script engine not found but scripts are enabled #30448

michaelottofits · 2024-06-14T14:48:29Z

michaelottofits
Jun 14, 2024

Keycloak 24.0.1 in Kubernetes Cluster.

I get the message Could not find ScriptEngine for script

Expected behavior
keycloak execute script on authentication flow

Actual behavior

2024-06-14 13:21:31,079 WARN  [org.keycloak.services] (executor-thread-1) KC-SERVICES0013: Failed authentication: java.lang.IllegalStateException: Could not find ScriptEngine for script: Script{id='null', realmId='68e32d83-d467-4c97-b744-72c7082786f2', name='Keycloak-Authenticator-Console', type='text/javascript', code='/*
 * Template for JavaScript based authenticator's.
 * See org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticatorFactory
 */

// import enum for error lookup
AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

/**
 * An example authenticate function.
 *
 * The following variables are available for convenience:
 * user - current user {@see org.keycloak.models.UserModel}
 * realm - current realm {@see org.keycloak.models.RealmModel}
 * session - current KeycloakSession {@see org.keycloak.models.Keycloa
8000
kSession}
 * httpRequest - current HttpRequest {@see org.jboss.resteasy.spi.HttpRequest}
 * script - current script {@see org.keycloak.models.ScriptModel}
 * authenticationSession - current authentication session {@see org.keycloak.sessions.AuthenticationSessionModel}
 * LOG - current logger {@see org.jboss.logging.Logger}
 *
 * You one can extract current http request headers via:
 * httpRequest.getHttpHeaders().getHeaderString("Forwarded")
 *
 * @param context {@see org.keycloak.authentication.AuthenticationFlowContext}
 */
function authenticate(context) {

    var username = user ? user.username : "anonymous";
    LOG.info(script.name + " trace auth for: " + username);
    var forEach = Array.prototype.forEach;    
    var client = context.getSession().getContext().getClient();
    var authShouldFail = true;   
   
    forEach.call(user.getClientRoleMappingsStream(client).toArray(), function(roleModel) 
    {  
        if(roleModel.getName().indexOf('console') !== -1)
        {
            authShouldFail = false;  
        }
    });


    if (authShouldFail) {

        context.failure(AuthenticationFlowError.ACCESS_DENIED);
        
        return;
    }

    context.success();
}', description='Keycloak Account Console'}
    at org.keycloak.scripting.DefaultScriptingProvider.getPreparedScriptEngine(DefaultScriptingProvider.java:114)
    at org.keycloak.scripting.DefaultScriptingProvider.prepareEvaluatableScript(DefaultScriptingProvider.java:74)
    at org.keycloak.scripting.DefaultScriptingProvider.prepareInvocableScript(DefaultScriptingProvider.java:55)
    at org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticator.getInvocableScriptAdapter(ScriptBasedAuthenticator.java:164)
    at org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticator.tryInvoke(ScriptBasedAuthenticator.java:120)
    at org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticator.authenticate(ScriptBasedAuthenticator.java:103)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:442)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:246)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:377)
    at org.keycloak.authentication.DefaultAuthenticationFlow.continueAuthenticationAfterSuccessfulAction(DefaultAuthenticationFlow.java:178)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:154)
    at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:987)
    at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:364)
    at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:335)
    at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:327)
    at org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:392)
    at org.keycloak.services.resources.LoginActionsService$quarkusrestinvoker$authenticateForm_32b8e198ac3110abd1d5774e83a4cf87858129f4.invoke(Unknown Source)
    at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
    at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
    at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
    at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
    at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
    at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
    at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
    at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
    at java.base/java.lang.Thread.run(Thread.java:840)

the script engine is in release 21.1.0 already included.

### In the previous version, when Keycloak was used on Java 17 with Javascript providers it was needed to add the Nashorn javascript engine to the distribution. This is no longer needed as Nashorn javascript engine is available in Keycloak server by default. see

it always run into exception.

How to Reproduce?

create docker image with custom authenticator script. [like this] (https://www.keycloak.org/docs/latest/server_development/#_script_providers)
deploy keycloak in docker or k8 cluster
use add script in web based authenticationflow and set as required

Anything else?

Answered by michaelottofits

Sep 12, 2025

Hey @KevPace

I created an image based on quay.io/keycloak/keycloak:26.3.0 and added the Nashorn JAR file with ASM dependencies to the provider folder “https://github.com/openjdk/nashorn”. It is important that the variable KC_PROXY_HEADERS=xforwarded is set, otherwise it will not work.

View full answer

ghost · 2025-09-12T12:56:20Z

ghost
Sep 12, 2025

Hey @michaelottofits have you fixed it?
And if yes how

1 reply

michaelottofits Sep 12, 2025
Author

Hey @KevPace

I created an image based on quay.io/keycloak/keycloak:26.3.0 and added the Nashorn JAR file with ASM dependencies to the provider folder “https://github.com/openjdk/nashorn”. It is important that the variable KC_PROXY_HEADERS=xforwarded is set, otherwise it will not work.

Answer selected by michaelottofits

Navigation Menu

Repository navigation

script engine not found but scripts are enabled #30448

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

script engine not found but scripts are enabled #30448

Uh oh!

michaelottofits Jun 14, 2024

Replies: 1 comment · 1 reply

Uh oh!

ghost Sep 12, 2025

Uh oh!

michaelottofits Sep 12, 2025 Author

michaelottofits
Jun 14, 2024

Replies: 1 comment 1 reply

ghost
Sep 12, 2025

michaelottofits Sep 12, 2025
Author