Skip to content

fix #43819 - partial import fails to overwrite existing groups#43924

Merged
vmuzikar merged 2 commits intokeycloak:mainfrom
MartinNowak:fix-43819-partial-import-group-overwrite
Nov 25, 2025
Merged

fix #43819 - partial import fails to overwrite existing groups#43924
vmuzikar merged 2 commits intokeycloak:mainfrom
MartinNowak:fix-43819-partial-import-group-overwrite

Conversation

@MartinNowak
Copy link
Contributor

@MartinNowak MartinNowak commented Nov 4, 2025

  • when removal is delayed until insertion of the newly imported group this causes a duplicate key constrain violation (Key (realm_id, parent_group, name))
  • fixed by flushing group removals

It seems that even when testing with KC_TEST_DATABASE=postgres the realm provider is not actually used by the admin tests.

@Test
public void testAddGroupsOverwrite() {
addGroups();
testOverwrite();
}

fixes #43819

@MartinNowak MartinNowak requested a review from a team as a code owner November 4, 2025 09:20
@MartinNowak MartinNowak force-pushed the fix-43819-partial-import-group-overwrite branch 5 times, most recently from 4be2b3d to 57bb318 Compare November 4, 2025 09:24
@shawkins
Copy link
Contributor

shawkins commented Nov 6, 2025

We could consider using EntityManagers.flush(session, false); prior to the imports

results.addAllResults(partialImport.doImport(rep, realm, session));

Rather than individually flushing with each delete.

@shawkins shawkins force-pushed the fix-43819-partial-import-group-overwrite branch from d985b88 to c2a1767 Compare November 20, 2025 20:58
@shawkins
Copy link
Contributor

@MartinNowak updated the pr with a test and more general fix. Should be good for inclusion now.

MartinNowak and others added 2 commits November 21, 2025 07:16
- when removal is delayed until insertion of the newly imported group
  this causes a duplicate key constrain violation (`Key (realm_id, parent_group, name)`)
- fixed by flushing group removals

Signed-off-by: Martin Nowak <code@dawg.eu>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
#	services/src/main/java/org/keycloak/partialimport/PartialImportManager.java
@shawkins shawkins force-pushed the fix-43819-partial-import-group-overwrite branch from c2a1767 to dafb95f Compare November 21, 2025 12:16
@shawkins shawkins requested review from ahus1 and pedroigor November 21, 2025 14:22
Copy link
Contributor

@vmuzikar vmuzikar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving based on @shawkins' review.

@vmuzikar vmuzikar merged commit d5a507e into keycloak:main Nov 25, 2025
81 checks passed
Jonaka3385 pushed a commit to Jonaka3385/keycloak that referenced this pull request Nov 26, 2025
keycloak#43924)

* fix keycloak#43819 - partial import fails to overwrite existing groups

- when removal is delayed until insertion of the newly imported group
  this causes a duplicate key constrain violation (`Key (realm_id, parent_group, name)`)
- fixed by flushing group removals

Signed-off-by: Martin Nowak <code@dawg.eu>

* adding a test and using a general fix

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
#	services/src/main/java/org/keycloak/partialimport/PartialImportManager.java

---------

Signed-off-by: Martin Nowak <code@dawg.eu>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
Jonaka3385 pushed a commit to Jonaka3385/keycloak that referenced this pull request Nov 26, 2025
# This is the 1st commit message:

Fix race condition in SAML DocumentBuilderFactory creation

Closes keycloak#44438

Signed-off-by: martins <martin.soderstrom@aurorainnovation.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
# The commit message keycloak#2 will be skipped:

# fix keycloak#43819 - partial import fails to overwrite existing groups (keycloak#43924)
#
# * fix keycloak#43819 - partial import fails to overwrite existing groups
#
# - when removal is delayed until insertion of the newly imported group
#   this causes a duplicate key constrain violation (`Key (realm_id, parent_group, name)`)
# - fixed by flushing group removals
#
# Signed-off-by: Martin Nowak <code@dawg.eu>
#
# * adding a test and using a general fix
#
# Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# # Conflicts:
# #	services/src/main/java/org/keycloak/partialimport/PartialImportManager.java
#
# ---------
#
# Signed-off-by: Martin Nowak <code@dawg.eu>
# Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Co-authored-by: Steve Hawkins <shawkins@redhat.com>

# The commit message keycloak#3 will be skipped:

# Always allow to setup JWKS URL in oidc idp
#
# Closes keycloak#44217
#
# Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>

# The commit message keycloak#4 will be skipped:

# Update translation files (keycloak#44444)
#
# Updated by "Cleanup translation files" hook in Weblate.
#
# Signed-off-by: Hosted Weblate <hosted@weblate.org>

# The commit message keycloak#5 will be skipped:

# Promote MDC Logging Feature to Supported State
#
# Closes keycloak#41205
#
# Signed-off-by: Ruchika Jha <ruchika@li-0551ffcc-341d-11b2-a85c-a28deda416be.ibm.com>
# Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
# Co-authored-by: Ruchika Jha <ruchika@li-0551ffcc-341d-11b2-a85c-a28deda416be.ibm.com>
# Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>

# The commit message keycloak#6 will be skipped:

# Stop looking up client in ClientAssertionState to prevent lookup by clientId in federated client authentication (keycloak#44448)
#
# Closes keycloak#44447
#
# Signed-off-by: stianst <stianst@gmail.com>

# The commit message keycloak#7 will be skipped:

# When joining a group, don't rely on cached values if user has already been updated
#
# Closes keycloak#44480
#
# Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

partial import fails to overwrite existing groups

3 participants