Keycloak Realm Export Fails with NullPointerException for Default Policy (JavaScript Policies)
Problem
When performing a backup-and-restore for Keycloak, a backup of the Keycloak configuration can be made. However, when executing the backup command, several error messages are generated, and no backup file is created for the ucs realm.
You can get more output during the backup creation by adding the --verbose flag:
univention-app shell keycloak /opt/keycloak/bin/kc.sh export \
--db=$(ucr get kc/db/kind) \
--db-driver=$(ucr get kc/db/driver) \
--transaction-xa-enabled=$(ucr get kc/db/xa) \
--dir /var/lib/univention-appcenter/apps/keycloak/data/myexport \
--verbose
Traceback
Changes detected in configuration. Updating the server image.
Updating the configuration and installing your custom providers, if any. Please wait.
2026-07-13 12:02:19,615 WARN [io.quarkus.arc.deployment.SplitPackageProcessor] (build-25) Detected a split package usage which is considered a bad practice and should be avoided. Following packages were detected in multiple archives:
- "de.univention.keycloak" found in [/opt/keycloak/lib/../providers/univention-app-authenticator-1.0.jar, /opt/keycloak/lib/../providers/univention-condition-ipaddress-1.0.jar, /opt/keycloak/lib/../providers/univention-ldap-mapper-1.0.jar, /opt/keycloak/lib/../providers/univention-user-attribute-nameid-mapper-base64-1.0.jar]
2026-07-13 12:02:20,245 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: univention-saml-user-attribute-nameid-mapper-base64 (de.univention.keycloak.UniventionUserAttributeNameIdMapperBase64) is implementing the internal SPI protocol-mapper. This SPI is internal and may change without notice
2026-07-13 12:02:20,258 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: freemarker (de.univention.keycloak.UniventionFreeMarkerLoginFormsProviderFactory) is implementing the internal SPI login. This SPI is internal and may change without notice
2026-07-13 12:02:20,510 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: univention-condition-ipaddress (de.univention.keycloak.UniventionConditionIpAddressFactory) is implementing the internal SPI authenticator. This SPI is internal and may change without notice
2026-07-13 12:02:20,511 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: univention-authenticator (de.univention.authenticator.UniventionAuthenticatorFactory) is implementing the internal SPI authenticator. This SPI is internal and may change without notice
2026-07-13 12:02:20,512 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: univention-app-authenticator (de.univention.keycloak.UniventionAppAuthenticatorFactory) is implementing the internal SPI authenticator. This SPI is internal and may change without notice
2026-07-13 12:02:20,673 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: UNIVENTION_UPDATE_PASSWORD (de.univention.keycloak.UniventionUpdatePasswordFactory) is implementing the internal SPI required-action. This SPI is internal and may change without notice
2026-07-13 12:02:20,673 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: UNIVENTION_SELF_SERVICE (de.univention.keycloak.UniventionSelfServiceFactory) is implementing the internal SPI required-action. This SPI is internal and may change without notice
2026-07-13 12:02:20,711 WARN [org.keycloak.services] (build-24) KC-SERVICES0047: univention-ldap-mapper (de.univention.keycloak.UniventionUserAccountControlStorageMapperFactory) is implementing the internal SPI ldap-mapper. This SPI is internal and may change without notice
2026-07-13 12:02:22,889 INFO [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 6733ms
Server configuration updated and persisted. Run the following command to review the configuration:
kc.sh show-config
Next time you run the server, just add --optimized to the command to ensure this build is used.
2026-07-13 12:02:26,759 INFO [org.infinispan.CONTAINER] (main) ISPN000974: Virtual threads support: unavailable
2026-07-13 12:02:28,062 INFO [org.hibernate.orm.jdbc.batch] (JPA Startup Thread) HHH100501: Automatic JDBC statement batching enabled (maximum batch size 32)
2026-07-13 12:02:28,791 INFO [org.keycloak.quarkus.runtime.storage.database.jpa.DatabaseIndexChecker] (db-index-checker) Running database index checker
2026-07-13 12:02:29,800 INFO [org.infinispan.CONTAINER] (main) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'
2026-07-13 12:02:30,219 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: node_323617, Site name: null
2026-07-13 12:02:30,235 INFO [org.keycloak.models.workflow.WorkflowsEventListenerFactory] (main) Workflow runner task scheduled: next execution at 00:02:30, then every PT12H
2026-07-13 12:02:30,535 INFO [org.keycloak.services] (main) KC-SERVICES0033: Full model export requested
2026-07-13 12:02:31,056 INFO [org.keycloak.exportimport.dir.DirExportProvider] (main) Exporting into directory /var/lib/univention-appcenter/apps/keycloak/data/myexport
2026-07-13 12:02:31,129 INFO [org.keycloak.exportimport.dir.DirExportProvider] (main) Realm 'master' - data exported
2026-07-13 12:02:31,215 INFO [org.keycloak.exportimport.dir.DirExportProvider] (main) Users 0 - 0 exported
2026-07-13 12:02:33,319 INFO [com.arjuna.ats.jbossatx] (main) ARJUNA032014: Stopping transaction recovery manager
2026-07-13 12:02:33,344 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (nonserver) mode
2026-07-13 12:02:33,344 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Error while exporting policy [Default Policy].
2026-07-13 12:02:33,344 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Cannot invoke "org.keycloak.authorization.policy.provider.PolicyProviderFactory.onExport(org.keycloak.authorization.model.Policy, org.keycloak.representations.idm.authorization.PolicyRepresentation, org.keycloak.authorization.AuthorizationProvider)" because "providerFactory" is null
2026-07-13 12:02:33,344 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.
2026-07-13 12:06:34,684 INFO [org.infinispan.CONTAINER] (main) ISPN000974: Virtual threads support: unavailable
2026-07-13 12:06:35,738 INFO [org.hibernate.orm.jdbc.batch] (JPA Startup Thread) HHH100501: Automatic JDBC statement batching enabled (maximum batch size 32)
2026-07-13 12:06:36,376 INFO [org.keycloak.quarkus.runtime.storage.database.jpa.DatabaseIndexChecker] (db-index-checker) Running database index checker
2026-07-13 12:06:36,945 INFO [org.keycloak.jgroups.certificates.CertificateReloadManager] (main) Starting JGroups certificate reload manager
2026-07-13 12:06:37,357 INFO [org.infinispan.CONTAINER] (main) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'
2026-07-13 12:06:37,694 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: node_400844, Site name: null
2026-07-13 12:06:37,743 INFO [org.keycloak.models.workflow.WorkflowsEventListenerFactory] (main) Workflow runner task scheduled: next execution at 00:06:37, then every PT12H
2026-07-13 12:06:37,996 INFO [org.keycloak.services] (main) KC-SERVICES0033: Full model export requested
2026-07-13 12:06:38,462 INFO [org.keycloak.exportimport.dir.DirExportProvider] (main) Exporting into directory /var/lib/univention-appcenter/apps/keycloak/data/myexport
2026-07-13 12:06:38,530 INFO [org.keycloak.exportimport.dir.DirExportProvider] (main) Realm 'master' - data exported
2026-07-13 12:06:38,604 INFO [org.keycloak.exportimport.dir.DirExportProvider] (main) Users 0 - 0 exported
2026-07-13 12:06:40,664 INFO [com.arjuna.ats.jbossatx] (main) ARJUNA032014: Stopping transaction recovery manager
2026-07-13 12:06:40,688 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (nonserver) mode
2026-07-13 12:06:40,689 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) Error details:: java.lang.RuntimeException: Error while exporting policy [Default Policy].
at org.keycloak.models.utils.ModelToRepresentation.toRepresentation(ModelToRepresentation.java:1428)
at org.keycloak.models.utils.ModelToRepresentation.lambda$toResourceServerRepresentation$16(ModelToRepresentation.java:1369)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
at java.base/java.util.LinkedList$LLSpliterator.forEachRemaining(LinkedList.java:1242)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
at org.keycloak.models.utils.ModelToRepresentation.toResourceServerRepresentation(ModelToRepresentation.java:1372)
at org.keycloak.exportimport.util.ExportUtils.exportClient(ExportUtils.java:320)
at org.keycloak.exportimport.util.ExportUtils.lambda$exportRealm$0(ExportUtils.java:107)
at org.keycloak.models.utils.ModelToRepresentation.lambda$filterValidRepresentations$7(ModelToRepresentation.java:770)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1845)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
at org.keycloak.utils.ClosingStream.collect(ClosingStream.java:182)
at org.keycloak.exportimport.util.ExportUtils.exportRealm(ExportUtils.java:110)
at org.keycloak.exportimport.util.ExportUtils.exportRealm(ExportUtils.java:81)
at org.keycloak.exportimport.util.MultipleStepsExportProvider$2.runExportImportTask(MultipleStepsExportProvider.java:109)
at org.keycloak.exportimport.util.ExportImportSessionTask.lambda$run$1(ExportImportSessionTask.java:58)
at org.keycloak.connections.jpa.support.EntityManagers.runInBatchMode(EntityManagers.java:43)
at org.keycloak.connections.jpa.support.EntityManagers.runInBatch(EntityManagers.java:117)
at org.keycloak.exportimport.util.ExportImportSessionTask.run(ExportImportSessionTask.java:64)
at org.keycloak.exportimport.util.ExportImportSessionTask.lambda$runTask$0(ExportImportSessionTask.java:51)
at org.keycloak.models.utils.KeycloakModelUtils.lambda$runJobInTransaction$1(KeycloakModelUtils.java:355)
at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:469)
at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:354)
at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:344)
at org.keycloak.exportimport.util.ExportImportSessionTask.runTask(ExportImportSessionTask.java:51)
at org.keycloak.exportimport.util.MultipleStepsExportProvider.exportRealmImpl(MultipleStepsExportProvider.java:165)
at org.keycloak.exportimport.util.MultipleStepsExportProvider.exportModel(MultipleStepsExportProvider.java:75)
at org.keycloak.exportimport.ExportImportManager.runExport(ExportImportManager.java:159)
at org.keycloak.services.resources.KeycloakApplication.runBootstrap(KeycloakApplication.java:102)
at org.keycloak.services.resources.KeycloakApplication.startup(KeycloakApplication.java:80)
at org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication.onStartupEvent(QuarkusKeycloakApplication.java:75)
at org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication_Observer_onStartupEvent_ce5XOZYOfrotBEj0Q9isImsjqEg.notify(Unknown Source)
at io.quarkus.arc.impl.EventImpl$Notifier.notifyObservers(EventImpl.java:366)
at io.quarkus.arc.impl.EventImpl$Notifier.notify(EventImpl.java:348)
at io.quarkus.arc.impl.EventImpl.fire(EventImpl.java:81)
at io.quarkus.arc.runtime.ArcRecorder.fireLifecycleEvent(ArcRecorder.java:165)
at io.quarkus.arc.runtime.ArcRecorder.handleLifecycleEvents(ArcRecorder.java:115)
at io.quarkus.runner.recorded.LifecycleEventsBuildStep$startupEvent1144526294.deploy_0(Unknown Source)
at io.quarkus.runner.recorded.LifecycleEventsBuildStep$startupEvent1144526294.deploy(Unknown Source)
at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
at io.quarkus.runtime.Application.start(Application.java:112)
at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:127)
at io.quarkus.runtime.Quarkus.run(Quarkus.java:79)
at org.keycloak.quarkus.runtime.KeycloakMain.start(KeycloakMain.java:132)
at org.keycloak.quarkus.runtime.cli.Picocli.start(Picocli.java:918)
at org.keycloak.quarkus.runtime.cli.command.AbstractAutoBuildCommand.runCommand(AbstractAutoBuildCommand.java:112)
at org.keycloak.quarkus.runtime.cli.command.AbstractCommand.lambda$call$1(AbstractCommand.java:66)
at java.base/java.util.Optional.orElseGet(Optional.java:364)
at org.keycloak.quarkus.runtime.cli.command.AbstractCommand.call(AbstractCommand.java:65)
at org.keycloak.quarkus.runtime.cli.command.AbstractCommand.call(AbstractCommand.java:34)
at picocli.CommandLine.executeUserObject(CommandLine.java:2031)
at picocli.CommandLine.access$1500(CommandLine.java:148)
at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2469)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2461)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2423)
at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2277)
at picocli.CommandLine$RunLast.execute(CommandLine.java:2425)
at picocli.CommandLine.execute(CommandLine.java:2174)
at org.keycloak.quarkus.runtime.cli.Picocli.execute(Picocli.java:198)
at org.keycloak.quarkus.runtime.cli.Picocli.parseAndRun(Picocli.java:187)
at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:104)
at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:84)
at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:86)
at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:37)
Caused by: java.lang.NullPointerException: Cannot invoke "org.keycloak.authorization.policy.provider.PolicyProviderFactory.onExport(org.keycloak.authorization.model.Policy, org.keycloak.representations.idm.authorization.PolicyRepresentation, org.keycloak.authorization.AuthorizationProvider)" because "providerFactory" is null
at org.keycloak.models.utils.ModelToRepresentation.toRepresentation(ModelToRepresentation.java:1200)
at org.keycloak.models.utils.ModelToRepresentation.toRepresentation(ModelToRepresentation.java:1189)
at org.keycloak.models.utils.ModelToRepresentation.toRepresentation(ModelToRepresentation.java:1400)
The key portions of the traceback are:
2026-07-13 12:06:40,688 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (nonserver) mode 2026-07-13 12:06:40,689 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) Error details:: java.lang.RuntimeException: Error while exporting policy [Default Policy].
Caused by: java.lang.NullPointerException: Cannot invoke "org.keycloak.authorization.policy.provider.PolicyProviderFactory.onExport(org.keycloak.authorization.model.Policy, org.keycloak.representations.idm.authorization.PolicyRepresentation, org.keycloak.authorization.AuthorizationProvider)" because "providerFactory" is null
Root Cause
The interface org.keycloak.authorization.policy.provider.PolicyProviderFactory is a core, built-in component of Keycloak’s architecture (specifically for Authorization Services / Fine-Grained Authorization).
During export, Keycloak attempts to invoke the factory corresponding to the policy type. However, Keycloak cannot find this factory (providerFactory is null) and crashes with a NullPointerException:
Cannot invoke "org.keycloak.authorization.policy.provider.PolicyProviderFactory.onExport(...)" because "providerFactory" is null
Why is the Factory Missing?
JavaScript Policies Disabled (Most common cause starting with Keycloak 24+)
Historically, the automatically created Default Policy in Keycloak was often of type js (JavaScript). Starting with Keycloak 24+, the JavaScript feature (keycloak-js-policies) is disabled by default and must be explicitly enabled via a feature flag. If it is disabled, the factory is missing, causing the export to crash at this exact point.
This error appears to stem from a legacy configuration containing JavaScript policies that can no longer be evaluated in Keycloak 24+ due to JavaScript policies being disabled by default.
Inspecting the Keycloak PostgreSQL database directly on host <HOSTNAME> reveals that the following clients still contain the Default Policy:
keycloak=# SELECT id, name, type, resource_server_id
FROM resource_server_policy
WHERE name = 'Default Policy';
id | name | type | resource_server_id
--------------------------------------+----------------+------+--------------------------------------
00b77062-a7a8-461e-a839-c3aa6fb67d23 | Default Policy | js | 9f07939f-06de-44b9-a286-092a7cd47be6
2bb44650-d19c-4d28-aedb-86626d21d2de | Default Policy | js | 8e76429c-c577-4f8c-85d7-b2684583ab78
0b60112b-7e8a-4b17-85ed-1ef82af1b70f | Default Policy | js | c3e35d25-d2c5-45a5-877c-6c1c09cf3e5b
(3 rows)
keycloak=# SELECT id, client_id, realm_id
FROM client
WHERE id IN (
'9f07939f-06de-44b9-a286-092a7cd47be6',
'8e76429c-c577-4f8c-85d7-b2684583ab78',
'c3e35d25-d2c5-45a5-877c-6c1c09cf3e5b'
);
id | client_id | realm_id
--------------------------------------+--------------+----------
9f07939f-06de-44b9-a286-092a7cd47be6 | jamfconnect | ucs
8e76429c-c577-4f8c-85d7-b2684583ab78 | jamfconnect2 | ucs
c3e35d25-d2c5-45a5-877c-6c1c09cf3e5b | ipad-mgmt | ucs
(3 rows)
Investigation
To check whether the required extension (i.e., the logic for JavaScript policies) is present or active in Keycloak, check via the filesystem of the Univention App.
Since js-policies is a standard Keycloak feature, no external JAR file needs to be installed. The feature is already integrated into the codebase, but disabled by default.
Because Keycloak runs within a Docker container under UCS, the configuration and loaded modules can be inspected directly via the CLI on the UCS server.
Look for the lines kc.features or kc.features-disabled in the command output.
If js-policies is listed under disabled features (or does not appear at all), the feature is not loaded.
univention-app shell keycloak /opt/keycloak/bin/kc.sh show-config
root@<HOSTNAME>:~/univention-support# univention-app shell keycloak /opt/keycloak/bin/kc.sh show-config
Current Mode: production
Current Configuration:
kc.provider.file.org.jboss.resteasy.resteasy-client-api-6.2.5.Final.jar.last-modified = 1782372729966 (Persisted)
kc.provider.file.univention-authenticator-1.0-jar-with-dependencies.jar.last-modified = 1782372729966 (Persisted)
kc.provider.file.okio-2.10.0.jar.last-modified = 1782372729966 (Persisted)
kc.spi-events-listener--jboss-logging--success-level = DEBUG (ENV)
kc.provider.file.ipaddress-5.5.1.jar.last-modified = 1782372729962 (Persisted)
kc.spi.events.listener."jboss.logging".success.level = DEBUG (EnvConfigSource)
kc.http-port = 8180 (ENV)
kc.log-level = INFO (ENV)
kc.spi.events.listener."jboss.logging".error.level = WARN (EnvConfigSource)
kc.db-ping-datatype = BYTEA (ENV)
kc.spi-events-listener--jboss-logging--error-level = WARN (ENV)
kc.db-driver = org.postgresql.Driver (ENV)
kc.db-username = keycloak (ENV)
kc.log-console-output = default (classpath application.properties)
kc.provider.file.kotlin-stdlib-1.4.32.jar.last-modified = 1782372729966 (Persisted)
kc.db = postgres (Persisted)
kc.provider.file.gson-2.8.9.jar.last-modified = 1782372729962 (Persisted)
kc.db-xa = false (ENV)
kc.version = 26.6.3 (SysPropConfigSource)
kc.db-url = jdbc:postgresql://<DOMAIN_NAME>:5432/keycloak?sslmode=require (ENV)
kc.transaction-xa-enabled = false (Persisted)
kc.provider.file.univention-ldap-mapper-1.0.jar.last-modified = 1782372729966 (Persisted)
kc.db-password = <REDACTED> (ENV)
kc.provider.file.univention-app-authenticator-1.0.jar.last-modified = 1782372729966 (Persisted)
kc.provider.file.gson-fire-1.9.0.jar.last-modified = 1782372729962 (Persisted)
kc.db-kind = postgres (ENV)
kc.provider.file.okhttp-4.9.3.jar.last-modified = 1782372729966 (Persisted)
kc.provider.file.org.jboss.resteasy.resteasy-client-6.2.5.Final.jar.last-modified = 1782372729966 (Persisted)
kc.log-file = /opt/keycloak/bin/../data/log/keycloak.log (classpath application.properties)
kc.provider.file.univention-user-attribute-nameid-mapper-base64-1.0.jar.last-modified = 1782372729966 (Persisted)
kc.https-key-store-password = <REDACTED> (ENV)
kc.provider.file.univention-condition-ipaddress-1.0.jar.last-modified = 1782372729966 (Persisted)
In the active configuration list, the option kc.features or kc.features-disabled does not appear at all.
Keycloak is running on default vendor settings for version 26.6.3, where JavaScript policies (js-policies) are disabled by default.
Keycloak uses PostgreSQL as its database by default in Nubus for UCS, the existing tables can be inspected directly:
sudo -u postgres psql
postgres=# \l
List of databases
Name | Owner | Encoding | Collate | Ctype | ICU Locale | Locale Provider | Access privileges
---------------+---------------+----------+-------------+-------------+------------+-----------------+-----------------------
importhttpapi | importhttpapi | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc |
keycloak | keycloak | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc |
pkgdb | postgres | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc |
postgres | postgres | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc |
selfservice | selfservice | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc |
template0 | postgres | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc | =c/postgres +
| | | | | | | postgres=CTc/postgres
template1 | postgres | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | | libc | =c/postgres +
| | | | | | | postgres=CTc/postgres
(7 rows)
postgres=# \c keycloak
You are now connected to database "keycloak" as user "postgres".
keycloak=# \dt
List of relations
Schema | Name | Type | Owner
--------+-------------------------------+-------+----------
public | admin_event_entity | table | keycloak
public | associated_policy | table | keycloak
public | authentication_execution | table | keycloak
public | authentication_flow | table | keycloak
public | authenticator_config | table | keycloak
public | authenticator_config_entry | table | keycloak
public | broker_link | table | keycloak
public | client | table | keycloak
public | client_attributes | table | keycloak
public | client_auth_flow_bindings | table | keycloak
public | client_initial_access | table | keycloak
public | client_node_registrations | table | keycloak
public | client_scope | table | keycloak
public | client_scope_attributes | table | keycloak
public | client_scope_client | table | keycloak
public | client_scope_role_mapping | table | keycloak
public | component | table | keycloak
public | component_config | table | keycloak
public | composite_role | table | keycloak
public | credential | table | keycloak
public | databasechangelog | table | keycloak
public | databasechangeloglock | table | keycloak
public | default_client_scope | table | keycloak
public | event_entity | table | keycloak
public | fed_user_attribute | table | keycloak
public | fed_user_consent | table | keycloak
public | fed_user_consent_cl_scope | table | keycloak
public | fed_user_credential | table | keycloak
public | fed_user_group_membership | table | keycloak
public | fed_user_required_action | table | keycloak
public | fed_user_role_mapping | table | keycloak
public | federated_identity | table | keycloak
public | federated_user | table | keycloak
public | group_attribute | table | keycloak
public | group_role_mapping | table | keycloak
public | identity_provider | table | keycloak
public | identity_provider_config | table | keycloak
public | identity_provider_mapper | table | keycloak
public | idp_mapper_config | table | keycloak
public | jgroups_ping | table | keycloak
public | jgroupsping | table | keycloak
public | keycloak_group | table | keycloak
public | keycloak_role | table | keycloak
public | migration_model | table | keycloak
public | offline_client_session | table | keycloak
public | offline_user_session | table | keycloak
public | org | table | keycloak
public | org_domain | table | keycloak
public | org_invitation | table | keycloak
public | policy_config | table | keycloak
public | protocol_mapper | table | keycloak
public | protocol_mapper_config | table | keycloak
public | realm | table | keycloak
public | realm_attribute | table | keycloak
public | realm_default_groups | table | keycloak
public | realm_enabled_event_types | table | keycloak
public | realm_events_listeners | table | keycloak
public | realm_localizations | table | keycloak
public | realm_required_credential | table | keycloak
public | realm_smtp_config | table | keycloak
public | realm_supported_locales | table | keycloak
public | redirect_uris | table | keycloak
public | required_action_config | table | keycloak
public | required_action_provider | table | keycloak
public | resource_attribute | table | keycloak
public | resource_policy | table | keycloak
public | resource_scope | table | keycloak
public | resource_server | table | keycloak
public | resource_server_perm_ticket | table | keycloak
public | resource_server_policy | table | keycloak
public | resource_server_resource | table | keycloak
public | resource_server_scope | table | keycloak
public | resource_uris | table | keycloak
public | revoked_token | table | keycloak
public | role_attribute | table | keycloak
public | scope_mapping | table | keycloak
public | scope_policy | table | keycloak
public | server_config | table | keycloak
public | user_attribute | table | keycloak
public | user_consent | table | keycloak
public | user_consent_client_scope | table | keycloak
public | user_entity | table | keycloak
public | user_federation_config | table | keycloak
public | user_federation_mapper | table | keycloak
public | user_federation_mapper_config | table | keycloak
public | user_federation_provider | table | keycloak
public | user_group_membership | table | keycloak
public | user_required_action | table | keycloak
public | user_role_mapping | table | keycloak
public | web_origins | table | keycloak
public | workflow_state | table | keycloak
(91 rows)
keycloak=# SELECT id, name, type, resource_server_id
FROM resource_server_policy
WHERE name = 'Default Policy';
id | name | type | resource_server_id
--------------------------------------+----------------+------+--------------------------------------
00b77062-a7a8-461e-a839-c3aa6fb67d23 | Default Policy | js | 9f07939f-06de-44b9-a286-092a7cd47be6
2bb44650-d19c-4d28-aedb-86626d21d2de | Default Policy | js | 8e76429c-c577-4f8c-85d7-b2684583ab78
0b60112b-7e8a-4b17-85ed-1ef82af1b70f | Default Policy | js | c3e35d25-d2c5-45a5-877c-6c1c09cf3e5b
(3 rows)
keycloak=# SELECT id, client_id, realm_id
FROM client
WHERE id IN (
'9f07939f-06de-44b9-a286-092a7cd47be6',
'8e76429c-c577-4f8c-85d7-b2684583ab78',
'c3e35d25-d2c5-45a5-877c-6c1c09cf3e5b'
);
id | client_id | realm_id
--------------------------------------+--------------+----------
9f07939f-06de-44b9-a286-092a7cd47be6 | jamfconnect | ucs
8e76429c-c577-4f8c-85d7-b2684583ab78 | jamfconnect2 | ucs
c3e35d25-d2c5-45a5-877c-6c1c09cf3e5b | ipad-mgmt | ucs
(3 rows)
Solution
- Open the Keycloak Admin Console.
- Check the relevant clients to see if they contain an Authorization tab and a Policies sub-menu.
- Locate the Default Policy listed in those clients, then delete or disable it.
- Retry the backup process, the backup and restore process should now complete without errors as expected.