Liferay 7.4迁移后集成Keycloak出现启动及登录异常

报错信息 #

启动时数据库更新错误 #

2024-05-29 06:45:01.537 ERROR [CM Configuration Updater (ManagedServiceFactory Update: factoryPid=[com.liferay.portal.security.sso.openid.connect.internal.configuration.OpenIdConnectProviderConfiguration])][BatchingBatch:139] HHH000315: Exception executing batch [org.hibernate.StaleStateException: Batch update returned unexpected row count from update [0]; actual row count: 0; expected: 1; statement executed: update OAuthClientASLocalMetadata set mvccVersion=?, modifiedDate=? where oAuthClientASLocalMetadataId=? and mvccVersion=?], SQL: update OAuthClientASLocalMetadata set mvccVersion=?, modifiedDate=? where oAuthClientASLocalMetadataId=? and mvccVersion=?

请求时空指针异常 #

2024-05-29 13:14:40.374 ERROR [http-nio-9015-exec-9][VirtualHostFilter:53] java.lang.NullPointerException
java.lang.NullPointerException: null
        at com.liferay.portal.security.sso.openid.connect.internal.servlet.filter.auto.login.OpenIdConnectAutoLoginFilter.isFilterEnabled(OpenIdConnectAutoLoginFilter.java:52) ~[?:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:78) ~[portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:138) ~[portal-kernel.jar:?]
        at com.liferay.portal.servlet.filters.virtualhost.VirtualHostFilter.processFilter(VirtualHostFilter.java:236) ~[portal-impl.jar:?]
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:40) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:138) [portal-kernel.jar:?]
        at com.liferay.portal.monitoring.internal.servlet.filter.MonitoringFilter.processFilter(MonitoringFilter.java:116) [bundleFile:?]
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:40) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:189) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:92) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:189) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:92) [portal-kernel.jar:?]
        at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:176) [urlrewritefilter-4.0.4.jar:4.0.4]
        at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145) [urlrewritefilter-4.0.4.jar:4.0.4]
        at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92) [urlrewritefilter-4.0.4.jar:4.0.4]
        at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:389) [urlrewritefilter-4.0.4.jar:4.0.4]
        at com.liferay.portal.url.rewrite.filter.internal.URLRewriteFilter.processFilter(URLRewriteFilter.java:86) [bundleFile:?]
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:40) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:168) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:92) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:168) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:92) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:189) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:92) [portal-kernel.jar:?]
        at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:95) [portal-kernel.jar:?]
        at com.liferay.shielded.container.internal.proxy.FilterWrapper.doFilter(FilterWrapper.java:69) [com.liferay.shielded.container.impl.jar:?]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) [catalina.jar:9.0.83]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.83]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168) [catalina.jar:9.0.83]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) [catalina.jar:9.0.83]
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481) [catalina.jar:9.0.83]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130) [catalina.jar:9.0.83]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) [catalina.jar:9.0.83]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [catalina.jar:9.0.83]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [catalina.jar:9.0.83]
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390) [tomcat-coyote.jar:9.0.83]
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) [tomcat-coyote.jar:9.0.83]
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:928) [tomcat-coyote.jar:9.0.83]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1794) [tomcat-coyote.jar:9.0.83]
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) [tomcat-coyote.jar:9.0.83]
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) [tomcat-util.jar:9.0.83]
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) [tomcat-util.jar:9.0.83]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-util.jar:9.0.83]
        at java.lang.Thread.run(Thread.java:829) [?:?]

问题分析 #

1. 数据库更新错误：StaleStateException表明更新OAuthClientASLocalMetadata表时，找不到符合条件的记录（实际影响行数为0，预期1行）。大概率是迁移过程中，OpenID Connect的元数据记录未正确同步到7.4的数据库中，或者mvcc版本号不一致导致乐观锁校验失败。
2. 空指针异常：OpenIdConnectAutoLoginFilter.isFilterEnabled方法抛出空指针，说明过滤器初始化时依赖的配置对象未正确加载，和前面的数据库更新失败直接相关——元数据加载失败导致配置对象为空，进而触发空指针。

解决方案 #

步骤1：修复数据库元数据记录 #

• 检查OAuthClientASLocalMetadata表，确认是否存在对应Keycloak的记录。如果没有，手动插入正确的元数据（可参考7.2中的对应记录，或重新配置Keycloak集成后让系统自动生成）。
• 如果记录存在但mvcc版本号异常，尝试更新该记录的mvccVersion为当前最新值，或删除旧记录后重新配置Keycloak集成。

步骤2：重新配置OpenID Connect集成 #

• 登录Liferay控制台，进入控制面板 > 配置 > 系统设置 > 安全 > 单点登录 > OpenID Connect Provider，删除现有的Keycloak配置。
• 重启Liferay服务器，确认之前的数据库更新错误不再出现。
• 重新添加Keycloak的OpenID Connect配置，填写正确的客户端ID、客户端密钥、授权端点、令牌端点等信息，保存后再次重启服务器验证。

步骤3：清理缓存 #

• 清理Liferay的临时文件和缓存（[liferay-home]/work、[liferay-home]/osgi/state目录），避免旧配置残留。
• 清理数据库缓存（如使用MySQL，可执行FLUSH TABLES）。

步骤4：验证过滤器配置 #

• 检查OpenIdConnectAutoLoginFilter的启用状态，确保在控制面板 > 配置 > 系统设置 > 安全 > 单点登录中已正确启用OpenID Connect自动登录功能。
• 确认虚拟主机配置正确，避免因虚拟主机映射问题导致过滤器加载异常。

内容的提问来源于stack exchange，提问作者Akash