Uploaded image for project: 'Red Hat build of Keycloak'
  1. Red Hat build of Keycloak
  2. RHBK-1017

[GHI#26665] Unable to modify access token lifespan at realm level. Keycloak stops working.

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      Before reporting an issue

      [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

      Area

      admin/ui

      Describe the bug

      I'm starting my Keycloak 23.0.5 instance in a docker container using a Postgres database also in docker.
      I go into a realm/Realm Settings/Tokens and try to modify access token lifespan to, let's say, 1 hour. Click on save.

      There is a java exception at the console:

      ```
      keycloak | 2024-01-31 17:39:33,263 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-5) Uncaught server error: java.lang.NumberFormatException: For input string: ""
      keycloak | at java.base/java.lang.NumberFormatException.forInputString(NumberFormatException.java:67)
      keycloak | at java.base/java.lang.Integer.parseInt(Integer.java:678)
      keycloak | at java.base/java.lang.Integer.valueOf(Integer.java:999)
      keycloak | at org.keycloak.models.jpa.RealmAdapter.lambda$getUserActionTokenLifespans$2(RealmAdapter.java:593)
      keycloak | at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
      keycloak | at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
      keycloak | at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
      keycloak | at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
      keycloak | at java.base/java.util.HashMap$EntrySpliterator.forEachRemaining(HashMap.java:1850)
      keycloak | at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
      keycloak | at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
      keycloak | at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
      keycloak | at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
      keycloak | at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
      keycloak | at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
      keycloak | at org.keycloak.models.jpa.RealmAdapter.getUserActionTokenLifespans(RealmAdapter.java:593)
      keycloak | at org.keycloak.models.cache.infinispan.entities.CachedRealm.<init>(CachedRealm.java:241)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheSession.prepareCachedRealm(RealmCacheSession.java:438)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheManager.computeSerialized(RealmCacheManager.java:142)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheSession.getRealm(RealmCacheSession.java:420)
      keycloak | at org.keycloak.models.jpa.JpaRealmProvider.getRealmByName(JpaRealmProvider.java:162)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheSession.prepareCachedRealmByName(RealmCacheSession.java:480)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheSession.lambda$getRealmByName$0(RealmCacheSession.java:472)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheManager.computeSerialized(RealmCacheManager.java:142)
      keycloak | at org.keycloak.models.cache.infinispan.RealmCacheSession.getRealmByName(RealmCacheSession.java:472)
      keycloak | at org.keycloak.services.managers.RealmManager.getRealmByName(RealmManager.java:98)
      keycloak | at org.keycloak.services.resources.admin.RealmsAdminResource.getRealmAdmin(RealmsAdminResource.java:192)
      keycloak | at org.keycloak.services.resources.admin.RealmsAdminResource$quarkusrestinvoker$getRealmAdmin_a79304c5f6b93bb8957395d5fd7a2ca5d97a5ae2.invoke(Unknown Source)
      keycloak | at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
      keycloak | at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
      keycloak | at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)
      keycloak | at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
      keycloak | at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
      keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
      keycloak | at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
      ```

      After that, it is impossible to list realms in the corresponding drop box on top left.

      The corresponding XHR request returns 400/unknown error.

      I still have access to master realm.

      But, if the modified realm is master itself, then keycloak stops working and doesn't even start again.

      The database looks corrupted and the only way I found to solve this is to restore it from a previous snapshot. This is very annoying.

      Version

      23.0.5

      Expected behavior

      Modifying access token lifespan at realm settings level should not affect instance's health.

      Actual behavior

      Keycloak stops working when modifying access token lifespan at realms settings level.

      How to Reproduce?

      Go into a realm/Realm Settings/Tokens and try to modify access token lifespan to, let's say, 1 hour. Click on save.
      Also do it for master realm.

      Anything else?

      No response

              Unassigned Unassigned
              pvlha Pavel Vlha
              Keycloak Core (shared)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: