script engine not found but scripts are enabled

[michaelottofits]

Keycloak 24.0.1 in Kubernetes Cluster.

I get the message Could not find ScriptEngine for script

Expected behavior
keycloak execute script on authentication flow

Actual behavior

2024-06-14 13:21:31,079 WARN  [org.keycloak.services] (executor-thread-1) KC-SERVICES0013: Failed authentication: java.lang.IllegalStateException: Could not find ScriptEngine for script: Script{id='null', realmId='68e32d83-d467-4c97-b744-72c7082786f2', name='Keycloak-Authenticator-Console', type='text/javascript', code='/*
 * Template for JavaScript based authenticator's.
 * See org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticatorFactory
 */

// import enum for error lookup
AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

/**
 * An example authenticate function.
 *
 * The following variables are available for convenience:
 * user - current user {@see org.keycloak.models.UserModel}
 * realm - current realm {@see org.keycloak.models.RealmModel}
 * session - current KeycloakSession {@see org.keycloak.models.KeycloakSession}
 * httpRequest - current HttpRequest {@see org.jboss.resteasy.spi.HttpRequest}
 * script - current script {@see org.keycloak.models.ScriptModel}
 * authenticationSession - current authentication session {@see org.keycloak.sessions.AuthenticationSessionModel}
 * LOG - current logger {@see org.jboss.logging.Logger}
 *
 * You one can extract current http request headers via:
 * httpRequest.getHttpHeaders().getHeaderString("Forwarded")
 *
 * @param context {@see org.keycloak.authentication.AuthenticationFlowContext}
 */
function authenticate(context) {

    var username = user ? user.username : "anonymous";
    LOG.info(script.name + " trace auth for: " + username);
    var forEach = Array.prototype.forEach;    
    var client = context.getSession().getContext().getClient();
    var authShouldFail = true;   
   
    forEach.call(user.getClientRoleMappingsStream(client).toArray(), function(roleModel) 
    {  
        if(roleModel.getName().indexOf('console') !== -1)
        {
            authShouldFail = false;  
        }
    });


    if (authShouldFail) {

        context.failure(AuthenticationFlowError.ACCESS_DENIED);
        
        return;
    }

    context.success();
}', description='Keycloak Account Console'}
    at org.keycloak.scripting.DefaultScriptingProvider.getPreparedScriptEngine(DefaultScriptingProvider.java:114)
    at org.keycloak.scripting.DefaultScriptingProvider.prepareEvaluatableScript(DefaultScriptingProvider.java:74)
    at org.keycloak.scripting.DefaultScriptingProvider.prepareInvocableScript(DefaultScriptingProvider.java:55)
    at org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticator.getInvocableScriptAdapter(ScriptBasedAuthenticator.java:164)
    at org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticator.tryInvoke(ScriptBasedAuthenticator.java:120)
    at org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticator.authenticate(ScriptBasedAuthenticator.java:103)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:442)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:246)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:377)
    at org.keycloak.authentication.DefaultAuthenticationFlow.continueAuthenticationAfterSuccessfulAction(DefaultAuthenticationFlow.java:178)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:154)
    at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:987)
    at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:364)
    at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:335)
    at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:327)
    at org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:392)
    at org.keycloak.services.resources.LoginActionsService$quarkusrestinvoker$authenticateForm_32b8e198ac3110abd1d5774e83a4cf87858129f4.invoke(Unknown Source)
    at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
    at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
    at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
    at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
    at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
    at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
    at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
    at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
    at java.base/java.lang.Thread.run(Thread.java:840)

the script engine is in release 21.1.0 already included.

### In the previous version, when Keycloak was used on Java 17 with Javascript providers it was needed to add the Nashorn javascript engine to the distribution. This is no longer needed as Nashorn javascript engine is available in Keycloak server by default. see

it always run into exception.

How to Reproduce?

• create docker image with custom authenticator script. [like this] (https://www.keycloak.org/docs/latest/server_development/#_script_providers)
• deploy keycloak in docker or k8 cluster
• use add script in web based authenticationflow and set as required

Anything else?

[ghost]

Hey @michaelottofits have you fixed it?
And if yes how

[michaelottofits]

Hey @KevPace

I created an image based on quay.io/keycloak/keycloak:26.3.0 and added the Nashorn JAR file with ASM dependencies to the provider folder “https://github.com/openjdk/nashorn”. It is important that the variable KC_PROXY_HEADERS=xforwarded is set, otherwise it will not work.