You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Client impersonate in Fine Grained Admin Permissions V2
#40035
I'm facing one problem in new version of keycloak and new version of Fine Grained Admin Permissions - V2, since V1 has been depricated/archived. https://www.keycloak.org/2025/05/fgap-kc-26-2
In V1, I have ability to create policy with client_id and add it to admin-impersonating.permission.users permissions. Witch mean client could get token of any user.
Now, with new version of FGAP v2, I cannot archive it.
If I try to create Client permission, I cannot choose impersonate:
However, if I configure User permission with policy that is created for client:
I'm getting next error:
2025-05-28 13:59:57,397 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-41) Uncaught server error: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.RealmModel.getName()" because "realm" is null
at org.keycloak.services.managers.RealmManager.isAdministrationRealm(RealmManager.java:100)
at org.keycloak.services.resources.admin.permissions.MgmtPermissions.hasOneAdminRole(MgmtPermissions.java:158)
at org.keycloak.services.resources.admin.permissions.MgmtPermissions.hasOneAdminRole(MgmtPermissions.java:152)
at org.keycloak.services.resources.admin.permissions.UserPermissionsV2.canImpersonate(UserPermissionsV2.java:97)
at org.keycloak.services.resources.admin.permissions.UserPermissionsV2.canClientImpersonate(UserPermissionsV2.java:162)
at org.keycloak.protocol.oidc.tokenexchange.V1TokenExchangeProvider.tokenExchange(V1TokenExchangeProvider.java:133)
at org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider.exchange(AbstractTokenExchangeProvider.java:134)
at org.keycloak.protocol.oidc.grants.TokenExchangeGrantType.process(TokenExchangeGrantType.java:92)
at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:151)
at org.keycloak.protocol.oidc.endpoints.TokenEndpoint$quarkusrestinvoker$processGrantRequest_6408e15340992839b66447750c221d9aaa837bd7.invoke(Unknown Source)
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:638)
at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2675)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2654)
at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1627)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1594)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Unknown Source)
Are there some who were faceing the same problem like me? Maybe I didn't follow some staps, but I didn't find any dokumentation regarding configure impersonate with new FGAP v2.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted w
338F
ith heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi all,
I'm facing one problem in new version of keycloak and new version of Fine Grained Admin Permissions - V2, since V1 has been depricated/archived.
https://www.keycloak.org/2025/05/fgap-kc-26-2
In V1, I have ability to create policy with client_id and add it to admin-impersonating.permission.users permissions. Witch mean client could get token of any user.
Now, with new version of FGAP v2, I cannot archive it.
If I try to create Client permission, I cannot choose impersonate:
However, if I configure User permission with policy that is created for client:
I'm getting next error:
Are there some who were faceing the same problem like me? Maybe I didn't follow some staps, but I didn't find any dokumentation regarding configure impersonate with new FGAP v2.
All reactions