KEYCLOAK-2529 More proper handling of DB errors during migration

model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java

@@ -184,13 +184,24 @@ public class DefaultJpaConnectionProviderFactory implements JpaConnectionProvide
 	                    emf = Persistence.createEntityManagerFactory(unitName, properties);
 	                    logger.trace("EntityManagerFactory created");
 
+                    } catch (Exception e) {
+                        // Safe rollback
+                        if (connection != null) {
+                            try {
+                                connection.rollback();
+                            } catch (SQLException e2) {
+                                logger.warn("Can't rollback connection", e2);
+                            }
+                        }
+
+                        throw e;
                     } finally {
 	                    // Close after creating EntityManagerFactory to prevent in-mem databases from closing
 	                    if (connection != null) {
 	                        try {
 	                            connection.close();
 	                        } catch (SQLException e) {
-	                            logger.warn(e);
+	                            logger.warn("Can't close connection", e);
 	                        }
 	                    }
                     }

model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/DefaultLiquibaseConnectionProvider.java

@@ -93,9 +93,6 @@ public class DefaultLiquibaseConnectionProvider implements LiquibaseConnectionPr
 
         // Change command for creating lock and drop DELETE lock record from it
         SqlGeneratorFactory.getInstance().register(new CustomInsertLockRecordGenerator());
-
-        // We wrap liquibase update in CustomLockService provided by DBLockProvider. No need to lock inside liquibase itself.
-        LockServiceFactory.getInstance().register(new DummyLockService());
     }
 
 
@@ -127,6 +124,11 @@ public class DefaultLiquibaseConnectionProvider implements LiquibaseConnectionPr
 
         String changelog = (database instanceof DB2Database) ? LiquibaseJpaUpdaterProvider.DB2_CHANGELOG :  LiquibaseJpaUpdaterProvider.CHANGELOG;
         logger.debugf("Using changelog file: %s", changelog);
+
+        // We wrap liquibase update in CustomLockService provided by DBLockProvider. No need to lock inside liquibase itself.
+        // NOTE: This can't be done in baseLiquibaseInitialization() as liquibase always restarts lock service
+        LockServiceFactory.getInstance().register(new DummyLockService());
+
         return new Liquibase(changelog, new ClassLoaderResourceAccessor(getClass().getClassLoader()), database);
     }
 

services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java

@@ -166,6 +166,7 @@ public class KeycloakApplication extends Application {
         } catch (Exception e) {
             session.getTransaction().rollback();
             logger.migrationFailure(e);
+            throw e;
         } finally {
             session.close();
         }