Repository navigation
Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null #28100
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
identity-brokering, ldap
Describe the bug
I'm using Keycloak v24.0.1 with both
- another keycloak server as an identity provider (let's call that "foo")
- an LDAP User federation (with Kerberos SSO).
I had tested both separately and it worked. But when BOTH are enabled, the following occurs, see the descriptions in the sections below.
As soon as I disable the LDAP user federation, it will work.
I should add, the LDAP user federation is configured as follows:
- Edit mode: UNSYNCED
- Import Users: On
- Sync Registrations: Off
Version
24.0.1
Regression
- The issue is a regression
Expected behavior
Successful login with the "foo" keycloak IDP
Actual behavior
After the steps described in "How to Reproduce", the GUI shows "An Error occurred", and the log shows:
2024-03-20 15:37:29,305 WARN [org.keycloak.services] (executor-thread-10) KC-SERVICES0013: Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null
at org.keycloak.models.utils.UserModelDelegate.getFederationLink(UserModelDelegate.java:195)
at org.keycloak.storage.ldap.LDAPStorageProvider.lambda$decorateUserProfile$23(LDAPStorageProvider.java:1115)
at org.keycloak.userprofile.AttributeMetadata.isSelected(AttributeMetadata.java:132)
at org.keycloak.userprofile.DefaultAttributes.configureMetadata(DefaultAttributes.java:332)
at org.keycloak.userprofile.DefaultAttributes.<init>(DefaultAttributes.java:87)
at org.keycloak.userprofile.DeclarativeUserProfileProvider.createAttributes(DeclarativeUserProfileProvider.java:112)
at org.keycloak.userprofile.DeclarativeUserProfileProvider.createUserProfile(DeclarativeUserProfileProvider.java:139)
at org.keycloak.userprofile.DeclarativeUserProfileProvider.create(DeclarativeUserProfileProvider.java:122)
at org.keycloak.authentication.authenticators.broker.IdpReviewProfileAuthenticator.actionImpl(IdpReviewProfileAuthenticator.java:196)
at org.keycloak.authentication.authenticators.broker.AbstractIdpAuthenticator.action(AbstractIdpAuthenticator.java:93)
at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:151)
at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:987)
How to Reproduce?
- Go to the keycloak login form
- Click the button at the bottom to sign in with the "foo" keycloak IDP
- At the "foo" keycloak IDP, choose a user not yet known to our own idp, and without email address, and login.
- After redirect back at our IDP, the "Update Account Information" form shows up. Enter an Email address and click "submit".
- Now the errors occur as described in "Actual behavior".
Anything else?
No response
Reacted by Zernov-A, Christian Spitschka and StManolo
Metadata
Metadata
Assignees
Labels
Type
Fields
No fields configured for issues without a type.
Activity
pedroigor commentedon Mar 20, 2024
@fjf2002 Did you manage to have both working on previous versions?
fjf2002 commentedon Mar 21, 2024
@pedroigor: Unknown.
Do you expect me to setup Keycloak v23 or v22 and test that?
ArminRadmueller commentedon Mar 22, 2024
same problem with Verion 24.0.1 and Microsoft Entra ID.
I have noticed that if you create the social link on a user manually, the login with Entra ID works.
pedroigor commentedon Mar 25, 2024
@ArminRadmueller @fjf2002 I think I know what is going on. During the first broker login flow we are not dealing with the fact that the
federation link(basically, the user federation provider ID) does not exist. See https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpReviewProfileAuthenticator.java#L115.We need to override the
getFederationLinkand return null in that case.We also don't have enough coverage for brokering and LDAP enabled at the same time. We should update our test suite to cover such usage.
Resolve the user federation link as null when decorating the user pro…
3 remaining items
Resolve the user federation link as null when decorating the user pro…
Resolve the user federation link as null when decorating the user pro…
pedroigor commentedon Mar 26, 2024
@fjf2002 Please, let me know if that fix works well for you. I managed to reproduce it in that test by enabling Kerberos to a realm without running any other step to authenticate the user but just log in from the broker.
I hope it is enough to cover this usage.
ArminRadmueller commentedon Mar 27, 2024
Unfortunately I don't know exactly how to test. Would it be possible to release this fix in a 24.0.3?
fjf2002 commentedon Mar 27, 2024
I have tested using the nightly build. Works. Thank You for patching that quickly.
Resolve the user federation link as null when decorating the user pro…
Merged PR 43762: Update dependency org.keycloak:keycloak-authz-client…