keycloak: Incorrect JSON returned in case of unavailable user federation

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest nightly release

Area

admin/ui

Describe the bug

When Keycloak is configured with a user fedeation such as LDAP and that user federation is not available, Keycloak show the following error message in the admin UI when searching for users.

No users found, could be due to wrongly configured federated provider Unexpected non-whitespace character after JSON at position 1775 (line 1 column 1776)

Keycloak returned the following response to the admin UI. Note that the json is invalid, but contains all users from local Keycloak database.

[
    {
        "id": "139020a3-4459-43b1-a92f-d90e5cf093a1",
        "createdTimestamp": 1632070461116,
        "username": "test",
        "enabled": true,
        "emailVerified": true,
        "email": "test@example.com",
        "access": {
            "manageGroupMembership": true,
            "view": true,
            "mapRoles": true,
            "impersonate": true,
            "manage": true
        },
        "bruteForceStatus": {
            "numFailures": 0,
            "disabled": false,
            "lastIPFailure": "n/a",
            "lastFailure": 0
        }
    },
    {
        "id": "139020a3-4459-43b1-a92f-d90e5cf093a2",
        "createdTimestamp": 1632070461116,
        "username": "test2",
        "enabled": true,
        "emailVerified": true,
        "email": "test2@example.net",
        "access": {
            "manageGroupMembership": true,
            "view": true,
            "mapRoles": true,
            "impersonate": true,
            "manage": true
        },
        "bruteForceStatus": {
            "numFailures": 0,
            "disabled": false,
            "lastIPFailure": "n/a",
            "lastFailure": 0
        }
    },
    {
        "id": "139020a3-4459-43b1-a92f-d90e5cf093a3",
        "createdTimestamp": 1632070461116,
        "username": "test3",
        "enabled": true,
        "emailVerified": true,
        "email": "test3@example.org",
        "access": {
            "manageGroupMembership": true,
            "view": true,
            "mapRoles": true,
            "impersonate": true,
            "manage": true
        },
        "bruteForceStatus": {
            "numFailures": 0,
            "disabled": false,
            "lastIPFailure": "n/a",
            "lastFailure": 0
        }
    },
    {
        "id": "139020a3-4459-43b1-a92f-d90e5cf093a4",
        "createdTimestamp": 1632070461116,
        "username": "test4",
        "enabled": true,
        "emailVerified": false,
        "email": "test4@example.com",
        "access": {
            "manageGroupMembership": true,
            "view": true,
            "mapRoles": true,
            "impersonate": true,
            "manage": true
        },
        "bruteForceStatus": {
            "numFailures": 0,
            "disabled": false,
            "lastIPFailure": "n/a",
            "lastFailure": 0
        }
    },
    {
        "id": "139020a3-4459-43b1-a92f-d90e5cf093a5",
        "createdTimestamp": 1632070461116,
        "username": "test5",
        "enabled": true,
        "emailVerified": true,
        "email": "test5@local.local",
        "access": {
            "manageGroupMembership": true,
            "view": true,
            "mapRoles": true,
            "impersonate": true,
            "manage": true
        },
        "bruteForceStatus": {
            "numFailures": 0,
            "disabled": false,
            "lastIPFailure": "n/a",
            "lastFailure": 0
        }
    }
]{
    "error": "unknown_error"
}

I understand that Keycloak cannot show any users from the unavailable federation, but it does not show the users returned for the query either.

Version

22.0.3

Expected behavior

Show the list of users that could be loaded from Keycloak itself (and available user federations with higher priority than the unavailable one). Show an additional hint that not all users could be loaded due to an issue with the federation provider.

Actual behavior

Shows this error message and returns invalid JSON.

How to Reproduce?

• Start a fresh Keycloak instance
• add a local user to a realm
• configure a user federation (ldap) within that the same realm and set the connection url to a non-existing server and all other attributes to valid values
• navigate to the user tab and search for all users

Anything else?

No response