* Add support to specify max expiration time for client assertions in Identity Provider settings (#46304, #46626, #46627)
We now support the configuration of max client assertion expiration time for the following providers:
- OIDC Identity Provider
- SPIFFE Identity Provider
- Kubernetes Identity Provider
Added testFederatedClientAssertionMaxExpiration test.
Added UI test for saving and retrieving fedClientAssertionMaxExp for Kubernetes Identity Provider.
Fixes#46304 (SPIFFE)
Fixes#46626 (Kubernetes)
Fixes#46627 (OIDC)
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
* Move client auth tests to AbstractBaseClientAuthTest
This allows testing base, Kubernetes and Spiffe implementations.
Fixes#46630
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
---------
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
* Add v2 admin event support to Client Admin API
Introduce AdminEventV2Builder to fire admin events with apiVersion=v2
detail marker, allowing consumers to distinguish v2 API events from v1.
- Add AdminEventV2Builder class for creating v2 admin events
- Modify DefaultClientService to fire v2 events on client create/update
- Pass AdminAuth through API chain for proper event authentication context
- Add tests verifying v2 events contain correct operation type and format
Closes#46123
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* added github comments
Extended AdminEventBuilder, now accepts AdimPermissionEvaluator instead
of AdminAuth
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Refactor admin builder v2, mask sensitive info, improve tests
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Apply suggestions from code review
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Apply suggestion from @mabartos
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* fixed imports
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* fixed merge error
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Polish constructors, disable events by default
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
* Public visibility for detail key, add test case for PATCH
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
---------
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
Rename {client-uuid} to {targetClientUuid} in RoleContainerResource to
avoid duplicate parameter names when the resource is mounted under
ClientResource. {clientUuid} is not sufficient because code generators
normalise {client-uuid} from the parent path to clientUuid as well.
Closes#46015
Signed-off-by: Zorian Motso <zorianmotso@gmail.com>
* fix: adding admin role invalidation when a new realm is found
closes: #45966
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* Update model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
* adding a comment and a permission tweak for imported realms
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* checking getShouldUseLightweightToken
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Stefan GuilhenandGitHub
rmartincandPedro Igor
Thomas DarimontandGitHub
Martin KanisandGitHub
Vlasta RamikandGitHub
Thomas DieslerandMarek Posolda
Giuseppe GrazianoandGitHub
vramikandPedro Igor
Yike GaoandGitHub
Takashi NorimatsuandGitHub
forkimenjeckayangandGitHub
Peter SkopekandMarek Posolda
Marie DalyandGitHub
Zorian MotsoandGitHub
Steven HawkinsandGitHub
Thomas DieslerandMarek Posolda
ValeriaandGitHub