Unable to Start IAM after Making Group Change, Database corruption

Products

Service Virtualization

Issue/Introduction

Added an LDAP System. Tested Connection and Authentication with no errors.

Defined LDAP Group Settings. Save.

Chose Sync LDAP Groups To Identity and Access Manager. No errors.

Navigated to Groups under Manage to view the synced LDAP groups and assign roles to the groups.

Choose the dropdown and no Groups show.

There are 1677 groups so went back to Define LDAP Group Settings and entered in a filter. Save. No errors.

Chose Sync LDAP Groups To Identity and Access Manager again. No errors.

Went back to Groups to map roles and still nothing showed.

Restarted IAM and was not able to start IAM again.

Running IAM with H2 database.

Seeing this error in the server.log:

2019-09-05 10:08:42,792 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 53) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)

at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:84)

at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

at java.util.concurrent.FutureTask.run(FutureTask.java:266)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

at org.jboss.threads.JBossThread.run(JBossThread.java:320)

Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)

at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)

at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298)

at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340)

at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253)

at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)

at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)

at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)

at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)

at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)

at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250)

at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133)

at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565)

at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536)

at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)

at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)

at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)

at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)

at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578)

at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)

at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)

... 6 more

Caused by: javax.persistence.PersistenceException: org.hibernate.HibernateException: Transaction was rolled back in a different thread!

at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1692)

at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1602)

at org.hibernate.jpa.internal.QueryImpl.getResultList(QueryImpl.java:492)

at org.keycloak.models.jpa.GroupAdapter.getRoleMappings(GroupAdapter.java:274)

at org.keycloak.models.cache.infinispan.entities.CachedGroup.<init>(CachedGroup.java:47)

Environment

All supported DevTest releases.

Cause

Too many groups being brought in when doing Sync.

Resolution

Renamed C:\Program Files\CA\DevTest\IdentityAccessManager\standalone\data folder to C:\Program Files\CA\DevTest\IdentityAccessManager\standalone\data_backup to start with a fresh IAM database.

Started IAM service.

Reconfigured LDAP provider and under Group Settings added a filter to limit the number of Groups brought in when doing a sync.

Was able to only limit to 3 groups being brought in and then was able to map roles to the Groups.

Additional Information

When configuring LDAP with IAM, is is recommended to put a filter on the Group settings to limit the number if groups brought in, it can be thousands and can overload the database, especially when using the H2 (embedded) database of IAM.