Keycloak extensions fail when login on master realm with domain admin user

When logging in with an UMS/Nubus admin user (user is meber of group Domain Admins) into Keycloak master admin console which is a supported scenario by Univention Keycloak the Keycloak extensions cannot process that user's login causing to permanently fail (as they do not skip the record) with:

07/05/2024 07:59:01 DEBUG http://ums-keycloak.idp-fed-test.svc.cluster.local:8080 "GET /admin/realms/opendesk/users/f:cdc81bdf-6a51-46bf-a663-b3f8f21ece1f:default.admin HTTP/1.1" 404 114
Traceback (most recent call last):
  File "/usr/app/src/__main__.py", line 57, in <module>
    notif.notify_new_logins()
  File "/usr/app/src/modules/notifier.py", line 71, in notify_new_logins
    self.notify_user(
  File "/usr/app/src/modules/notifier.py", line 54, in notify_user
    user_email = self.keycloak.get_user_email(user_id)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/app/src/modules/keycloak_poller.py", line 132, in get_user_email
    user = self.kc_admin.get_user(user_id)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/keycloak/keycloak_admin.py", line 727, in get_user
    return raise_error_from_response(data_raw, KeycloakGetError)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/keycloak/exceptions.py", line 192, in raise_error_from_response
    raise error(
keycloak.exceptions.KeycloakGetError: 404: b'{"error":"User not found","error_description":"For more on this error consult the server log at the debug level."}'

Set to category low as the Keycloak Admin Console is usually not enabled in openDesk.

Edited by Thorsten Roßner