From 1a95a5889380349f74529f740ba019f02bdeb142 Mon Sep 17 00:00:00 2001
From: Alexander Schwartz <aschwart@redhat.com>
Date: Mon, 16 May 2022 09:49:26 +0200
Subject: [PATCH] Graceful handling if composite roles have been removed
 concurrently.

Closes #12003
---
 .../models/cache/infinispan/RoleAdapter.java    | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java
index 9b4a7e34ef..533bb89335 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java
@@ -130,14 +130,15 @@ public class RoleAdapter implements RoleModel {
 
         if (composites == null) {
             composites = new HashSet<>();
-            composites = cached.getComposites().stream()
-                    .map(id -> {
-                        RoleModel role = realm.getRoleById(id);
-                        if (role == null) {
-                            throw new IllegalStateException("Could not find composite in role " + getName() + ": " + id);
-                        }
-                        return role;
-                    }).collect(Collectors.toSet());
+            for (String id : cached.getComposites()) {
+                RoleModel role = realm.getRoleById(id);
+                if (role == null) {
+                    // chance that composite role was removed, so invalidate this entry and fallback to delegate
+                    getDelegateForUpdate();
+                    return updated.getCompositesStream();
+                }
+                composites.add(role);
+            }
         }
 
         return composites.stream();