Skip to content

fix: prevent NPE in convertDeprecatedCredentialsFormat when credential fields are null #51557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SaadAhmed7 wants to merge 3 commits into
base: main
Choose a base branch
from
+16 −3
Open

fix: prevent NPE in convertDeprecatedCredentialsFormat when credential fields are null #51557

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4254350
fix: prevent NPE when deprecated credential fields are null
SaadAhmed7 Aug 8, 2026
758d1e5
Use OTPPolicy defaults for null OTP digits and period
SaadAhmed7 Aug 8, 2026
5091dfb
Reject unverifiable password credentials and honor realm OTP policy
SaadAhmed7 Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@
import org.keycloak.models.ModelDuplicateException;
import org.keycloak.models.ModelException;
import org.keycloak.models.ModelValidationException;
import org.keycloak.models.OTPPolicy;
import org.keycloak.models.OrganizationDomainModel;
import org.keycloak.models.OrganizationModel;
import org.keycloak.models.ProtocolMapperModel;
Expand Down Expand Up @@ -272,21 +273,33 @@ public static void importGroup(RealmModel realm, GroupModel parent, GroupReprese
}


private static void convertDeprecatedCredentialsFormat(UserRepresentation user) {
private static void convertDeprecatedCredentialsFormat(RealmModel realm, UserRepresentation user) {
if (user.getCredentials() != null) {
for (CredentialRepresentation cred : user.getCredentials()) {
try {
if ((cred.getCredentialData() == null || cred.getSecretData() == null) && cred.getValue() == null) {
logger.warnf("Using deprecated 'credentials' format in JSON representation for user '%s'. It will be removed in future versions", user.getUsername());

if (PasswordCredentialModel.TYPE.equals(cred.getType()) || PasswordCredentialModel.PASSWORD_HISTORY.equals(cred.getType())) {
if (cred.getHashIterations() == null) {
// The stored hash cannot be reproduced without the iteration count it was
// generated with, so such a credential could never be verified. Reject it
// instead of persisting an unusable password.
throw new ModelValidationException("Credential of type '" + cred.getType()
+ "' for user '" + user.getUsername() + "' is missing 'hashIterations'");
}
PasswordCredentialData credentialData = new PasswordCredentialData(cred.getHashIterations(), cred.getAlgorithm());
cred.setCredentialData(JsonSerialization.writeValueAsString(credentialData));
// Created this manually to avoid conversion from Base64 and back
cred.setSecretData("{\"value\":\"" + cred.getHashedSaltedValue() + "\",\"salt\":\"" + cred.getSalt() + "\"}");
cred.setPriority(10);
} else if (OTPCredentialModel.TOTP.equals(cred.getType()) || OTPCredentialModel.HOTP.equals(cred.getType())) {
OTPCredentialData credentialData = new OTPCredentialData(cred.getType(), cred.getDigits(), cred.getCounter(), cred.getPeriod(), cred.getAlgorithm(), null);
OTPPolicy otpPolicy = realm.getOTPPolicy();
OTPCredentialData credentialData = new OTPCredentialData(cred.getType(),
cred.getDigits() != null ? cred.getDigits() : otpPolicy.getDigits(),
cred.getCounter() != null ? cred.getCounter() : otpPolicy.getInitialCounter(),
cred.getPeriod() != null ? cred.getPeriod() : otpPolicy.getPeriod(),
cred.getAlgorithm(), null);
OTPSecretData secretData = new OTPSecretData(cred.getHashedSaltedValue());
cred.setCredentialData(JsonSerialization.writeValueAsString(credentialData));
cred.setSecretData(JsonSerialization.writeValueAsString(secretData));
Expand Down Expand Up @@ -824,7 +837,7 @@ public static void createFederatedIdentities(UserRepresentation userRep, Keycloa
}

public static void createCredentials(UserRepresentation userRep, KeycloakSession session, RealmModel realm, UserModel user, boolean adminRequest) {
convertDeprecatedCredentialsFormat(userRep);
convertDeprecatedCredentialsFormat(realm, userRep);
if (userRep.getCredentials() != null) {
for (CredentialRepresentation cred : userRep.getCredentials()) {
if (cred.getId() != null && user.credentialManager().getStoredCredentialById(cred.getId()) != null) {
Expand Down