From 4e13c0bbd3f1e70cb5b8be2367deeeb77af06c26 Mon Sep 17 00:00:00 2001
From: Giuseppe Graziano <g.graziano94@gmail.com>
Date: Mon, 13 Jan 2025 17:29:37 +0100
Subject: [PATCH] Avoid a NullPointerException when client roles are associated
 with a client that no longer exists (#35489)

Closes #34444

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
(cherry picked from commit 8f417d63183369f84cc6cdab1b0843d470c07c43)

Co-authored-by: Marek Posolda <mposolda@gmail.com>
---
 services/src/main/java/org/keycloak/utils/RoleResolveUtil.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java b/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java
index ddd1cc10bcb..ffc229eda3f 100644
--- a/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java
+++ b/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java
@@ -122,6 +122,9 @@ public class RoleResolveUtil {
 
         } else {
             ClientModel app = (ClientModel) role.getContainer();
+            if (app == null) {
+                return;
+            }
             access = token.getResourceAccess(app.getClientId());
             if (access == null) {
                 access = token.addAccess(app.getClientId());