Questions[keycloak](server)

I installed Keycloak 26.0.0 on Ubuntu and was able to create a temporary admin account. When I log in a banner says:

You are logged in as a temporary admin user. To harden security, create a permanent admin account and delete the temporary one.

How do I create a permanent admin account? Do I follow the "Managing users" documentation? Do I create the permanent admin account in the master realm? How do I give this admin correct permissions/role?

I read the Managing users documentation. I added a user named admin in the master realm and set a password. I do not see how to give it an admin role or admin permissions. I tried the Assign Role button but the admin role is not listed.

I have seen other questions here about giving admin role for new realms, but not anything that describes giving admin role in the master realm. Nor have I found any questions or documentation that gives details about a "permanent admin account".

I need to authorize my application (named "Logic" from now on) to manage users of a Keycloak realm. "Logic" already authenticates itself against that realm with a client credentials grant access type, so the code is already working.

Now, in the Keycloak administration console, I need to add the correct role to my client so that "Logic" is authorized to call whatever API endpoint Keycloak provides to manage the realm users.

In the realm clients list there is a client named realm-management, which Keycloak provides by default for each realm. This client can manage the whole realm, not just its users, and it has a list of client roles for that reason. manage-users is one of the roles in that list and it is the role I need to assign to my other client (that I named logic in Keycloak). In other words, my "Logic" application uses the keycloak client-id logic to authenticate itself and I need to add the manage-users role to the logic client.

The problem is that in my client (logic) roles settings, those same roles, listed under realm-management client, are not listed at all, and the list only has uma_protection role:

If I searched for "manage-users" by typing it in the search box, it wouldn't show up. Meanwhile, if I click that role in the roles list of the realm-management client, it shows that no users have that role and it lets me add the role to users, but not to clients, even if that role is actually listed in a client (realm-management).

Creating a new role in my logic client, by the same name of manage-users, is possible, but I'm not sure that's the way to go. I mean, why should I duplicate an existing role? It smells of wrong.

Can you please tell me the correct way to add the manage-users role to a client in Keycloak 23?

I'm currently trying to set up keycloak to provide single sign on to a nextcloud and gitlab instance. All three services are running inside a docker compose network with an nginx server as proxy to each of them. I can browse to keycloak, nextcloud and gitlab and log in with the respective admin accounts fine. Only signing in via keycloak to nextcloud or gitlab is not possible.

When trying to log in to nextcloud via keycloak, the following saml request is sent:

<samlp:AuthnRequest
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    ID="ONELOGIN_472a6a24a82cd8195e67727722780d428f21494f"
    Version="2.0"

    IssueInstant="2021-02-08T17:49:07Z"
    Destination="https://mydomain.de/auth/realms/master/protocol/saml"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    AssertionConsumerServiceURL="https://www.mydomain.de/nextcloud/apps/user_saml/saml/acs">
    <saml:Issuer>https://www.mydomain.de/nextcloud/apps/user_saml/saml/metadata</saml:Issuer>
    <samlp:NameIDPolicy
        Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
        AllowCreate="true" />
</samlp:AuthnRequest>

The error logged by keycloak is

 (default task-3) org.keycloak.events.jpa.EventEntity{clientId=null, realmId=master, ipAddress=172.19.0.1, id=c640029f-d9d5-4141-a473-b3ef981b1347, sessionId=null, time=1612806547526, error=invalid_authn_request, type=LOGIN_ERROR, userId=null, detailsJson={"reason":"invalid_destination"}}

What strikes me as odd is the value of ipAddress shown in the error 172.19.0.1, which is the IP of the docker compose network.

When trying to log in to gitlab via keycloak, the following saml request is sent:

<samlp:AuthnRequest AssertionConsumerServiceURL='https://mydomain.de/gitlab/users/auth/saml/callback'
                Destination='https://mydomain.de/auth/realms/master/protocol/saml'
                ID='_51172953-2b87-4c35-bde1-098aff31e7a9' IssueInstant='2021-02-08T16:48:03Z' Version='2.0'
                xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'
                xmlns:samlp='urn:oasis:names:tc:SAML:2.0:protocol'>
<saml:Issuer>https://mydomain.de/gitlab</saml:Issuer>
<samlp:NameIDPolicy AllowCreate='true' Format='urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'/>
</samlp:AuthnRequest>

At least, keycloak gives the same error as when trying to log in to nextcloud.

The docker container for keycloak is setup as

FROM jboss/keycloak:latest
ENV PROXY_ADDRESS_FORWARDING=true

ENV KEYCLOAK_USER=*****
ENV KEYCLOAK_PASSWORD=*****

ENV KEYCLOAK_FRONTEND_URL=https://www.mydomain.de/auth

ENV DB_VENDOR=postgres
ENV DB_DATABASE=******
ENV DB_USER=*****
ENV DB_PASSWORD=*****
ENV DB_ADDR=*****

ENV KEYCLOAK_LOGLEVEL=TRACE
ENV ROOT_LOGLEVEL=TRACE

The respective service in the docker compose file is defined as

keycloak:
    build:
        context: ../container/keycloak
    depends_on:
    -   postgres
    volumes:
    -   "keycloak:/tmp"

Additionally, the reverse proxy configuration in nginx for the keycloak endpoint is

location /auth {
    proxy_pass         http://keycloak:8080;
    proxy_redirect     default;
    proxy_set_header    Host               $host;
    proxy_set_header    X-Real-IP          $remote_addr;
    proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Host   $host;
    proxy_set_header    X-Forwarded-Server $host;
    proxy_set_header    X-Forwarded-Port   $server_port;
    proxy_set_header    X-Forwarded-Proto  $scheme;
    proxy_http_version 1.1;
}

So, evidently, there is something I'm missing. The only hint I found so far is that invalid_destination indicates that the value of destination in the saml request is wrong. However at least the URL is correct. My guess would be that keycloak expects its IP from the docker compose network instead of mydomain.de. However, I thought that

ENV PROXY_ADDRESS_FORWARDING=true

Would solve this issue. I'm happy for any help I can get. If more information are needed, I will provide them ASAP.

I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS.

I followed this tutorial to enable Keycloak to sign me in using SAML. I noticed, that this tutorial is guiding me to download the “SAML Metadata IDPSSODescriptor” from the client's "Installation"-Tab. However, I can only choose "SAML Metadata SPSSODescriptor".

In AWS, I entered the name of my realm as "Provider Name" and imported the SPSSODescriptor. This led to the following error: SAML Providers must reference at least one SAML assertion issuer.

I am trying to start a Keycloak instance which uses a custom mysql database instead of the embedded H2.

Since I am planning to use docker, I created a network for Keyclock docker to communicate with mysql.

docker network create keycloak-network

Following that docker instance of mysql is started with the following command.

sudo docker run --name mysql-container --net keycloak-network -v /home/renju/opt/EXONERATE/DB/mysql-data-5-7:/var/lib/mysql -e MYSQL_DATABASE=keycloak -e MYSQL_USER=ku -e MYSQL_PASSWORD=kupw -e MYSQL_ROOT_PASSWORD=myrootpw -d -p 3306:3306 mysql:5.7

I am expecting keycloak to access the database keycloak with username ku and password kupw. I ensured that the database as well as the user is created in mysql.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| keycloak           |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
5 rows in set (0.00 sec)

mysql> select * from user where User='ku';
+------+------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| Host | User | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin                | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | ku   | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                | N                | N              | N                   | N                  | N                | N          | N            | N                      |          |            |             |              |             0 |           0 |               0 |                    0 | mysql_native_password | *26F9FD80FE9252482EECF5F36ED57EE8551BF34A | N                | 2020-01-29 23:52:37   |              NULL | N              |
+------+------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
1 row in set (0.00 sec)

With mysql up and running, i started the keycloak docker to connect to mysql with user ku accessing the database keycloak.

sudo docker run --name keycloak --net keycloak-network -e DB_ADDR=mysql-container -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e DB_VENDOR=MYSQL -e DB_DATABASE=keycloak -e DB_USER=ku -e DB_PASSWORD=kupw -e JDBC_PARAMS='useSSL=false&allowPublicKeyRetrieval=true' -e JAVA_OPTS="-Djboss.as.management.blocking.timeout=1200" -p 8180:8180 jboss/keycloak -Djboss.http.port=8180

But this command fails while trying to create a schema/insert data into the tables in mysql with the following exception.

23:59:52,439 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 71) MSC000001: Failed to start service jboss.deployment.unit."keycloak-server.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."keycloak-server.war".undertow-deployment: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication()
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at [email protected]//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
    at [email protected]//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
    at [email protected]//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
    at [email protected]//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
    at java.base/java.lang.Thread.run(Thread.java:834)
    at [email protected]//org.jboss.threads.JBossThread.run(JBossThread.java:485)
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication()
    at [email protected]//org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:164)
    at [email protected]//org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2784)
    at [email protected]//org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364)
    at [email protected]//org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277)
    at [email protected]//org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89)
    at [email protected]//org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
    at [email protected]//org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
    at [email protected]//io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
    at [email protected]//org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
    at [email protected]//io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
    at [email protected]//io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:305)
    at [email protected]//io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:145)
    at [email protected]//io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:585)
    at [email protected]//io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:556)
    at [email protected]//io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
    at [email protected]//io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
    at [email protected]//org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1504)
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1504)
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1504)
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1504)
    at [email protected]//io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:598)
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
    at [email protected]//org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
    ... 8 more
Caused by: java.lang.RuntimeException: Failed to update database
    at [email protected]//org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider.update(LiquibaseJpaUpdaterProvider.java:116)
    at [email protected]//org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider.update(LiquibaseJpaUpdaterProvider.java:81)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory$2.run(DefaultJpaConnectionProviderFactory.java:336)
    at [email protected]//org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.update(DefaultJpaConnectionProviderFactory.java:329)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.migration(DefaultJpaConnectionProviderFactory.java:301)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.lambda$lazyInit$0(DefaultJpaConnectionProviderFactory.java:182)
    at [email protected]//org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:682)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.lazyInit(DefaultJpaConnectionProviderFactory.java:133)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:81)
    at [email protected]//org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:59)
    at [email protected]//org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:205)
    at [email protected]//org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:51)
    at [email protected]//org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:33)
    at [email protected]//org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:205)
    at [email protected]//org.keycloak.services.DefaultKeycloakSession.realmLocalStorage(DefaultKeycloakSession.java:158)
    at [email protected]//org.keycloak.models.cache.infinispan.RealmCacheSession.getRealmDelegate(RealmCacheSession.java:148)
    at [email protected]//org.keycloak.models.cache.infinispan.RealmCacheSession.getMigrationModel(RealmCacheSession.java:141)
    at [email protected]//org.keycloak.migration.MigrationModelManager.migrate(MigrationModelManager.java:91)
    at [email protected]//org.keycloak.services.resources.KeycloakApplication.migrateModel(KeycloakApplication.java:272)
    at [email protected]//org.keycloak.services.resources.KeycloakApplication.migrateAndBootstrap(KeycloakApplication.java:213)
    at [email protected]//org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:180)
    at [email protected]//org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
    at [email protected]//org.keycloak.services.resources.KeycloakApplication.startup(KeycloakApplication.java:171)
    at [email protected]//org.keycloak.services.resources.KeycloakApplication.init(KeycloakApplication.java:162)
    at [email protected]//org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:143)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
    at [email protected]//org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152)
    ... 31 more
Caused by: liquibase.exception.MigrationFailedException: Migration failed for change set META-INF/jpa-changelog-1.2.0.Beta1.xml::1.2.0.Beta1::[email protected]:
     Reason: liquibase.exception.UnexpectedLiquibaseException: java.sql.SQLException: IJ031070: Transaction cannot proceed: STATUS_ROLLEDBACK
    at org.liquibase//liquibase.changelog.ChangeSet.execute(ChangeSet.java:607)
    at org.liquibase//liquibase.changelog.visitor.UpdateVisitor.visit(UpdateVisitor.java:51)
    at org.liquibase//liquibase.changelog.ChangeLogIterator.run(ChangeLogIterator.java:79)
    at org.liquibase//liquibase.Liquibase.update(Liquibase.java:214)
    at org.liquibase//liquibase.Liquibase.update(Liquibase.java:192)
    at org.liquibase//liquibase.Liquibase.update(Liquibase.java:188)
    at [email protected]//org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider.updateChangeSet(LiquibaseJpaUpdaterProvider.java:182)
    at [email protected]//org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider.update(LiquibaseJpaUpdaterProvider.java:102)
    ... 61 more
Caused by: liquibase.exception.UnexpectedLiquibaseException: java.sql.SQLException: IJ031070: Transaction cannot proceed: STATUS_ROLLEDBACK
    at org.liquibase//liquibase.database.jvm.JdbcConnection.getURL(JdbcConnection.java:79)
    at org.liquibase//liquibase.executor.jvm.JdbcExecutor.execute(JdbcExecutor.java:66)
    at org.liquibase//liquibase.executor.jvm.JdbcExecutor.execute(JdbcExecutor.java:113)
    at org.liquibase//liquibase.database.AbstractJdbcDatabase.execute(AbstractJdbcDatabase.java:1277)
    at org.liquibase//liquibase.database.AbstractJdbcDatabase.executeStatements(AbstractJdbcDatabase.java:1259)
    at org.liquibase//liquibase.changelog.ChangeSet.execute(ChangeSet.java:582)
    ... 68 more
Caused by: java.sql.SQLException: IJ031070: Transaction cannot proceed: STATUS_ROLLEDBACK
    at [email protected]//org.jboss.jca.adapters.jdbc.WrapperDataSource.checkTransactionActive(WrapperDataSource.java:271)
    at [email protected]//org.jboss.jca.adapters.jdbc.WrappedConnection.checkTransactionActive(WrappedConnection.java:2001)
    at [email protected]//org.jboss.jca.adapters.jdbc.WrappedConnection.checkStatus(WrappedConnection.java:2016)
    at [email protected]//org.jboss.jca.adapters.jdbc.WrappedConnection.checkTransaction(WrappedConnection.java:1990)
    at [email protected]//org.jboss.jca.adapters.jdbc.WrappedConnection.getMetaData(WrappedConnection.java:977)
    at org.liquibase//liquibase.database.jvm.JdbcConnection.getURL(JdbcConnection.java:77)
    ... 73 more

23:59:52,646 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "microprofile-metrics-smallrye")]): java.lang.NullPointerException
    at [email protected]//org.wildfly.extension.microprofile.metrics.MicroProfileMetricsSubsystemAdd$2.execute(MicroProfileMetricsSubsystemAdd.java:86)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:999)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:743)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467)
    at [email protected]//org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1413)
    at [email protected]//org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521)
    at [email protected]//org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472)
    at [email protected]//org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434)
    at [email protected]//org.jboss.as.server.ServerService.boot(ServerService.java:435)
    at [email protected]//org.jboss.as.server.ServerService.boot(ServerService.java:394)
    at [email protected]//org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374)
    at java.base/java.lang.Thread.run(Thread.java:834)

23:59:52,649 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler@757c56a0 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException: java.util.concurrent.RejectedExecutionException
    at [email protected]//org.jboss.threads.RejectingExecutor.execute(RejectingExecutor.java:37)
    at [email protected]//org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2026)
    at [email protected]//org.jboss.threads.EnhancedQueueExecutor.execute(EnhancedQueueExecutor.java:757)
    at [email protected]//org.jboss.as.controller.notification.NotificationSupports$NonBlockingNotificationSupport.emit(NotificationSupports.java:95)
    at [email protected]//org.jboss.as.controller.OperationContextImpl.notifyModificationBegun(OperationContextImpl.java:877)
    at [email protected]//org.jboss.as.controller.OperationContextImpl.ensureWriteLockForRuntime(OperationContextImpl.java:866)
    at [email protected]//org.jboss.as.controller.OperationContextImpl.removeService(OperationContextImpl.java:639)
    at [email protected]//org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler$1.handleRollback(DeployerChainAddHandler.java:135)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext$RollbackDelegatingResultHandler.handleResult(AbstractOperationContext.java:1561)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext$Step.invokeResultHandler(AbstractOperationContext.java:1533)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext$Step.handleResult(AbstractOperationContext.java:1515)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext$Step.finalizeInternal(AbstractOperationContext.java:1472)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext$Step.finalizeStep(AbstractOperationContext.java:1455)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext$Step.access$400(AbstractOperationContext.java:1319)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext.executeResultHandlerPhase(AbstractOperationContext.java:876)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:756)
    at [email protected]//org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467)
    at [email protected]//org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1413)
    at [email protected]//org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521)
    at [email protected]//org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472)
    at [email protected]//org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434)
    at [email protected]//org.jboss.as.server.ServerService.boot(ServerService.java:435)
    at [email protected]//org.jboss.as.server.ServerService.boot(ServerService.java:394)
    at [email protected]//org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374)
    at java.base/java.lang.Thread.run(Thread.java:834)
    Suppressed: java.util.concurrent.RejectedExecutionException: Executor is being shut down
        at [email protected]//org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2028)
        ... 23 more

23:59:52,650 ERROR [org.jboss.as.controller.client] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler@757c56a0 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException

But I could see that the tables that got created as a result of executing this process inside the keycloak database.

mysql> 
mysql> use keycloak;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
+------------------------------+
| Tables_in_keycloak           |
+------------------------------+
| APPLICATION_DEFAULT_ROLES    |
| APP_NODE_REGISTRATIONS       |
| CLIENT                       |
| CLIENT_ATTRIBUTES            |
| CLIENT_IDENTITY_PROV_MAPPING |
| CLIENT_SESSION               |
| CLIENT_SESSION_NOTE          |
| CLIENT_SESSION_ROLE          |
| COMPOSITE_ROLE               |
| CREDENTIAL                   |
| DATABASECHANGELOG            |
| DATABASECHANGELOGLOCK        |
| EVENT_ENTITY                 |
| FEDERATED_IDENTITY           |
| FED_PROVIDERS                |
| IDENTITY_PROVIDER            |
| IDENTITY_PROVIDER_CONFIG     |
| KEYCLOAK_ROLE                |
| PROTOCOL_MAPPER              |
| PROTOCOL_MAPPER_CONFIG       |
| REALM                        |
| REALM_APPLICATION            |
| REALM_ATTRIBUTE              |
| REALM_DEFAULT_ROLES          |
| REALM_ENABLED_EVENT_TYPES    |
| REALM_EVENTS_LISTENERS       |
| REALM_REQUIRED_CREDENTIAL    |
| REALM_SMTP_CONFIG            |
| REALM_SUPPORTED_LOCALES      |
| REDIRECT_URIS                |
| SCOPE_MAPPING                |
| USERNAME_LOGIN_FAILURE       |
| USER_ATTRIBUTE               |
| USER_ENTITY                  |
| USER_FEDERATION_CONFIG       |
| USER_FEDERATION_PROVIDER     |
| USER_REQUIRED_ACTION         |
| USER_ROLE_MAPPING            |
| USER_SESSION                 |
| USER_SESSION_NOTE            |
| WEB_ORIGINS                  |
+------------------------------+
41 rows in set (0.00 sec)

I am not able to figure out the reason for failure. I am tring it in my ubuntu machine.

Not sure if this is the right place to post this question. Doing so as requested by stackoverflow members.