From 307c9be89d02d5bddcf7529511e5990e0813de4a Mon Sep 17 00:00:00 2001
From: vramik <vramik@redhat.com>
Date: Fri, 27 Mar 2020 09:38:29 +0100
Subject: [PATCH] KEYCLOAK-13247 NPE during migration when manage-account role
 missing

---
 .../java/org/keycloak/migration/migrators/MigrateTo9_0_0.java  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo9_0_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo9_0_0.java
index 3d734518b3..e61b39ad11 100644
--- a/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo9_0_0.java
+++ b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo9_0_0.java
@@ -93,7 +93,8 @@ public class MigrateTo9_0_0 implements Migration {
 
             client.setProtocol("openid-connect");
 
-            client.addScopeMapping(realm.getClientByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getRole(AccountRoles.MANAGE_ACCOUNT));
+            RoleModel role = realm.getClientByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getRole(AccountRoles.MANAGE_ACCOUNT);
+            if (role != null) client.addScopeMapping(role);
 
             ProtocolMapperModel audienceMapper = new ProtocolMapperModel();
             audienceMapper.setName("audience resolve");