rest/admin-v2/services/src/main/java/org/keycloak/services/client/ScimBackedClientService.java:90

• The JPA evaluator rejects field/operator combinations that the Admin v2 validator and current evaluator accept, such as enabled co "ru", by throwing ScimFilterException. Because that exception is not handled, enabling this backend turns a valid query into a 500 response; fall back to the delegate when the JPA evaluator cannot represent a validated query.

        } catch (ClientQueryException e) {
            throw new ServiceException(e.getMessage(), jakarta.ws.rs.core.Response.Status.BAD_REQUEST);
        } catch (ModelException e) {
            throw new ServiceException(e.getMessage(), jakarta.ws.rs.core.Response.Status.BAD_REQUEST);
        }

rest/admin-v2/services/src/main/java/org/keycloak/services/client/scim/ClientJpaQueryExecutor.java:59

• This query is not paginated at the database layer: getResultStream() is unbounded, while skip/limit is applied later in Java after lazy-loading each skipped client's protocol. Large offsets therefore scan and load every preceding match; pass offset/limit into this executor and apply setFirstResult/setMaxResults to the JPA query.

        return closing(em.createQuery(q).getResultStream());

rest/admin-v2/services/src/main/java/org/keycloak/services/client/scim/ClientJpaQueryExecutor.java:52

• Null literals lose the existing Admin API semantics here: the SCIM predicate provider turns eq/ne into CriteriaBuilder.equal/notEqual, so SQL null logic does not match nullable fields. This breaks cases explicitly covered by ClientQueryEvaluatorTest:243-257 (and documented in docs/guides/admin-api/querying.adoc:119); handle null with isNull/isNotNull, including under not, or fall back to the delegate for such filters.

            predicates.add(evaluator.visit(filterContext).predicate());

rest/admin-v2/services/src/main/java/org/keycloak/services/client/scim/ClientJpaQueryExecutor.java:59

• This raw ORDER BY does not preserve the API's nulls-last contract. For example, PostgreSQL places null display names first for descending order, while ClientField uses Comparator.nullsLast and ClientSortAndSliceOptionsTest:74-81 asserts that behavior; add an explicit null-rank order before each value order so SCIM-backed pagination remains compatible.

        q.orderBy(sortOptions.stream().map(sortOption -> {
            var field = ClientJpaQuerySchema.INSTANCE.getAttributeByPath(sortOption.field().toQueryValue())
                    .getModelAttributeName();
            return sortOption.isAscending() ? cb.asc(root.get(field)) : cb.desc(root.get(field));

rest/admin-v2/services/src/main/java/org/keycloak/services/client/scim/ClientJpaQueryExecutor.java:64

• Stream.toList() returns an unmodifiable list, so an explicit sort that omits clientId (for example, sort=displayName) reaches this add and throws UnsupportedOperationException. Build orders as a mutable list before appending the tie-breaker.

            orders.add(cb.asc(root.get("clientId")));

rest/admin-v2/services/src/main/java/org/keycloak/services/client/scim/ClientJpaQueryExecutor.java:62

• The existing API comparator defines string ordering as case-insensitive and always places nulls last (ClientField.java:65-77), but these raw asc/desc expressions inherit database collation and null ordering. For example, PostgreSQL places null displayName values first for descending order, so applying pagination here changes which clients are returned when the SCIM service is enabled; construct portable order expressions that preserve the API comparator's case and null semantics.

            return sortOption.isAscending() ? cb.asc(root.get(field)) : cb.desc(root.get(field));

rest/admin-v2/services/src/main/java/org/keycloak/services/client/scim/ClientJpaQueryExecutor.java:62

• The JPA ordering does not preserve the API's sort contract: ClientField.java:65-77 defines case-insensitive string ordering with nulls last, while raw asc/desc delegates both behaviors to the database (for example, PostgreSQL puts nulls first for descending order). Because pagination is applied immediately afterward, enabling this service can return different clients on each page; add explicit null ranking and case-normalized ordering for string fields before paginating.

        var orders = new ArrayList<>(sortOptions.stream().map(sortOption -> {
            var field = ClientJpaQuerySchema.INSTANCE.getAttributeByPath(sortOption.field().toQueryValue())
                    .getModelAttributeName();
            return sortOption.isAscending() ? cb.asc(root.get(field)) : cb.desc(root.get(field));