Skip to content

docs(workflows): fix offboarding example revoke-role role list format - #48969

Merged
ahus1 merged 1 commit into
keycloak:mainfrom
thomasdelorge:fix/doc-workflows-example
May 20, 2026
Merged

docs(workflows): fix offboarding example revoke-role role list format#48969
ahus1 merged 1 commit into
keycloak:mainfrom
thomasdelorge:fix/doc-workflows-example

Conversation

@thomasdelorge

@thomasdelorge thomasdelorge commented May 13, 2026 •
edited by ahus1
Loading

Copy link
Copy Markdown
Contributor

Closes #49140

Hello,

The Offboarding sales members example used a single role string with comma-separated names ("manager,sales-rep,sales-intern").

On admin ui, quotes around roles are dropped on save and workflow use it as one role

Before :

DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-2) Workflow 'Offboarding sales members' activated for resource 5da8b53a-337c-48d0-bfbd-524008e71d06 (execution id: 5d83b859-1163-4786-ac92-0cec7cad74e5)
DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-2) Running step revoke-role on resource 5da8b53a-337c-48d0-bfbd-524008e71d06 (execution id: 5d83b859-1163-4786-ac92-0cec7cad74e5)
ERROR [org.keycloak.models.workflow.RoleBasedStepProvider] (kc-workflow-event-executor-1208-2) Failed to grant role to user 5da8b53a-337c-48d0-bfbd-524008e71d06: java.lang.IllegalStateException: Role manager,sales-rep,sales-intern not found
        at org.keycloak.models.workflow.RoleBasedStepProvider.getRole(RoleBasedStepProvider.java:68)
        at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
        at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1708)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
        at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
        at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
        at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
        at org.keycloak.models.workflow.RoleBasedStepProvider.run(RoleBasedStepProvider.java:34)
        at org.keycloak.models.workflow.RunWorkflowTask.lambda$runWorkflowStep$0(RunWorkflowTask.java:68)
        at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:469)
        at org.keycloak.models.workflow.RunWorkflowTask.runWorkflowStep(RunWorkflowTask.java:63)
        at org.keycloak.models.workflow.RunWorkflowTask.run(RunWorkflowTask.java:41)
        at org.keycloak.models.utils.KeycloakModelUtils.lambda$runJobInTransaction$1(KeycloakModelUtils.java:355)
        at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:469)
        at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:354)
        at org.keycloak.models.workflow.WorkflowTransactionalTask.run(WorkflowTransactionalTask.java:27)
        at org.keycloak.models.workflow.WorkflowTask.run(WorkflowTask.java:31)
        at java.base/java.util.concurrent.CompletableFuture$AsyncRun.run(CompletableFuture.java:1804)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1583)

DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-2) Step revoke-role completed successfully (execution id: 5d83b859-1163-4786-ac92-0cec7cad74e5)
DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-2) Workflow 'Offboarding sales members' completed for resource 5da8b53a-337c-48d0-bfbd-524008e71d06 (execution id: 5d83b859-1163-4786-ac92-0cec7cad74e5)

After :

DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-3) Workflow 'Offboarding sales members' activated for resource b6921d44-7aca-4e19-bc5f-2a391bdc0192 (execution id: 531158a6-2a53-43d3-931c-1b9d87f6935a)
DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-3) Running step revoke-role on resource b6921d44-7aca-4e19-bc5f-2a391bdc0192 (execution id: 531158a6-2a53-43d3-931c-1b9d87f6935a)
DEBUG [org.keycloak.models.workflow.RevokeRoleStepProvider] (kc-workflow-event-executor-1208-3) Revoking role %s from user %s)
DEBUG [org.keycloak.models.workflow.RevokeRoleStepProvider] (kc-workflow-event-executor-1208-3) Revoking role %s from user %s)
DEBUG [org.keycloak.models.workflow.RevokeRoleStepProvider] (kc-workflow-event-executor-1208-3) Revoking role %s from user %s)
DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-3) Step revoke-role completed successfully (execution id: 531158a6-2a53-43d3-931c-1b9d87f6935a)
DEBUG [org.keycloak.models.workflow.RunWorkflowTask] (kc-workflow-event-executor-1208-3) Workflow 'Offboarding sales members' completed for resource b6921d44-7aca-4e19-bc5f-2a391bdc0192 (execution id: 531158a6-2a53-43d3-931c-1b9d87f6935a)

Have a good day,
Thomas

@thomasdelorge
docs(workflows): fix offboarding example revoke-role role list format
3f24234 
The revoke-role step expects multivalued role names, not a
comma-separated string.

Signed-off-by: Thomas DELORGE <thomas.delorge@orbeet.io>
@thomasdelorge
thomasdelorge requested a review from a team as a code owner May 13, 2026 14:37
@ahus1

ahus1 commented May 19, 2026

Copy link
Copy Markdown
Member

@sguilhen - can you please have a look? Maybe a bug issue is needed to backport this one.

sguilhen
sguilhen approved these changes May 20, 2026
View reviewed changes

@sguilhen sguilhen left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for catching this, @thomasdelorge !

@sguilhen

sguilhen commented May 20, 2026

Copy link
Copy Markdown
Contributor

I've opened #49140 to track this (along with backports). @thomasdelorge Can you edit your commit to include "Closes #49140" to link the commit to the issue?

@ahus1

ahus1 commented May 20, 2026

Copy link
Copy Markdown
Member

@sguilhen - I've updated the description, and I can update the commit message on squash. Happy to help out here...

@sguilhen

sguilhen commented May 20, 2026

Copy link
Copy Markdown
Contributor

@ahus1 Thanks! We can proceed with this one then!

@ahus1
ahus1 enabled auto-merge (squash) May 20, 2026 21:31
@ahus1
ahus1 merged commit a988875 into keycloak:main May 20, 2026
65 checks passed
@thomasdelorge
thomasdelorge deleted the fix/doc-workflows-example branch May 21, 2026 05:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ahus1 ahus1 ahus1 approved these changes
+1 more reviewer
@sguilhen sguilhen sguilhen approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@sguilhen sguilhen

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Workflows documentation: offboarding example is incorrectly enclosing the list of revoked roles with double quotes

3 participants

@thomasdelorge @ahus1 @sguilhen