Hi, I am currently trying to configure my Keycloak Server (24.0.1) to be Federated via SSSD with my RedHat Idm server. I have created a Keycloak Realm, that has the SSSD Federation created. This Realm has a client that I am using the authenticate into my application.
When I hit the application I am trying to authenticate, the associated client uri is hit and the login page comes up. When I provide my credentials that are being managed within the Idm server I am getting a message on the UI saying the following.
We are sorry...
Unexpected error when handling authentication request to identity provider.
Checking the logs on Keycloak it appears to be an issue with the Database. Logs below.
Any insight on this issue would be greatly appreciated.
SSSD Configuration File
[domain/mydomain.com]
id_provider = ipa
ipa_server = _srv_, ipa.mydomain.com
ipa_domain = mydomain.com
ipa_hostname = keycloak.mydomain.com
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber
krb5_store_password_if_offline = True
[sssd]
services = nss, pam, ssh, sudo, ifp
domains = mydomain.com
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
allowed_uids = root
user_attributes = +mail, +telephoneNumber, +givenname, +sn
[session_recording]
Keycloak Logs
Mar 21 21:57:14 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:14,112 INFO [io.quarkus] (main) Keycloak 24.0.1 on JVM (powered by Quarkus 3.8.1) started in 7.741s. Listening on: https://0.0.0.0:443
Mar 21 21:57:14 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:14,113 INFO [io.quarkus] (main) Profile prod activated.
Mar 21 21:57:14 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:14,113 INFO [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, keycloak, logging-gelf, narayana-jta, reactive-routes, resteasy-reactive, resteasy-reactive-jackson, smallrye-context-propagation, vertx]
Mar 21 21:57:35 mykeycloak.com java[5321]: pam_sss(keycloak:auth): authentication success; logname= uid=0 euid=0 tty= ruser= rhost= user=myuser
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:36,089 WARN [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (executor-thread-1) SQL Error: 23505, SQLState: 23505
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:36,090 ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (executor-thread-1) Unique index or primary key violation: "PUBLIC.UK_DYKN684SL8UP1CRFEI6ECKHD7_INDEX_B ON PUBLIC.USER_ENTITY(REALM_ID NULLS FIRST, EMAIL_CONSTRAINT NULLS FIRST) VALUES ( /* key:2 */ 'bcaeb69c-2b49-41d0-8613-4cdead92a771', 'myuser@domain.com')"; SQL statement:
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: update USER_ENTITY set CREATED_TIMESTAMP=?,EMAIL=?,EMAIL_CONSTRAINT=?,EMAIL_VERIFIED=?,ENABLED=?,FEDERATION_LINK=?,FIRST_NAME=?,LAST_NAME=?,NOT_BEFORE=?,REALM_ID=?,SERVICE_ACCOUNT_CLIENT_LINK=?,USERNAME=? where ID=? [23505-224]
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:36,093 WARN [org.keycloak.services] (executor-thread-1) KC-SERVICES0013: Failed authentication: org.keycloak.models.ModelDuplicateException: org.h2.jdbc.JdbcSQLIntegrityConstraintViolationException: Unique index or primary key violation: "PUBLIC.UK_DYKN684SL8UP1CRFEI6ECKHD7_INDEX_B ON PUBLIC.USER_ENTITY(REALM_ID NULLS FIRST, EMAIL_CONSTRAINT NULLS FIRST) VALUES ( /* key:2 */ 'bcaeb69c-2b49-41d0-8613-4cdead92a771', 'myuser@domain.com')"; SQL statement:
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: update USER_ENTITY set CREATED_TIMESTAMP=?,EMAIL=?,EMAIL_CONSTRAINT=?,EMAIL_VERIFIED=?,ENABLED=?,FEDERATION_LINK=?,FIRST_NAME=?,LAST_NAME=?,NOT_BEFORE=?,REALM_ID=?,SERVICE_ACCOUNT_CLIENT_LINK=?,USERNAME=? where ID=? [23505-224]
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.connections.jpa.PersistenceExceptionConverter.convert(PersistenceExceptionConverter.java:95)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:64)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at jdk.proxy2/jdk.proxy2.$Proxy70.flush(Unknown Source)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.models.jpa.UserAdapter.joinGroupImpl(UserAdapter.java:405)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.models.jpa.UserAdapter.joinGroup(UserAdapter.java:396)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.federation.sssd.SSSDFederationProvider.importUserToKeycloak(SSSDFederationProvider.java:140)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.federation.sssd.SSSDFederationProvider.findOrCreateAuthenticatedUser(SSSDFederationProvider.java:119)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.federation.sssd.SSSDFederationProvider.getUserByUsername(SSSDFederationProvider.java:82)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.storage.UserStorageManager.lambda$getUserByUsername$19(UserStorageManager.java:386)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.utils.ServicesUtils.lambda$timeBoundOne$1(ServicesUtils.java:83)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.SortedOps$RefSortingSink.end(SortedOps.java:400)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.Sink$ChainedReference.end(Sink.java:258)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:528)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:513)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.FindOps$FindOp.evaluateSequential(FindOps.java:150)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline.findFirst(ReferencePipeline.java:647)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.storage.UserStorageManager.getUserByUsername(UserStorageManager.java:386)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.models.cache.infinispan.UserCacheSession.getUserByUsername(UserCacheSession.java:270)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.userprofile.validator.DuplicateEmailValidator.validate(DuplicateEmailValidator.java:75)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.userprofile.AttributeValidatorMetadata.validate(AttributeValidatorMetadata.java:80)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.userprofile.DefaultAttributes.validate(DefaultAttributes.java:178)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.userprofile.DefaultUserProfile.validate(DefaultUserProfile.java:76)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.authentication.requiredactions.VerifyUserProfile.evaluateTriggers(VerifyUserProfile.java:63)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.managers.AuthenticationManager.evaluateRequiredAction(AuthenticationManager.java:1352)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.managers.AuthenticationManager.lambda$evaluateRequiredActionTriggers$19(AuthenticationManager.java:1323)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.util.stream.ReferencePipeline.forEachOrdered(ReferencePipeline.java:601)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.managers.AuthenticationManager.evaluateRequiredActionTriggers(AuthenticationManager.java:1323)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.managers.AuthenticationManager.nextRequiredAction(AuthenticationManager.java:1041)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.authentication.AuthenticationProcessor.nextRequiredAction(AuthenticationProcessor.java:1138)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.authentication.AuthenticationProcessor.authenticationComplete(AuthenticationProcessor.java:1128)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:995)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:364)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:335)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:327)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:392)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.services.resources.LoginActionsService$quarkusrestinvoker$authenticateForm_32b8e198ac3110abd1d5774e83a4cf87858129f4.invoke(Unknown Source)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.lang.Thread.run(Thread.java:840)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: Caused by: org.h2.jdbc.JdbcSQLIntegrityConstraintViolationException: Unique index or primary key violation: "PUBLIC.UK_DYKN684SL8UP1CRFEI6ECKHD7_INDEX_B ON PUBLIC.USER_ENTITY(REALM_ID NULLS FIRST, EMAIL_CONSTRAINT NULLS FIRST) VALUES ( /* key:2 */ 'bcaeb69c-2b49-41d0-8613-4cdead92a771', 'myuser@domain.com')"; SQL statement:
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: update USER_ENTITY set CREATED_TIMESTAMP=?,EMAIL=?,EMAIL_CONSTRAINT=?,EMAIL_VERIFIED=?,ENABLED=?,FEDERATION_LINK=?,FIRST_NAME=?,LAST_NAME=?,NOT_BEFORE=?,REALM_ID=?,SERVICE_ACCOUNT_CLIENT_LINK=?,USERNAME=? where ID=? [23505-224]
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.message.DbException.getJdbcSQLException(DbException.java:520)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.message.DbException.getJdbcSQLException(DbException.java:489)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.message.DbException.get(DbException.java:223)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.message.DbException.get(DbException.java:199)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.index.Index.getDuplicateKeyException(Index.java:527)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.mvstore.db.MVSecondaryIndex.checkUnique(MVSecondaryIndex.java:223)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.mvstore.db.MVSecondaryIndex.add(MVSecondaryIndex.java:184)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.mvstore.db.MVTable.addRow(MVTable.java:519)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.table.Table.updateRows(Table.java:571)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.command.dml.Update.doUpdate(Update.java:103)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.command.dml.Update.update(Update.java:87)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.command.dml.DataChangeStatement.update(DataChangeStatement.java:74)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.command.CommandContainer.update(CommandContainer.java:169)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.command.Command.executeUpdate(Command.java:256)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.jdbc.JdbcPreparedStatement.executeUpdateInternal(JdbcPreparedStatement.java:216)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.h2.jdbc.JdbcPreparedStatement.executeUpdate(JdbcPreparedStatement.java:174)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at io.agroal.pool.wrapper.PreparedStatementWrapper.executeUpdate(PreparedStatementWrapper.java:88)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.executeUpdate(ResultSetReturnImpl.java:194)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.engine.jdbc.mutation.internal.AbstractMutationExecutor.performNonBatchedMutation(AbstractMutationExecutor.java:108)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.engine.jdbc.mutation.internal.MutationExecutorSingleNonBatched.performNonBatchedOperations(MutationExecutorSingleNonBatched.java:40)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.engine.jdbc.mutation.internal.AbstractMutationExecutor.execute(AbstractMutationExecutor.java:52)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.persister.entity.mutation.UpdateCoordinatorStandard.doStaticUpdate(UpdateCoordinatorStandard.java:778)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.persister.entity.mutation.UpdateCoordinatorStandard.performUpdate(UpdateCoordinatorStandard.java:324)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.persister.entity.mutation.UpdateCoordinatorStandard.coordinateUpdate(UpdateCoordinatorStandard.java:242)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.persister.entity.AbstractEntityPersister.update(AbstractEntityPersister.java:2810)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.action.internal.EntityUpdateAction.execute(EntityUpdateAction.java:168)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.engine.spi.ActionQueue.executeActions(ActionQueue.java:632)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.engine.spi.ActionQueue.executeActions(ActionQueue.java:499)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.event.internal.AbstractFlushingEventListener.performExecutions(AbstractFlushingEventListener.java:363)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.event.internal.DefaultFlushEventListener.onFlush(DefaultFlushEventListener.java:41)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.event.service.internal.EventListenerGroupImpl.fireEventOnEachListener(EventListenerGroupImpl.java:127)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.internal.SessionImpl.doFlush(SessionImpl.java:1403)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.hibernate.internal.SessionImpl.flush(SessionImpl.java:1389)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at java.base/java.lang.reflect.Method.invoke(Method.java:568)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: at org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:62)
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: ... 60 more
Mar 21 21:57:36 mykeycloak.com kc.sh[5321]: 2024-03-21 21:57:36,095 WARN [org.keycloak.events] (executor-thread-1) type="LOGIN_ERROR", realmId="bcaeb69c-2b49-41d0-8613-4cdead92a771", clientId="argocd", userId="null", ipAddress="172.20.1.24", error="invalid_user_credentials", auth_method="openid-connect", auth_type="code", redirect_uri="https://anotherapp.com/path/auth/callback", code_id="d4f0a5f7-193a-465c-88a0-460be5fd2094", username="myuser