Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fails to delete authentication flow when it's referenced as an IdP first broker login flow alias #868

Open
akikoskinen opened this issue Apr 27, 2023 · 2 comments · May be fixed by #1208
Open
Assignees
Labels

Comments

@akikoskinen
Copy link
Contributor

Current Behavior

A custom authentication flow has been set as an identity provider's first broker login flow alias. In one step the identity provider's first broker login flow alias value is changed to another authentication flow and the previous authentication flow is removed.

Keycloak-config-cli tries to first remove the authentication flow. This results to a 500 response from Keycloak. Keycloak's log shows: Cannot remove authentication flow, it is currently in use.

Expected Behavior

Keycloak-config-cli should first change the identity provider's first broker login flow alias to the new value. The authentication flow should be removed only after that.

Steps To Reproduce

No response

Environment

  • Keycloak Version: 19.0.1
  • keycloak-config-cli Version: 5.5.0
  • Java Version: 11

Anything else?

This is similar to #349 in the sense that things should be done in the correct order.

@thomasdarimont
Copy link
Contributor

Thanks @akikoskinen for reporting this.
Could you provide a reproducer for this similar to that one? #623

@akikoskinen
Copy link
Contributor Author

Here are files to reproduce this. I took an existing test file as a base, slightly modified to suit this case (the filenames have a .txt extension, although they are JSON files, since GitHub doesn't accept files with a .json extension). This realm file adds an identity provider with a custom first (and post, I'll return to this later) login flow.

00-initialize.json.txt

In the next step the identity provider's first login flow is reset to the Keycloak's built-in "first broker login" authentication flow and the custom authentication flow ("my custom first login flow") is removed.

01a-reset-first-login-flow.json.txt

Applying this realm change causes the error and is all for reproducing the original bug reported in this issue.

But I found out that this same issue also concerns the identity provider's post login flow. The 00-initialize.json file also sets a custom post login flow for the identity provider. If in a second step the post login flow is reset (this time to an empty value, which removes any post login flow from the identity provider) and the custom authentication flow is removed, the same error occurs.

01b-reset-post-login-flow.json.txt

Applying these realm files don't need any special options to be used. I used something like

java -jar ./keycloak-config-cli-19.0.3.jar --keycloak.url=http://localhost:8080/auth --keycloak.user=admin --keycloak.password=admin --import.files.locations=./00-initialize.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Development

Successfully merging a pull request may close this issue.

3 participants