Keycloak Configuration File Does Not Work (App doesn't exist in role definitions: default-client)

[tom-rm-meyer-ISST]

Current Behavior

When starting the DTR chart enabling keycloak, does fail with following errors:

2024-04-02 07:59:02,071 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (import_export) mode
2024-04-02 07:59:02,071 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: App doesn't exist in role definitions: default-client

I tried using the Helm Chart autoinstall because I did not manage to create the expected keycloak configuration myself. The configuration file at least is not working for the following version combination:

• helm chart version (app version): 0.4.9 (0.4.1)
• keycloak version chart (appVersion): 16.1.7 (22.0.3)

When running keycloak in verbose (docker compose), following stacktrace is added:

keycloak-supplier  | 2024-04-02 08:09:33,466 INFO  [org.keycloak.exportimport.singlefile.SingleFileImportProvider] (main) Full importing from file /opt/keycloak/bin/../data/import/default-realm-import.json
keycloak-supplier  | 2024-04-02 08:09:35,079 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (development) mode
keycloak-supplier  | 2024-04-02 08:09:35,079 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) Error details:: java.lang.RuntimeException: App doesn't exist in role definitions: default-client
keycloak-supplier  |    at org.keycloak.models.utils.RepresentationToModel.importRoles(RepresentationToModel.java:144)
keycloak-supplier  |    at org.keycloak.storage.datastore.LegacyExportImportManager.importRealm(LegacyExportImportManager.java:352)
keycloak-supplier  |    at org.keycloak.models.utils.RepresentationToModel.importRealm(RepresentationToModel.java:127)
keycloak-supplier  |    at org.keycloak.services.managers.RealmManager.importRealm(RealmManager.java:571)
keycloak-supplier  |    at org.keycloak.exportimport.util.ImportUtils.importRealm(ImportUtils.java:111)
keycloak-supplier  |    at org.keycloak.exportimport.util.ImportUtils.importRealms(ImportUtils.java:66)
keycloak-supplier  |    at org.keycloak.exportimport.singlefile.SingleFileImportProvider$1.runExportImportTask(SingleFileImportProvider.java:65)
keycloak-supplier  |    at org.keycloak.exportimport.util.ExportImportSessionTask.run(ExportImportSessionTask.java:35)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.lambda$runJobInTransaction$1(KeycloakModelUtils.java:261)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:383)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:260)
keycloak-supplier  |    at org.keycloak.exportimport.singlefile.SingleFileImportProvider.importModel(SingleFileImportProvider.java:61)
keycloak-supplier  |    at org.keycloak.exportimport.ExportImportManager$1.run(ExportImportManager.java:150)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.lambda$runJobInTransaction$1(KeycloakModelUtils.java:261)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:383)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:260)
keycloak-supplier  |    at org.keycloak.exportimport.ExportImportManager.runImportAtStartup(ExportImportManager.java:145)
keycloak-supplier  |    at org.keycloak.services.resources.KeycloakApplication.importRealms(KeycloakApplication.java:261)
keycloak-supplier  |    at org.keycloak.services.resources.KeycloakApplication.bootstrap(KeycloakApplication.java:214)
keycloak-supplier  |    at org.keycloak.services.resources.KeycloakApplication$2.lambda$run$0(KeycloakApplication.java:146)
keycloak-supplier  |    at org.keycloak.models.dblock.DBLockGlobalLockProvider.withLock(DBLockGlobalLockProvider.java:77)
keycloak-supplier  |    at org.keycloak.models.locking.GlobalLockProvider.withLock(GlobalLockProvider.java:45)
keycloak-supplier  |    at org.keycloak.services.resources.KeycloakApplication$2.run(KeycloakApplication.java:146)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.lambda$runJobInTransaction$1(KeycloakModelUtils.java:261)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:383)
keycloak-supplier  |    at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:260)
keycloak-supplier  |    at org.keycloak.services.resources.KeycloakApplication.startup(KeycloakApplication.java:142)
keycloak-supplier  |    at org.keycloak.quarkus.runtime.integration.QuarkusLifecycleObserver.onStartupEvent(QuarkusLifecycleObserver.java:37)
keycloak-supplier  |    at org.keycloak.quarkus.runtime.integration.QuarkusLifecycleObserver_Observer_onStartupEvent_c9888fa6c2aa9208d4625ee9d83de6fd77e22c83.notify(Unknown Source)
keycloak-supplier  |    at io.quarkus.arc.impl.EventImpl$Notifier.notifyObservers(EventImpl.java:346)
keycloak-supplier  |    at io.quarkus.arc.impl.EventImpl$Notifier.notify(EventImpl.java:328)
keycloak-supplier  |    at io.quarkus.arc.impl.EventImpl.fire(EventImpl.java:82)
keycloak-supplier  |    at io.quarkus.arc.runtime.ArcRecorder.fireLifecycleEvent(ArcRecorder.java:155)
keycloak-supplier  |    at io.quarkus.arc.runtime.ArcRecorder.handleLifecycleEvents(ArcRecorder.java:106)
keycloak-supplier  |    at io.quarkus.deployment.steps.LifecycleEventsBuildStep$startupEvent1144526294.deploy_0(Unknown Source)
keycloak-supplier  |    at io.quarkus.deployment.steps.LifecycleEventsBuildStep$startupEvent1144526294.deploy(Unknown Source)
keycloak-supplier  |    at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
keycloak-supplier  |    at io.quarkus.runtime.Application.start(Application.java:101)
keycloak-supplier  |    at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:111)
keycloak-supplier  |    at io.quarkus.runtime.Quarkus.run(Quarkus.java:71)
keycloak-supplier  |    at org.keycloak.quarkus.runtime.KeycloakMain.start(KeycloakMain.java:98)
keycloak-supplier  |    at org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.run(AbstractStartCommand.java:37)
keycloak-supplier  |    at picocli.CommandLine.executeUserObject(CommandLine.java:2026)
keycloak-supplier  |    at picocli.CommandLine.access$1500(CommandLine.java:148)
keycloak-supplier  |    at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
keycloak-supplier  |    at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
keycloak-supplier  |    at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
keycloak-supplier  |    at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
keycloak-supplier  |    at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
keycloak-supplier  |    at picocli.CommandLine.execute(CommandLine.java:2170)
keycloak-supplier  |    at org.keycloak.quarkus.runtime.cli.Picocli.parseAndRun(Picocli.java:100)
keycloak-supplier  |    at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:88)
keycloak-supplier  |    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
keycloak-supplier  |    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
keycloak-supplier  |    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
keycloak-supplier  |    at java.base/java.lang.reflect.Method.invoke(Method.java:568)
keycloak-supplier  |    at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:61)
keycloak-supplier  |    at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:32)
keycloak-supplier  | 
keycloak-supplier exited with code 1

Also the default chart is not working as the configmap is hard coded to init-script-vol in value keycloak.extraVolumes[init-script-vol].configMap.name but configmap name is derived from release name in init-script-configmap.yaml template.

Expected Behavior

Keycloak example installs and supports on using the idp integration.

Steps To Reproduce

• adapt values.yaml
  • enableKeycloak: true
  • registry.auth.password: <some pw>
  • keycloak.extraVolumes[init-script-vol].configMap.name: registry-digital-twin-registry-keycloak-configmap
• install following INSTALL.md
• check logs of keycloak kubectl -n semantics logs registry-keycloak-0