@xgp Can you include the required keycloak-admin-client dependency in quarkus/runtime/pom.xml and build the server as described here: Building keycloak?
If you then declare the dependency in your extension as provided, it should no longer cause a conflict.

I can try this. Can you explain exactly what this does? What is special about this library that requires a custom build of Keycloak? Are there other libraries with the same requirements? Is there any documentation that explains this? Thank you!

I am getting a build error when I do as suggested by @koplas...would be curious to know if yours builds.

I am getting a build error when I do as suggested by @koplas...would be curious to know if yours builds.

The following works for me:

1. Clone the keycloak repo

2. Run mvn -DskipTests clean install

3. Add keycloak-admin-client-reactive to the runtime and keycloak-admin-client-reactive-deployment to deployment (Apply this keycloak-admin-client.diff.txt)

4. Run mvn -pl quarkus/deployment,quarkus/dist -am -DskipTests clean install

I have not tested it, but now you should be able to use the keycloak-admin-client-reactive in your extension.

Can you explain exactly what this does? What is special about this library that requires a custom build of Keycloak? Are there other libraries with the same requirements? Is there any documentation that explains this?

Keycloak provides a couple of dependencies that the extension can use. For example, quarkus-resteasy-reactive is provided by the Quarkus runtime and can be used by the Keycloak extension. Using a dependency that uses the same transitive dependencies as the runtime can result in these errors. A workaround would be to exclude all conflicting dependencies, but this can break if you upgrade Keycloak.

I have a similar problem and the documentation and upgrade guide only mentions that the usage is deprecated and the application should be rewritten. Someone with Quarkus and Keycloak expertise can provide the intended way of including dependencies into the extension.

Thanks @koplas . It needed the quarkus-keycloak-admin-client-common as well, but it seems to work. Here is the patch I had to use:

diff --git a/quarkus/deployment/pom.xml b/quarkus/deployment/pom.xml
index 4476986c6d..824fff2267 100644
--- a/quarkus/deployment/pom.xml
    b/quarkus/deployment/pom.xml
@@ -170,6  170,19 @@
             <artifactId>rest-assured</artifactId>
             <scope>test</scope>
         </dependency>
 
         <!-- Dependencies used by keycloak extensions -->
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-keycloak-admin-client-common-deployment</artifactId>
             <version>3.2.9.Final</version>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-keycloak-admin-client-reactive-deployment</artifactId>
             <version>3.2.9.Final</version>
         </dependency>
 
     </dependencies>
 
     <build>
diff --git a/quarkus/runtime/pom.xml b/quarkus/runtime/pom.xml
index 50a99a9f85..8465d770a4 100644
--- a/quarkus/runtime/pom.xml
    b/quarkus/runtime/pom.xml
@@ -112,6  112,18 @@
             <artifactId>picocli</artifactId>
         </dependency>
 
 	<!-- Dependencies used by keycloak extensions -->
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-keycloak-admin-client-common</artifactId>
             <version>3.2.9.Final</version>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-keycloak-admin-client-reactive</artifactId>
             <version>3.2.9.Final</version>
         </dependency>
 
         <!-- Keycloak -->
         <dependency>
             <groupId>org.keycloak</groupId>

I appreciate your explanation, but I still don't really understand what is going on or why it requires a custom build. Does it have to do with those -deployment dependencies that end up in /opt/keycloak/lib/lib/deployment/ dir? And that gets used during the build phase to set up some of the quarkus magic?

I've been using the Keycloak Admin Client in extensions since version 9, and there has always been some problem. Between having to build your own module, RESTEasy dependency/version hell, and now this. It really makes the case to stop using it altogether.

I'm also facing the same issue. Will this be fixed in a future version?

Thanks.

This is more of an issue of how Quarkus handles extensions and not a keycloak specific problem.

The root cause for this problem seems to be that different ClassLoaders are used.

I am adding to Backlog as not sure when Keycloak team has capacity to prioritize this. Anyone is welcome to investigate and send PR with fixing this if it can be fixed on Keycloak side in a nice way. See contributions guide for the details how to contribute a fix https://github.com/keycloak/keycloak/blob/main/CONTRIBUTING.md .

The possible workaround is also to not use keycloak-admin-client in your providers. As long as provider is deployed in Keycloak, it might be an option to use model-api directly (for example use something like session.realms().getRealm() to obtain RealmModel in your provider instead of calling keycloak-admin-client to obtain realm).

Thanks @mposolda

The diff that I sent solves it, but it causes the admin client to be bundled in Keycloak. Because there is not an external way to solve the use of the admin client, we found this to be the only way. I can PR that diff, but I'm not sure if Keycloak is willing to accept the addition of a library that is only depended on by extensions.

Regarding your workaround suggestion, I agree with using the KeycloakSession for cases where you are working agains the local Keycloak. However, we have a couple of extensions that actually manage remote Keycloaks (e.g. for managing multi-Realm, multi-tenancy) from an extension. I also (a while ago when I first encountered the problem of having to custom build a Wildfly module to import the admin client) did a quick search on GitHub of extensions that use the admin client. I found it to be fairly common. One of the other rationales I found (beyond communicating with remote Keycloaks) is that extension developers had used the admin client in their code so that it could be run both inside and outside of Keycloak, which I considered to be a pretty good argument.

Anyway, LMK if you would consider the diff as a PR, and I'll create a ticket and submit it.

We won't include the admin client in the dist that's for sure, so we need some other solution.

I'd give this a go and see if it works: https://quarkus.io/guides/security-keycloak-admin-client

Thanks for the clarification on including the admin client @stianst

I tried the quarkus "security-keycloak-admin-client" and I wasn't able to get it to work from inside Keycloak.

Due to the amount of issues reported by the community we are not able to prioritise resolving this issue at the moment.

If you are affected by this issue, upvote it by adding a 👍 to the description. We would also welcome a contribution to fix the issue.

Due to lack of updates in the last 180 days this issue will be automatically closed.