Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NPE in AuthenticationManager backchannelLogout #23306

Closed
2 tasks done
thomasdarimont opened this issue Sep 17, 2023 · 1 comment · Fixed by #23307
Closed
2 tasks done

NPE in AuthenticationManager backchannelLogout #23306

thomasdarimont opened this issue Sep 17, 2023 · 1 comment · Fixed by #23307
Labels
area/core kind/bug Categorizes a PR related to a bug
Milestone
22.0.4

Comments

@thomasdarimont
Copy link
Contributor

Before reporting an issue

Area

core

Describe the bug

In a customer project we observed UncaughtServerErrors which where caused by NPEs being thrown in AuthenticationManager#backchannelLogout. This is caused by accessing the user variable obtained from userSession.getUser() without a proper null check.

Version

22.0.1

Expected behavior

Should logout null for the username instead of throwing a NPE.

Actual behavior

BackchannelLogout sometimes yields an UncaughtServerError based on an NPE in AuthenticationManager#backchannelLogout.

How to Reproduce?

Hard to reproduce, as we need to create the sitation where the userSession is still present but the user object is gone.

Anything else?

No response
@thomasdarimont thomasdarimont added kind/bug Categorizes a PR related to a bug status/triage labels Sep 17, 2023
@thomasdarimont thomasdarimont mentioned this issue Sep 17, 2023
Merged
thomasdarimont added a commit to thomasdarimont/keycloak that referenced this issue Sep 17, 2023
@thomasdarimont
Prevent NPE in AuthenticationManager.backchannelLogout (keycloak#23306)
6dd1a97 
Previously, if the user was already removed from the userSession
and the log level was set to DEBUG, then an NPE was triggered by
the debug log statement during backchannelLogout.

Fixes keycloak#23306
@ghost ghost removed the status/triage label Sep 18, 2023
ahus1 pushed a commit that referenced this issue Sep 18, 2023
@thomasdarimont @ahus1
Prevent NPE in AuthenticationManager.backchannelLogout (#23306)
04d16ed 
Previously, if the user was already removed from the userSession
and the log level was set to DEBUG, then an NPE was triggered by
the debug log statement during backchannelLogout.

Fixes #23306
@ahus1
Copy link
Contributor

ahus1 commented Sep 18, 2023

Thank you for fixing this. If you'd create a backport for KC22, I'd be happy to merge that PR as well.

thomasdarimont added a commit to thomasdarimont/keycloak that referenced this issue Sep 18, 2023
@thomasdarimont
Prevent NPE in AuthenticationManager.backchannelLogout (keycloak#23306)
765e034 
Previously, if the user was already removed from the userSession
and the log level was set to DEBUG, then an NPE was triggered by
the debug log statement during backchannelLogout.

Fixes keycloak#23306

(cherry picked from commit 04d16ed)
@thomasdarimont thomasdarimont mentioned this issue Sep 18, 2023
Merged
@ahus1 ahus1 added this to the 22.0.4 milestone Sep 18, 2023
ahus1 pushed a commit that referenced this issue Sep 18, 2023
@thomasdarimont
Prevent NPE in AuthenticationManager.backchannelLogout (#23313)
a3ec768 
Previously, if the user was already removed from the userSession
and the log level was set to DEBUG, then an NPE was triggered by
the debug log statement during backchannelLogout.

Fixes #23306

(cherry picked from commit 04d16ed)
srose pushed a commit to srose/keycloak that referenced this issue Dec 20, 2023
@thomasdarimont @srose
Prevent NPE in AuthenticationManager.backchannelLogout (keycloak#23306)
7f46492 
Previously, if the user was already removed from the userSession
and the log level was set to DEBUG, then an NPE was triggered by
the debug log statement during backchannelLogout.

Fixes keycloak#23306
kamontat pushed a commit to kamontat/keycloak that referenced this issue Jan 20, 2024
@thomasdarimont @kamontat
Prevent NPE in AuthenticationManager.backchannelLogout (keycloak#23306)
5fd0728 
Previously, if the user was already removed from the userSession
and the log level was set to DEBUG, then an NPE was triggered by
the debug log statement during backchannelLogout.

Fixes keycloak#23306

Signed-off-by: Kamontat Chantrachirathumrong <14089557+kamontat@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/core kind/bug Categorizes a PR related to a bug
Projects
None yet
Milestone
22.0.4
Development

Successfully merging a pull request may close this issue.

Prevent NPE in AuthenticationManager.backchannelLogout (#23306) thomasdarimont/keycloak
2 participants
@thomasdarimont @ahus1