I’m unable to install Keycloak, despite trying many times (including with previous versions of UCS 5.2).
Some observations from the log (see below):
- There are a lot of log entries complaining that
5.0/keycloak=26.7.3-nubus1is not running. - The installation appears to be looking for postgresql-11, but I only have postgresql-15 installed.
- The installation appears to start keycloak, but then immediately removes it.
- At the end of the log, the installation appears to complain about a Python script error (
TypeError: 'NoneType' object is not subscriptable) which occurs during a docker container inspection.
In any case, installation fails, and Keycloak is reported by the App Center as not being installed.
In this particular case, there is a database named keycloak already in existence, left behind by a prior installation attempt. I’ve tried removing this database (and the associated keycloak user account), and re-attempting the installation, but it just recreates the database and still fails in exactly the same way.
Any ideas?
Here’s the full output from running the command univention-app install keycloak:
Resolving dependencies for keycloak
Going to install Keycloak (26.7.3-nubus1)
Password for Administrator:
Showing License agreement for 5.0/keycloak=26.7.3-nubus1
Showing README for 5.0/keycloak=26.7.3-nubus1
Falling back to initial value for keycloak/apache2/ssl/certificate
Falling back to initial value for keycloak/apache2/ssl/key
Falling back to initial value for keycloak/apache2/ssl/ca
Falling back to initial value for keycloak/csp/frame-ancestors
Cannot read ucs/self/registration/check_email_verification while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for keycloak/java/opts/append
Cannot read keycloak/password/change/endpoint while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for keycloak/password/change/endpoint
Falling back to initial value for keycloak/http/metrics/slos
Falling back to initial value for keycloak/management/port
Cannot read kc/db/url while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for kc/db/url
Cannot read kc/db/username while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for kc/db/username
Cannot read kc/db/password while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for kc/db/password
Cannot read kc/db/driver while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for kc/db/driver
Cannot read kc/db/ping/datatype while 5.0/keycloak=26.7.3-nubus1 is not running
Falling back to initial value for kc/db/ping/datatype
Configuring 5.0/keycloak=26.7.3-nubus1
Setting keycloak/server/sso/fqdn to 'ucs-sso-ng.mydomain.com'
Setting keycloak/server/sso/path to '/'
Setting keycloak/server/sso/virtualhost to 'true'
Setting keycloak/apache/config to 'true'
Setting keycloak/server/sso/autoregistration to 'true'
Unsetting keycloak/apache2/ssl/certificate
Unsetting keycloak/apache2/ssl/key
Unsetting keycloak/apache2/ssl/ca
Unsetting keycloak/csp/frame-ancestors
Setting keycloak/cookies/samesite to 'None'
Setting keycloak/login/messages/en/pwdChangeSuccessMsg to 'The password has been changed successfully.<br>Please log in again.<br/>'
Setting keycloak/login/messages/de/pwdChangeSuccessMsg to 'Das Passwort wurde erfolgreich geändert.<br>Bitte melden Sie sich erneut an.<br/>'
Setting keycloak/login/messages/en/accountNotVerifiedMsg to 'Your account is not verified.<br>You must <a id="loginSelfServiceLink" href="https://faraday.mydomain.com/univention/selfservice/#/selfservice/verifyaccount" target="_blank">verify your account</a> before you can login.<br/>'
Setting keycloak/login/messages/de/accountNotVerifiedMsg to 'Konto nicht verifiziert.<br>Sie m\\u00FCssen Ihr <a id="loginSelfServiceLink" href="https://faraday.mydomain.com/univention/selfservice/#/selfservice/verifyaccount" target="_blank">Konto verifizieren</a>, bevor Sie sich einloggen k\\u00F6nnen.<br/>'
Setting keycloak/login/messages/en/accessDeniedMsg to 'Access forbidden.<br>You do not have the needed privileges to access this application. Please contact the administrator that you do not have access to the service {0} if you find this to be incorrect.'
Setting keycloak/login/messages/de/accessDeniedMsg to 'Zugriff verboten.<br>Bitte wenden Sie sich an den Administrator, dass Sie keinen Zugriff auf den Service {0} haben, wenn Sie feststellen, dass dies nicht korrekt ist.'
Setting keycloak/log/level to 'INFO'
Setting keycloak/audit/events/success/level to 'DEBUG'
Setting keycloak/audit/events/error/level to 'WARN'
Unsetting keycloak/java/opts/append
Setting keycloak/deploy/resources/limits/memory to '3g'
Setting keycloak/event/metrics/user/enabled to 'false'
Setting keycloak/event/metrics/user/tags to 'clientId,realm'
Setting keycloak/event/metrics/user/events to 'login,logout'
Setting keycloak/http/metrics/histograms/enabled to 'false'
Unsetting keycloak/http/metrics/slos
Unsetting keycloak/management/port
Setting kc/db/kind to 'postgres'
Setting kc/db/xa to 'false'
Setting keycloak/federation/remote/identifier to 'univentionObjectIdentifier'
Setting keycloak/federation/source/identifier to 'univentionSourceIAM'
Cannot write settings while 5.0/keycloak=26.7.3-nubus1 is not running
dpkg-query: no packages found matching postgresql-11
Installing univention-keycloak apache template
Installing Keycloak data/settings acl
Installing Keycloak apache template info
Installing Keycloak translation template info
Installing Keycloak transaltion template
File: /var/lib/univention-appcenter/apps/keycloak/conf/UCS/login/messages/messages_de.properties
File: /var/lib/univention-appcenter/apps/keycloak/conf/UCS/login/messages/messages_en.properties
Installing 50-keycloak postgresql 11 template
Installing 50-keycloak postgresql 15 template
Installing 50-keycloak postgresql 17 template
Installing 50-keycloak postgresql template info
Installing keycloak ispn configuration template
Creating data directories for keycloak...
Registering UCR for keycloak
Marking 5.0/keycloak=26.7.3-nubus1 as installed
File: /etc/univention/service.info/services/univention-appcenter.cfg
Multifile: /etc/postgresql/15/main/pg_hba.conf
Multifile: /etc/apache2/sites-available/default-ssl.conf
Multifile: /etc/apache2/sites-available/000-default.conf
Adding localhost to LDAP object
Reloading apache2 configuration (via systemctl): apache2.service.
univention-postgresql was already set to manually installed.
Checking if database keycloak exists (postgresql implementation)
Database keycloak already exists
5.0/keycloak=26.7.3-nubus1 already has its database
Registering the container host keycl-20030210 for keycloak
Downloading app images
Running command: docker-compose -p keycloak pull
Pulling keycloak ...
Pulling keycloak ... pulling from nubus/images/keycloak
Pulling keycloak ... digest: sha256:4feee304899b3a44dc...
Pulling keycloak ... status: image is up to date for a...
Pulling keycloak ... done
Initializing app image
Running command: docker-compose -p keycloak up -d --no-build --no-recreate
Creating network "keycloak_appcenter_net" with the default driver
Creating keycloak ...
Creating keycloak ... done
Preconfiguring container 9d0a8f945f30392b8899535ad3a45670a49aee2665e71ad4ef72942073bd87a5
Starting keycloak ...
Starting keycloak ... done
Resolving dependencies for keycloak
Going to remove Keycloak (26.7.3-nubus1)
Showing README for 5.0/keycloak=26.7.3-nubus1
Configuring 5.0/keycloak=26.7.3-nubus1
Configuring 5.0/keycloak=26.7.3-nubus1
Executing interface configure for keycloak
No interface defined
Stopping keycloak ...
Stopping keycloak ... done
Removing keycloak ...
Removing keycloak ... done
Removing network keycloak_appcenter_net
Removing localhost from LDAP object
File: /etc/univention/service.info/services/univention-appcenter.cfg
Multifile: /etc/postgresql/15/main/pg_hba.conf
Multifile: /etc/apache2/sites-available/default-ssl.conf
Multifile: /etc/apache2/sites-available/000-default.conf
Reloading apache2 configuration (via systemctl): apache2.service.
Installing join script /var/cache/univention-appcenter/appcenter.software-univention.de/5.0/keycloak_20260915210106.uinst
univention-run-join-scripts: runs all join scripts existing on local computer.
copyright (c) 2001-2026 Univention GmbH, Germany
Running pre-joinscripts hook(s): done
Running 01univention-ldap-server-init.inst skipped (already executed)
Running 02univention-directory-notifier.inst skipped (already executed)
Running 03univention-directory-listener.inst skipped (already executed)
Running 04univention-ldap-client.inst skipped (already executed)
Running 05univention-bind.inst skipped (already executed)
Running 08univention-apache.inst skipped (already executed)
Running 10univention-ldap-server.inst skipped (already executed)
Running 11univention-heimdal-init.inst skipped (already executed)
Running 11univention-pam.inst skipped (already executed)
Running 15univention-directory-notifier-post.inst skipped (already executed)
Running 15univention-heimdal-kdc.inst skipped (already executed)
Running 18python-univention-directory-manager.inst skipped (already executed)
Running 20univention-directory-policy.inst skipped (already executed)
Running 20univention-join.inst skipped (already executed)
Running 20univention-ldap-config-master.inst skipped (already executed)
Running 22univention-directory-manager-rest.inst skipped (already executed)
Running 25univention-dhcp.inst skipped (already executed)
Running 26univention-nagios-common.inst skipped (already executed)
Running 30univention-appcenter.inst skipped (already executed)
Running 30univention-monitoring-client.inst skipped (already executed)
Running 30univention-nagios-client.inst skipped (already executed)
Running 31univention-monitoring-cups.inst skipped (already executed)
Running 31univention-monitoring-s4-connector.inst skipped (already executed)
Running 31univention-monitoring-samba.inst skipped (already executed)
Running 31univention-nagios-s4-connector.inst skipped (already executed)
Running 31univention-nagios-samba.inst skipped (already executed)
Running 33univention-portal.inst skipped (already executed)
Running 34univention-self-service.inst skipped (already executed)
Running 35univention-appcenter-docker.inst skipped (already executed)
Running 35univention-management-console-module-adtakeover.inst skipped (already executed)
Running 35univention-management-console-module-appcenter.inst skipped (already executed)
Running 35univention-management-console-module-diagnostic.inst skipped (already executed)
Running 35univention-management-console-module-ipchange.inst skipped (already executed)
Running 35univention-management-console-module-join.inst skipped (already executed)
Running 35univention-management-console-module-lib.inst skipped (already executed)
Running 35univention-management-console-module-pkgdb.inst skipped (already executed)
Running 35univention-management-console-module-printers.inst skipped (already executed)
Running 35univention-management-console-module-quota.inst skipped (already executed)
Running 35univention-management-console-module-reboot.inst skipped (already executed)
Running 35univention-management-console-module-services.inst skipped (already executed)
Running 35univention-management-console-module-setup.inst skipped (already executed)
Running 35univention-management-console-module-sysinfo.inst skipped (already executed)
Running 35univention-management-console-module-top.inst skipped (already executed)
Running 35univention-management-console-module-ucr.inst skipped (already executed)
Running 35univention-management-console-module-udm.inst skipped (already executed)
Running 35univention-management-console-module-updater.inst skipped (already executed)
Running 35univention-management-console-module-welcome.inst skipped (already executed)
Running 35univention-nagios-cups.inst skipped (already executed)
Running 35univention-self-service-master.inst skipped (already executed)
Running 35univention-self-service-passwordreset-umc.inst skipped (already executed)
Running 35univention-server-overview.inst skipped (already executed)
Running 36univention-management-console-module-apps.inst skipped (already executed)
Running 49univention-keycloak-client.inst skipped (already executed)
Running 50univention-pkgdb.inst skipped (already executed)
Running 55univention-node-exporter.inst skipped (already executed)
Running 67univention-mail-server.inst skipped (already executed)
Running 79univention-printserver.inst skipped (already executed)
Running 81univention-nfs-server.inst skipped (already executed)
Running 82univention-mail-dovecot.inst skipped (already executed)
Running 90univention-bind-post.inst skipped (already executed)
Running 92univention-management-console-web-server.inst skipped (already executed)
Running 94openvpn4ucs.inst skipped (already executed)
Running 96univention-samba4.inst skipped (already executed)
Running 97univention-s4-connector.inst skipped (already executed)
Running 98univention-pkgdb-tools.inst skipped (already executed)
Running 98univention-samba4-dns.inst skipped (already executed)
Running 51keycloak-uninstall.uinst done
Running post-joinscripts hook(s): done
Potential script hook folder is unused: /var/lib/univention-appcenter/apps/keycloak/local/hooks/post-remove.d
'NoneType' object is not subscriptable
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/__init__.py", line 161, in call_with_namespace
result = self.main(namespace)
^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install.py", line 66, in main
return self.do_it(args)
^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install_base.py", line 140, in do_it
success = self.do_it_once(app, args)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install.py", line 182, in do_it_once
return super().do_it_once(app, args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install_base.py", line 185, in do_it_once
self._do_it(app, args)
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/docker_install.py", line 46, in _do_it
ret = super()._do_it(app, args)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install.py", line 96, in _do_it
if self._install_app(app, args):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/docker_install.py", line 40, in _install_app
self._start_docker_image(app, hostdn, password, args)
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/docker_base.py", line 222, in _start_docker_image
f_name = docker.path('/etc/machine.secret')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/docker.py", line 342, in path
return os.path.join(self.root_dir, filename)
^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/docker.py", line 258, in root_dir
self._root_dir = self.inspect_container()['GraphDriver']['Data']['MergedDir']
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
TypeError: 'NoneType' object is not subscriptable
Traceback (most recent call last):
File "/usr/bin/univention-app", line 80, in <module>
main()
File "/usr/bin/univention-app", line 67, in main
ret = action(args)
^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/__init__.py", line 161, in call_with_namespace
result = self.main(namespace)
^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install.py", line 66, in main
return self.do_it(args)
^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install_base.py", line 140, in do_it
success = self.do_it_once(app, args)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install.py", line 182, in do_it_once
return super().do_it_once(app, args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install_base.py", line 185, in do_it_once
self._do_it(app, args)
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/docker_install.py", line 46, in _do_it
ret = super()._do_it(app, args)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/install.py", line 96, in _do_it
if self._install_app(app, args):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/docker_install.py", line 40, in _install_app
self._start_docker_image(app, hostdn, password, args)
File "/usr/lib/python3/dist-packages/univention/appcenter/actions/docker_base.py", line 222, in _start_docker_image
f_name = docker.path('/etc/machine.secret')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/docker.py", line 342, in path
return os.path.join(self.root_dir, filename)
^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/univention/appcenter/docker.py", line 258, in root_dir
self._root_dir = self.inspect_container()['GraphDriver']['Data']['MergedDir']
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
TypeError: 'NoneType' object is not subscriptable