Uploaded image for project: 'RH-SSO'
  1. RH-SSO
  2. RHSSO-1697

[GSS] org.keycloak.storage.ReadOnlyException Error when creating realm with a newly imported admin user when Import Users is set to off

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • Archive - 21'
    • RH-SSO-7.2.5.GA, RH-SSO-7.3.0.GA
    • Server
    • None
    • Major
    • Major
    • Hide

      In RH-SSO 7.2.5 :
      ~~~

      • switch to master realm
      • configure calid user federation with connection to a LDAP server; read only mode and import users to "on"
      • go to the users page, search for the ldap user XYZ, modify the now imported user XYZ and give him admin rights
      • switch the "import users" setting in the user configuration to "off" to avoid importing more users from LDAP to the realm
      • logout and login again as the newly imported user XYZ
      • try to create a new realm
        -> this should be failing until the "import users" option would switched back to "on"
        -> the logs show an Uncaught server error: org.keycloak.storage.ReadOnlyException
      • see attached logs [ rhsso-createrealm-exception.txt (6 KB) ].
        ~~~

      Also, the same issue is reproduced with using the currently latest Keycloak 4.8.3.Final:
      ~~~

      • sudo docker run --rm -p 8080:8080 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin --name kc jboss/keycloak:4.8.3.Final
      • execute the same steps as mentioned above
      • see attached logs for the exception traces [ keycloak-createrealm-exception.txt (7 KB) ]
        ~~~
      Show
      In RH-SSO 7.2.5 : ~~~ switch to master realm configure calid user federation with connection to a LDAP server; read only mode and import users to "on" go to the users page, search for the ldap user XYZ, modify the now imported user XYZ and give him admin rights switch the "import users" setting in the user configuration to "off" to avoid importing more users from LDAP to the realm logout and login again as the newly imported user XYZ try to create a new realm -> this should be failing until the "import users" option would switched back to "on" -> the logs show an Uncaught server error: org.keycloak.storage.ReadOnlyException see attached logs [ rhsso-createrealm-exception.txt (6 KB) ]. ~~~ Also, the same issue is reproduced with using the currently latest Keycloak 4.8.3.Final: ~~~ sudo docker run --rm -p 8080:8080 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin --name kc jboss/keycloak:4.8.3.Final execute the same steps as mentioned above see attached logs for the exception traces [ keycloak-createrealm-exception.txt (7 KB) ] ~~~

      A customer is using RH-SSO 7.2.5, and reported that when creating a new realm with a user imported from LDAP user federation, the operation fails and RH SSO is answering with a 500 internal server exception, provided that "import users" in the user federation configuration is switched off.

      The following error/exception is reported in the RH-SSO logs:
      ~~~
      11:03:11,204 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-17) Uncaught server error: org.keycloak.storage.ReadOnlyException
      at org.keycloak.models.utils.ReadOnlyUserModelDelegate.grantRole(ReadOnlyUserModelDelegate.java:133)
      at org.keycloak.models.utils.UserModelDelegate.grantRole(UserModelDelegate.java:179)
      at org.keycloak.models.utils.UserModelDelegate.grantRole(UserModelDelegate.java:179)
      at org.keycloak.models.utils.UserModelDelegate.grantRole(UserModelDelegate.java:179)
      at org.keycloak.models.utils.UserModelDelegate.grantRole(UserModelDelegate.java:179)
      at org.keycloak.models.utils.UserModelDelegate.grantRole(UserModelDelegate.java:179)
      at org.keycloak.models.cache.infinispan.UserAdapter.grantRole(UserAdapter.java:316)
      at org.keycloak.services.resources.admin.RealmsAdminResource.grantPermissionsToRealmCreator(RealmsAdminResource.java:163)
      at org.keycloak.services.resources.admin.RealmsAdminResource.importRealm(RealmsAdminResource.java:142)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:498)
      at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
      at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
      at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
      ...
      ...

      ~~~

      Please see the "Steps to Reproduce" and attached files for more.

        1. keycloak-createrealm-exception.txt
          8 kB
        2. rhsso-createrealm-exception.txt
          7 kB

              Unassigned Unassigned
              rhn-support-igueye Issa Gueye
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: