Closed
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
token-exchange
Describe the bug
During external-internal token exchange, there is NPE. It happens just when user already exists in the consumer realm and is linked with the IDP, which issued the exchanged token.
We do not test this yet in our testsuite as existing tests for external-internal token exchange tests the scenario when user does not yet exists in the consumer realm and is created by external-internal token exchange request.
This issue looks as a regression of 7cc055f8a6e4574ff0b0057c570c
Whole stacktrace:
java.lang.NullPointerException: Cannot invoke "org.keycloak.sessions.AuthenticationSessionModel.getAuthNote(String)" because "authSession" is null
at org.keycloak.broker.provider.AbstractIdentityProvider.updateEmail(AbstractIdentityProvider.java:179)
at org.keycloak.broker.provider.AbstractIdentityProvider.updateBrokeredUser(AbstractIdentityProvider.java:174)
at org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider.importUserFromExternalIdentity(AbstractTokenExchangeProvider.java:413)
at org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider.exchangeExternalToken(AbstractTokenExchangeProvider.java:297)
at org.keycloak.protocol.oidc.tokenexchange.V1TokenExchangeProvider.tokenExchange(V1TokenExchangeProvider.java:103)
at org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider.exchange(AbstractTokenExchangeProvider.java:114)
at org.keycloak.protocol.oidc.grants.TokenExchangeGrantType.process(TokenExchangeGrantType.java:92)
at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:151)
Version
Keycloak main from 2025-05-30 (after commit 7cc055f )
Regression
- The issue is a regression
Expected behavior
External-internal token-exchange works for existing users
Actual behavior
External-internal token-exchange does not work for existing users and throws NPE
How to Reproduce?
- Make sure there is Keycloak user linked to some IDP
- Send external-token exchange request with the
subject_tokenas the token from the IDP
Anything else?
No response