NullPointerException using auth-require-group-extension on Keycloak 11.0.2

[tgould-zivaro]

I am running Keycloak 11.0.2 with the require-group-extension deployed. I am using the below authentication flow (started as a copy from the Broser Flow).

This flow is allowing users in even when the do not have the configured required group. The Keycloak logs show the following that appears to be at the root of the issue....

[0m�[33m20:05:46,239 WARN  [org.keycloak.services] (default task-42) KC-SERVICES0013: Failed authentication: java.lang.NullPointerException
at deployment.auth-require-group-extension-1.0.0.0-SNAPSHOT.jar//com.github.thomasdarimont.keycloak.auth.requiregroup.RequireGroupAuthenticator.isMemberOfGroup(RequireGroupAuthenticator.java:47)
at deployment.auth-require-group-extension-1.0.0.0-SNAPSHOT.jar//com.github.thomasdarimont.keycloak.auth.requiregroup.RequireGroupAuthenticator.authenticate(RequireGroupAuthenticator.java:29)
at [email protected]//org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:443)
....

What am I missing or doing incorrectly please?

TIA!

[tgould-zivaro]

I believe that I have discovered that this is incompatible when using an Identity Provider Redirect. I am guessing that in such case, the original flow is ended when the redirect to the Identity Provider occurs. Therefore, any authorization via this plugin that is configured to happen afterwards dos not occur.

I have also attempted to configure the required authorization via this plugin in a separate 'authorization only' flow that is configured as the Identity Provider's Post Login Flow, but this limits you to only a single configuration - as opposed to potentially one for each unique client.

I have worked around this successfully in two slightly different manners:

1. enabling script based authenticators and writing a script to perform the authorization while dynamically determining the required group name based upon the client invoked

• OR -

2. writing a custom authenticator plugin and to perform the authorization while dynamically determining the required group name based upon the client invoked

It is unfortunate that this seemingly common use case (i.e. working with an Identify Provider) is either not better supported nor documented as a known limitation.