Ensure realm attributes import happens before client import

Adjusted import file for KC24.

Fixes #32799

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
(cherry picked from commit 445a7da9020e4c48561d99040edca36cda61d4cf)

model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java

@@ -352,6 +352,14 @@ public class DefaultExportImportManager implements ExportImportManager {
             }
         }
 
+        // import attributes
+
+        if (rep.getAttributes() != null) {
+            for (Map.Entry<String, String> attr : rep.getAttributes().entrySet()) {
+                newRealm.setAttribute(attr.getKey(), attr.getValue());
+            }
+        }
+
         Map<String, ClientModel> createdClients = new HashMap<>();
         if (rep.getClients() != null) {
             createdClients = createClients(session, rep, newRealm, mappedFlows);
@@ -444,14 +452,6 @@ public class DefaultExportImportManager implements ExportImportManager {
             newRealm.setDefaultLocale(rep.getDefaultLocale());
         }
 
-        // import attributes
-
-        if (rep.getAttributes() != null) {
-            for (Map.Entry<String, String> attr : rep.getAttributes().entrySet()) {
-                newRealm.setAttribute(attr.getKey(), attr.getValue());
-            }
-        }
-
         if (newRealm.getComponentsStream(newRealm.getId(), KeyProvider.class.getName()).count() == 0) {
             if (rep.getPrivateKey() != null) {
                 DefaultKeyProviders.createProviders(newRealm, rep.getPrivateKey(), rep.getCertificate());

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/ImportTest.java

@@ -31,6 +31,7 @@ import org.keycloak.models.ClientModel;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oidc.utils.AcrUtils;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
@@ -46,6 +47,7 @@ import org.keycloak.util.JsonSerialization;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.Collection;
+import java.util.Map;
 import java.util.Objects;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
@@ -64,7 +66,7 @@ public class ImportTest extends AbstractTestRealmKeycloakTest {
         // was having trouble deleting this realm from admin console
         removeRealm("demo-delete");
     }
-    
+
 	@Test
     public void install2() {
         testingClient.server().run(session -> {
@@ -138,6 +140,21 @@ public class ImportTest extends AbstractTestRealmKeycloakTest {
         });
     }
 
+    // https://github.com/keycloak/keycloak/issues/32799
+    @Test
+    public void importAcrToLoaMappingWithDefaultAcrValues() {
+        RealmRepresentation testRealm = loadJson(getClass().getResourceAsStream("/model/acr-values-import-bug.json"), RealmRepresentation.class);
+        adminClient.realms().create(testRealm);
+        testingClient.server().run(session -> {
+            RealmModel realm = session.realms().getRealmByName("acr-import-bug");
+            Map<String, Integer> acrLoaMap = AcrUtils.getAcrLoaMap(realm);
+            Assert.assertNotNull(acrLoaMap);
+
+            ClientModel clientSilverAcr = realm.getClientByClientId("client-silver");
+            Assert.assertEquals("silver", clientSilverAcr.getAttribute("default.acr.values"));
+        });
+    }
+
     @Test
     public void importUserProfile() throws Exception {
         final String realmString = IOUtils.toString(getClass().getResourceAsStream("/model/import-userprofile.json"), StandardCharsets.UTF_8);