Repository navigation
Script providers not working on OpenJDK 17 due to Nashorn being deprecated #9945
Description
Describe the bug
Hitting this below exception when I run the org.keycloak.testsuite.authz.* module tests
and here is the reference for the deprecation notice in openjdk - https://openjdk.java.net/jeps/372
I was able to confirm the same runs just fine with JDK11 runtime for the authserver. This would be a blocker for the Java 17 certification tests.
Caused by: java.lang.IllegalStateException: Could not find ScriptEngine for script: Script{id='null', realmId='0cfba609-5d40-404f-a3eb-769cf46dcff8', name='Grant Policy', type='text/javascript', code='$evaluation.grant();', description='null'}
This is also was previously discussed in KEYCLOAK-12755
Version
17.0.0-SNAPSHOT, OpenJDK17
Expected behavior
We would like the javascript engine to initialize and not fail on the authorization work flows
Actual behavior
The suspicion is that because of the deprecated Nashorn js engine in jdk17, we are getting a Could not find ScriptEngine for script IllegalStateExceptions.
I think we also want a proper exception to bubble up the stack trace, as currently we get a generic exception which is
Unexpected error while evaluating permissions: java.lang.RuntimeException: Failed to evaluate permissions even though we get the actual problem the stack trace down the line.
How to Reproduce?
run the authz module testsuite using the below mvn command
set the right binary path for the JDK17_HOME and MVN_SETTINGS_PATH before you run it.
mvn -f testsuite/integration-arquillian/tests/base/pom.xml clean install -Dauth.server.java.home=${JDK17_HOME} -Dauth.server.memory.settings="-Xms128m -Xmx512m -XX:MetaspaceSize=96m -XX:MaxMetaspaceSize=256m" -Dapp.server.memory.settings="-Xms128m -Xmx512m -XX:MetaspaceSize=96m -XX:MaxMetaspaceSize=256m" -B -s ${MVN_SETTINGS_PATH} -Dsettings.path=${MVN_SETTINGS_PATH} -Dsurefire.memory.Xms=512m -Dsurefire.memory.Xmx=1536m -Dinsecure.repositories=WARN -Pauth-server-wildfly -Pjava11-auth-server -Dtest=org.keycloak.testsuite.authz.AuthorizationTest
Anything else?
Issue full stack trace:
2022-02-01 20:07:38,427 ERROR [org.keycloak.authorization.authorization.AuthorizationTokenService] (default task-1) Unexpected error while evaluating permissions: java.lang.RuntimeException: Failed to evaluate permissions
at org.keycloak.keycloak-server-spi-private@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.evaluation.DecisionPermissionCollector.onError(DecisionPermissionCollector.java:182)
at org.keycloak.keycloak-server-spi-private@17.0.0-SNAPSHOT//org.keycloak.authorization.permission.evaluator.IterablePermissionEvaluator.evaluate(IterablePermissionEvaluator.java:71)
at org.keycloak.keycloak-server-spi-private@17.0.0-SNAPSHOT//org.keycloak.authorization.permission.evaluator.IterablePermissionEvaluator.evaluate(IterablePermissionEvaluator.java:87)
at org.keycloak.keycloak-services@17.0.0-SNAPSHOT//org.keycloak.authorization.authorization.AuthorizationTokenService.evaluatePermissions(AuthorizationTokenService.java:285)
at org.keycloak.keycloak-services@17.0.0-SNAPSHOT//org.keycloak.authorization.authorization.AuthorizationTokenService.authorize(AuthorizationTokenService.java:222)
.
.
.
.
Caused by: java.lang.IllegalStateException: Could not find ScriptEngine for script: Script{id='null', realmId='0cfba609-5d40-404f-a3eb-769cf46dcff8', name='Grant Policy', type='text/javascript', code='$evaluation.grant();', description='null'}
at org.keycloak.keycloak-services@17.0.0-SNAPSHOT//org.keycloak.scripting.DefaultScriptingProvider.createPreparedScriptEngine(DefaultScriptingProvider.java:106)
at org.keycloak.keycloak-services@17.0.0-SNAPSHOT//org.keycloak.scripting.DefaultScriptingProvider.prepareEvaluatableScript(DefaultScriptingProvider.java:72)
at org.keycloak.keycloak-services@17.0.0-SNAPSHOT//org.keycloak.scripting.DefaultScriptingProvider.prepareEvaluatableScript(DefaultScriptingProvider.java:33)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.js.JSPolicyProviderFactory.lambda$getEvaluatableScript$0(JSPolicyProviderFactory.java:109)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.js.ScriptCache.lambda$computeIfAbsent$0(ScriptCache.java:80)
at java.base/java.util.HashMap.computeIfAbsent(HashMap.java:1220)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.js.ScriptCache.computeIfAbsent(ScriptCache.java:80)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.js.JSPolicyProviderFactory.getEvaluatableScript(JSPolicyProviderFactory.java:106)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.js.JSPolicyProvider.evaluate(JSPolicyProvider.java:46)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.permission.AbstractPermissionProvider.evaluate(AbstractPermissionProvider.java:56)
at org.keycloak.keycloak-authz-policy-common@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.provider.permission.ResourcePolicyProvider.evaluate(ResourcePolicyProvider.java:47)
at org.keycloak.keycloak-server-spi-private@17.0.0-SNAPSHOT//org.keycloak.authorization.policy.evaluation.DefaultPolicyEvaluator.lambda$createPolicyEvaluator$0(DefaultPolicyEvaluator.java:116)
Metadata
Metadata
Assignees
Labels
Type
Fields
Projects
- Status
Activity
[-]Keycloak Auth server on Java17 faces issue with starting the deprecated javascript engine Nashorn[/-][+]Keycloak Auth server on OpenJDK17 faces issue with starting the deprecated javascript engine Nashorn[/+][-]Keycloak Auth server on OpenJDK17 faces issue with starting the deprecated javascript engine Nashorn[/-][+]Script providers not working on OpenJDK 17 due to Nashorn being deprecated[/+]stianst commentedon Feb 7, 2022
Nashhorn is available as a standalone module for OpenJDK 15+ (https://github.com/openjdk/nashorn).
However, Nashorn and its dependencies has to be placed on the module-path rather than the class-path. The above project also doesn't seem extremely active, so still to be seen if it will actually work properly or not.
kami619 commentedon Feb 7, 2022
thats true @stianst the fact that their guides are also based on Java 14 might make things even more tricker to get it right as we have to have all its transitive dependencies added to the app module path, quoting from their current docs
Nashorn is a JPMS module, so make sure it and its transitive dependencies (Nashorn depends on several ASM JARs) are on your application's module path, or appropriately added to a module layer, or otherwise configured as modules.stianst commentedon Feb 8, 2022
Infinispan team has the same issue and has somewhat workaround it by requiring users to install either Nashorn standalone or GraalVM js
mposolda commentedon May 23, 2022
Related documentation issue: keycloak/keycloak-documentation#1536
Related quickstarts issue: keycloak/keycloak-quickstarts#324
Make script providers working on JDK 17 (#11322)