Fix #17644, the registration either should finish properly or not create the user at all - #17646

Thank you, this is a known issue with far wider reach. I'll get back to this PR after returning from sick leave.
Cc: @mposolda This is the manifestation of the very same issue I mentioned last week.

@hmlnarik get well soon! Is there any issue that we could link to? I've searched the GitHub issues but found nothing similar (the only issue with the same stack trace is #16490, but that seems to be irrelevant to this error)

We have extended our registration flow with a few extra steps that set a few user attributes on the users (and does a few other required-for-us adjustments). But with this error (and probably other similar issues), a tiny portion of our user base does not have these values set, making our life harder.

I've debugged one of these cases, and with the help of the Keycloak events and our HTTP access logs, I was able to re-create this particular case - see the test in this PR.

But I think there are different ways to achieve the result of having a user without completing the registration flow. The users' first event in this case was a LOGIN_ERROR - probably because their password was not set, as the RegistrationPassword step did not run. But I've seen users whose first saved event was some IDP linking error, and so on. Should we fix these issues one by one, or do you have another solution in mind?

I'd be grateful if we could solve this - and probably I could backport the fix for older Keycloak versions.

There are a few failing tests in GitHub Actions, should I look into them? I wasn't able to reproduce them locally - are they just some flaky tests?

Thanks,
Vilmos

4 flaky tests on run #6401 ↗︎

0

468

45

0

4

Details:

  clients_test.spec.ts • 3 flaky tests

View Output Video

Test		Artifacts
Clients test > Client creation > Initial access token can't be created with 0 days and count		Output Screenshots
Clients test > Roles tab test > Add associated roles test		Output Screenshots
Clients test > Accessibility tests for clients > Check a11y violations on client registration/ anonymous access policies tab		Output Screenshots

  client_authorization_test.spec.ts • 1 flaky test

View Output Video

Test		Artifacts
Client authentication subtab > Should create a policy		Output Screenshots

_{This comment has been generated by cypress-bot as a result of this project's GitHub integration settings.}

@hmlnarik @mposolda have you had the chance to get back to this PR?

@hmlnarik @mposolda I was thinking about another solution: should we refactor the forgot password flow to not use the setUser() / getUser() methods? We could store the user's info in an AuthNote like in the IDP linking flow.

With this solution, no other hidden bugs should appear. What do you think?

Fixed in #19488