libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

Fixes a NullPointerException after import validation (#20151)

Browse source 
* Fixes a NullPointerException after import validation

If the import validation (when getting a user by email)
returns null, indicating that the user entity should be
removed from local storage, an email equality check results
in a NullPointerException.

This commit fixes this issue by explicitly checking for null.

Closes #20150

---------
Co-authored-by: Michal Hajas <mhajas@redhat.com>
This commit is contained in:
Håvar Nøvik 2023-10-23 23:19:25 +02:00 committed by GitHub
parent 03a8f05d14
commit bc55846809
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
model/legacy-private/src/main/java/org/keycloak/storage/UserStorageManager.java
View file

@ -389,7 +389,7 @@ public class UserStorageManager extends AbstractStorageManager<UserStorageProvid
if (user != null) { if (user != null) {
user = importValidation(realm, user); user = importValidation(realm, user);
// Case when email was changed directly in the userStorage and doesn't correspond anymore to the email from local DB // Case when email was changed directly in the userStorage and doesn't correspond anymore to the email from local DB
if (email.equalsIgnoreCase(user.getEmail())) { if (user != null && email.equalsIgnoreCase(user.getEmail())) {
return user; return user;
} }
} }

28
testsuite/model/src/test/java/org/keycloak/testsuite/model/user/UserSyncTest.java
View file

@ -130,7 +130,7 @@ public class UserSyncTest extends KeycloakModelTest {
long start = System.currentTimeMillis(); long start = System.currentTimeMillis();
SynchronizationResult res = withRealm(realmId, (session, realm) -> { SynchronizationResult res = withRealm(realmId, (session, realm) -> {
UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId)); UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
return new UserStorageSyncManager().syncAllUsers(session.getKeycloakSessionFactory(), realm.getId(), providerModel); return UserStorageSyncManager.syncAllUsers(session.getKeycloakSessionFactory(), realm.getId(), providerModel);
}); });
long end = System.currentTimeMillis(); long end = System.currentTimeMillis();
long timeNeeded = end - start; long timeNeeded = end - start;
@ -142,6 +142,32 @@ public class UserSyncTest extends KeycloakModelTest {
assertThat(withRealm(realmId, (session, realm) -> UserStoragePrivateUtil.userLocalStorage(session).getUsersCount(realm)), is(NUMBER_OF_USERS)); assertThat(withRealm(realmId, (session, realm) -> UserStoragePrivateUtil.userLocalStorage(session).getUsersCount(realm)), is(NUMBER_OF_USERS));
} }
@Test
public void testRemovedLDAPUserShouldNotFailGetUserByEmail() {
withRealm(realmId, (session, realm) -> {
UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
// disable cache
providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.NO_CACHE);
realm.updateComponent(providerModel);
ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
LDAPTestUtils.addLDAPUser(ldapFedProvider, realm, "user", "UserFN", "UserLN", "user@email.org", "userStreet", "1450");
return null;
});
assertThat(withRealm(realmId, (session, realm) -> session.users().getUserByEmail(realm, "user@email.org")), is(notNullValue()));
withRealm(realmId, (session, realm) -> {
ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
LDAPTestUtils.removeLDAPUserByUsername(ldapFedProvider, realm, ldapFedProvider.getLdapIdentityStore().getConfig(), "user");
return null;
});
assertThat(withRealm(realmId, (session, realm) -> session.users().getUserByEmail(realm, "user@email.org")), is(nullValue()));
}
@Test @Test
public void testAlwaysReadValueFromLDAPWorksWithNoCachePolicy() { public void testAlwaysReadValueFromLDAPWorksWithNoCachePolicy() {
// Create mapper from sn to a new user attribute // Create mapper from sn to a new user attribute