Calls made using Keycloak admin client fail with "authHeader" is null when using resteasy-reactive-jsonb #30089
Comments
|
/cc @FroMage(resteasy-reactive), @geoand(resteasy-reactive), @pedroigor(keycloak), @sberyozkin(keycloak), @stuartwdouglas(resteasy-reactive) |
|
@garthberry Given that it does not work with non-reactive variants as well, can you please confirm that keycloak-admin-client can work with JSONB at all, outside of Quarkus ? |
|
@sberyozkin I can't comment outside of Quarkus, but, we have been using the non-reactive variant with Quarkus and JSONB from at least 1.13.7.Final up to and including version 2.13.6.Final. I have also confirmed using the reproducer that non-reactive Keycloak admin client with JSONB works with Quarkus versions up to and including 2.14.0.Final. From Quarkus 2.14.1.Final onwards the NPE is thrown with both reactive and non-reactive variants. The NPE occurs with reactive variant and JSONB from at least Quarkus 2.8.0.Final. |
|
@garthberry Thanks, I've looked at various commits, and I have no idea what might've introduced a regression, for example, given:
There is only one commit in the whole collection of No changes in the |
|
@sberyozkin I have tracked down the commit responsible for the regression in the non-reactive variant. a74dd7125aea0ae35aba15a506f861058a83d976 Using a local build of both 2.14.1.Final and 2.15.1.Final with that commit reverted resolves the NPE when using JSONB. It appears that the root cause may be the same for both variants. |
|
@garthberry But it is all related to Jackson, not related to JSONB. |
|
@sberyozkin Looking at the Resteasy Client Proxy for org.keycloak.admin.client.token.TokenService for non-reactive variant using JSONB provider in 2.14.0.Final the clientHelper messageBodyReader for media type "application/json" is JacksonProvider. Whereas 2.14.1.Final it is set to JsonBindingProvider, however, the jsonbObj attribute is null. Interestingly the reactive variant seems to have the resourceReader is an instance of ClientJacksonMessageBodyReader when the JSONB provider is set. When the Jackson provider is set the resourceReader is an instance of ServerJacksonMessageBodyReader. It seems there are separate issues for each resteasy variant resulting in an NPE. |
|
@garthberry I'm pretty sure now that it is all down to the provider ordering. Something, example, Java Map implementation, has changed, in 2.14.1.Final, and now JSONB Provider either is selected first (Resteasy Classic) or affects the selection of other providers (Resteasy Reactive). I think the bottom line is that using JSONB provider while also using Keycloak Admin Client API which needs Jackson can lead to unpredictable results/bugs. The easiest option, if it is possible for your application, is move from JSONB to using Jackson only. If that does not work, then I can suggest, assuming JSONB is only used in the server scope, is to try and register it in the server scope only, so that it does not interfere with the client-scope JSON processing (ex, that of keycloak-admin-client and Jackson processing the client requests/responses). for custom providers one should be able to do it indirectly by registering Hi @geoand @FroMage @gsmet Can you recommend something re how to get a provider like reactive JSONB scoped to the server request/response processing only so that it does not interfere with the client side Jackson processing ? |
|
@sberyozkin Thank you, I have started investigating moving from JSONB to Jackson. Your assumption is correct, JSONB is only used in the server scope, so if it is possible to restrict JSONB to server request/response processing only that might be another viable workaround. |
|
#30146 takes care of it |
|
Thanks Georgios, @garthberry Can you please check @geoand's PR and see if the other alternative related to the provider scopes also works now (unless you have already migrated to Jackson :-)) ? |
|
@sberyozkin The Jackson migration is underway, nonetheless, I checked the PR against my reproducer and it works. When using reactive JSONB I can see that both JSONB and Jackson reactive providers are registered. When using reactive Jackson I only see the one provider registered. Thank you Georgios! |
Properly segregate Json MessageBodyReader/Writer classes for server and client
|
Thanks @garthberry |
|
Thanks for the collaboration everyone! |
…nd client Fixes: quarkusio#30089 (cherry picked from commit a95a5f7)
Describe the bug
When using resteasy-reactive-jsonb calls made using the Keycloak admin client will fail with an NPE
Expected behavior
Behaviour should be the same as when using resteasy-reactive-jackson
Actual behavior
Calls made using the Keycloak admin client fail with the following exception.
`
java.lang.NullPointerException: Cannot invoke "String.startsWith(String)" because "authHeader" is null
`
How to Reproduce?
Reproducer attached.
security-keycloak-admin-client-jsonb.tar.gz
Output of
uname -aorverDarwin pingguopao.orchard.home 22.2.0 Darwin Kernel Version 22.2.0: Fri Nov 11 02:03:51 PST 2022; root:xnu-8792.61.2~4/RELEASE_ARM64_T6000 arm64
Output of
java -versionopenjdk version "17.0.5" 2022-10-18 OpenJDK Runtime Environment Homebrew (build 17.0.5+0) OpenJDK 64-Bit Server VM Homebrew (build 17.0.5+0, mixed mode, sharing)
GraalVM version (if different from Java)
No response
Quarkus version or git rev
2.15.1.Final
Build tool (ie. output of
mvnw --versionorgradlew --version)Maven home: apache-maven-3.8.6 Java version: 17.0.5, vendor: Homebrew, runtime: /opt/homebrew/Cellar/openjdk@17/17.0.5/libexec/openjdk.jdk/Contents/Home Default locale: en_GB, platform encoding: UTF-8 OS name: "mac os x", version: "13.1", arch: "aarch64", family: "mac"
Additional information
The issue can also be reproduced when using the non-reactive variants of resteasy and Keycloak admin client.
The text was updated successfully, but these errors were encountered: