Keycloak extensions fail when login on master realm with domain admin user
When logging in with an UMS/Nubus admin user (user is meber of group Domain Admins) into Keycloak master admin console which is a supported scenario by Univention Keycloak the Keycloak extensions cannot process that user's login causing to permanently fail (as they do not skip the record) with:
07/05/2024 07:59:01 DEBUG http://ums-keycloak.idp-fed-test.svc.cluster.local:8080 "GET /admin/realms/opendesk/users/f:cdc81bdf-6a51-46bf-a663-b3f8f21ece1f:default.admin HTTP/1.1" 404 114
Traceback (most recent call last):
File "/usr/app/src/__main__.py", line 57, in <module>
notif.notify_new_logins()
File "/usr/app/src/modules/notifier.py", line 71, in notify_new_logins
self.notify_user(
File "/usr/app/src/modules/notifier.py", line 54, in notify_user
user_email = self.keycloak.get_user_email(user_id)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/app/src/modules/keycloak_poller.py", line 132, in get_user_email
user = self.kc_admin.get_user(user_id)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/keycloak/keycloak_admin.py", line 727, in get_user
return raise_error_from_response(data_raw, KeycloakGetError)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/keycloak/exceptions.py", line 192, in raise_error_from_response
raise error(
keycloak.exceptions.KeycloakGetError: 404: b'{"error":"User not found","error_description":"For more on this error consult the server log at the debug level."}'
Set to category low as the Keycloak Admin Console is usually not enabled in openDesk.
Edited by Thorsten Roßner