyway keycloak does not really seem to be able to handle this. If the ip does not route why is it still being used (for such a long time)? So these settings need to be better tuned. If I have 4 ip addresses from which 2 are not good, I am not expecting to have so much issues.

dig +short ldap.xxxxxxx
x.x.x.x
y.y.y.y

2025-03-31 14:56:41,681 ERROR [org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager] (executor-thread-546) Unexpected exception when validating password
of DN [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx]: javax.naming.CommunicationException: ldap.xxxxxxxxxxxxxxxxxxxxx:8443 [Root exception is java.net.SocketException: Network unreachable]
     at java.naming/com.sun.jndi.ldap.Connection.<init>(Connection.java:251)
     at java.naming/com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:141)
     at java.naming/com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1620)
     at java.naming/com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2848)
     at java.naming/com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:349)
     at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxFromUrl(LdapCtxFactory.java:229)
     at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:189)
     at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:247)
     at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
     at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
     at java.naming/javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:520)
     at java.naming/javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
     at java.naming/javax.naming.InitialContext.init(InitialContext.java:236)
     at java.naming/javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:154)
     at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.authenticate(LDAPOperationManager.java:506)
     at org.keycloak.storage.ldap.idm.store.ldap.LDAPIdentityStore.validatePassword(LDAPIdentityStore.java:357)
     at org.keycloak.storage.ldap.LDAPStorageProvider.validPassword(LDAPStorageProvider.java:821)
     at org.keycloak.storage.ldap.LDAPStorageProvider.isValid(LDAPStorageProvider.java:911)
     at org.keycloak.credential.UserCredentialManager.lambda$validate$11(UserCredentialManager.java:260)
     at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:64)
     at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracin
8000
gProvider.java:74)
     at org.keycloak.credential.UserCredentialManager.lambda$validate$12(UserCredentialManager.java:259)
     at java.base/java.util.Collection.removeIf(Collection.java:583)
     at org.keycloak.credential.UserCredentialManager.validate(UserCredentialManager.java:257)
     at org.keycloak.credential.UserCredentialManager.isValid(UserCredentialManager.java:73)
     at org.keycloak.models.SubjectCredentialManager.isValid(SubjectCredentialManager.java:45)
     at org.keycloak.authentication.authenticators.directgrant.ValidatePassword.authenticate(ValidatePassword.java:49)
     at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:465)
     at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:269)
     at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1079)
     at org.keycloak.protocol.oidc.grants.ResourceOwnerPasswordCredentialsGrantType.process(ResourceOwnerPasswordCredentialsGrantType.java:111)
     at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:151)
     at org.keycloak.protocol.oidc.endpoints.TokenEndpoint$quarkusrestinvoker$processGrantRequest_6408e15340992839b66447750c221d9aaa837bd7.invoke(Unknown Source)
     at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
     at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
     at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
     at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:635)
     at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
     at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
     at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)
     at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
     at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
     at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
     at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.net.SocketException: Network unreachable
     at java.base/sun.nio.ch.Net.connect0(Native Method)

f1-outsourcing Mar 31, 2025
Author

What also is strange is why it just not sticks with the good ldap server. Looks like it is even changing from a good connection to a bad connection.

f1-outsourcing Apr 7, 2025
Author

Have you confirmed this behaviour?

f1-outsourcing · 2025-04-16T09:19:22Z

f1-outsourcing
Apr 16, 2025
Author

Are you going to look into this short term? As it is quite annoying behaviour currently with testing and for production I need to search for different solution.

0 replies

Navigation Menu

Repository navigation

Querying of LDAP failed org.keycloak.storage.ldap.idm.query.internal.LDAPQuery@56aa92dd #38489

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Querying of LDAP failed org.keycloak.storage.ldap.idm.query.internal.LDAPQuery@56aa92dd #38489

Uh oh!

Uh oh!

f1-outsourcing Mar 27, 2025

Replies: 3 comments · 3 replies

Uh oh!

f1-outsourcing Mar 28, 2025 Author

Uh oh!

sguilhen Mar 31, 2025 Collaborator

Uh oh!

f1-outsourcing Mar 31, 2025 Author

Uh oh!

Uh oh!

f1-outsourcing Mar 31, 2025 Author

Uh oh!

f1-outsourcing Apr 7, 2025 Author

Uh oh!

f1-outsourcing Apr 16, 2025 Author

f1-outsourcing
Mar 27, 2025

Replies: 3 comments 3 replies

f1-outsourcing
Mar 28, 2025
Author

sguilhen
Mar 31, 2025
Collaborator

f1-outsourcing Mar 31, 2025
Author

f1-outsourcing Mar 31, 2025
Author

f1-outsourcing Apr 7, 2025
Author

f1-outsourcing
Apr 16, 2025
Author