Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null

[fjf2002]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

identity-brokering, ldap

Describe the bug

I'm using Keycloak v24.0.1 with both

• another keycloak server as an identity provider (let's call that "foo")
• an LDAP User federation (with Kerberos SSO).

I had tested both separately and it worked. But when BOTH are enabled, the following occurs, see the descriptions in the sections below.

As soon as I disable the LDAP user federation, it will work.

I should add, the LDAP user federation is configured as follows:

• Edit mode: UNSYNCED
• Import Users: On
• Sync Registrations: Off

Version

24.0.1

Regression

• The issue is a regression

Expected behavior

Successful login with the "foo" keycloak IDP

Actual behavior

After the steps described in "How to Reproduce", the GUI shows "An Error occurred", and the log shows:

2024-03-20 15:37:29,305 WARN  [org.keycloak.services] (executor-thread-10) KC-SERVICES0013: Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null
	at org.keycloak.models.utils.UserModelDelegate.getFederationLink(UserModelDelegate.java:195)
	at org.keycloak.storage.ldap.LDAPStorageProvider.lambda$decorateUserProfile$23(LDAPStorageProvider.java:1115)
	at org.keycloak.userprofile.AttributeMetadata.isSelected(AttributeMetadata.java:132)
	at org.keycloak.userprofile.DefaultAttributes.configureMetadata(DefaultAttributes.java:332)
	at org.keycloak.userprofile.DefaultAttributes.<init>(DefaultAttributes.java:87)
	at org.keycloak.userprofile.DeclarativeUserProfileProvider.createAttributes(DeclarativeUserProfileProvider.java:112)
	at org.keycloak.userprofile.DeclarativeUserProfileProvider.createUserProfile(DeclarativeUserProfileProvider.java:139)
	at org.keycloak.userprofile.DeclarativeUserProfileProvider.create(DeclarativeUserProfileProvider.java:122)
	at org.keycloak.authentication.authenticators.broker.IdpReviewProfileAuthenticator.actionImpl(IdpReviewProfileAuthenticator.java:196)
	at org.keycloak.authentication.authenticators.broker.AbstractIdpAuthenticator.action(AbstractIdpAuthenticator.java:93)
	at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:151)
	at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:987)

How to Reproduce?

• Go to the keycloak login form
• Click the button at the bottom to sign in with the "foo" keycloak IDP
• At the "foo" keycloak IDP, choose a user not yet known to our own idp, and without email address, and login.
• After redirect back at our IDP, the "Update Account Information" form shows up. Enter an Email address and click "submit".
• Now the errors occur as described in "Actual behavior".

Anything else?

No response

[pedroigor]

@fjf2002 Did you manage to have both working on previous versions?

[fjf2002]

@pedroigor: Unknown.
Do you expect me to setup Keycloak v23 or v22 and test that?

[ArminRadmueller]

same problem with Verion 24.0.1 and Microsoft Entra ID.
I have noticed that if you create the social link on a user manually, the login with Entra ID works.

[pedroigor]

@ArminRadmueller @fjf2002 I think I know what is going on. During the first broker login flow we are not dealing with the fact that the federation link (basically, the user federation provider ID) does not exist. See https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpReviewProfileAuthenticator.java#L115.

We need to override the getFederationLink and return null in that case.

We also don't have enough coverage for brokering and LDAP enabled at the same time. We should update our test suite to cover such usage.

[pedroigor]

@fjf2002 Please, let me know if that fix works well for you. I managed to reproduce it in that test by enabling Kerberos to a realm without running any other step to authenticate the user but just log in from the broker.

I hope it is enough to cover this usage.

[ArminRadmueller]

Unfortunately I don't know exactly how to test. Would it be possible to release this fix in a 24.0.3?

[fjf2002]

I have tested using the nightly build. Works. Thank You for patching that quickly.