KeyCloak/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-05-26 13:50:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
30,289 Commits 34 Branches 307 Tags
copilot/refactor-java-keystore-provider
Commit Graph
436 Commits
Author SHA1 Message Date
Thomas Darimont 2a7495b4f5 Allow specifying max allowed expiration of federated client assertion in the Identity Provider settings (#46629) 
* Add support to specify max expiration time for client assertions in Identity Provider settings (#46304, #46626, #46627)

We now support the configuration of max client assertion expiration time for the following providers:
- OIDC Identity Provider
- SPIFFE Identity Provider
- Kubernetes Identity Provider

Added testFederatedClientAssertionMaxExpiration test.
Added UI test for saving and retrieving fedClientAssertionMaxExp for Kubernetes Identity Provider.

Fixes #46304 (SPIFFE)
Fixes #46626 (Kubernetes)
Fixes #46627 (OIDC)

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>

* Move client auth tests to AbstractBaseClientAuthTest

This allows testing base, Kubernetes and Spiffe implementations.

Fixes #46630

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>

---------

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
 2026-02-27 07:05:10 +00:00
Thomas Diesler 8cfef9443d [OID4VCI] Add support for CredentialScopeRepresentation 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-26 09:06:15 +01:00
Ricardo Martin e7ac4ef3f7 Move test class for persistent CIMD to the new test-suite 
Closes #46438

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2026-02-24 11:40:26 +01:00
Thomas Diesler 54189f8094 [OID4VCI] Revisit and fix /credential_offer_uri endpoint (#46199) 
closes #45005


Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-23 10:10:58 +01:00
Marie Daly 3bdf058578 Added delay to flaky test AttackDetectionResourceTest (#46490) 
closes #45986


Signed-off-by: Marie Daly <marie.daly1@ibm.com>
 2026-02-23 08:14:30 +01:00
Thomas Diesler 613e55d733 [OID4VCI] Confine test realm setup to TestCase.configureTestRealm() 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-19 16:20:45 +01:00
Pedro RuivoandPedro Ruivo 4253a79eb2 Client or role parsing caching should be realm specific 
Closes #46403

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
 2026-02-17 16:57:38 +01:00
Pedro RuivoandPedro Ruivo 7e00961ee1 Cache evaluation of client roles with dots for role mapper 
Closes #43726

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
 2026-02-17 12:45:37 +01:00
Akbar Husain 3f62bb4d2b Make shebang in bash scripts consistent (#37369) 
Closes #34983

Signed-off-by: akbarhusainpatel <apatel@intermiles.com>
 2026-02-17 11:32:28 +01:00
Geremia Taglialatelaandtagliala 418700b4f8 Fix duplicate header in VERIFY_EMAIL flow 
Fix #46105

Signed-off-by: Geremia Taglialatela <tagliala.dev@gmail.com>
Co-authored-by: tagliala <556268+tagliala@users.noreply.github.com>
 2026-02-16 16:26:22 +01:00
Steven Hawkins c28cac9db3 fix: ensuring proper error handling for duplicate protocol mappers 
closes: #26946

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
 2026-02-13 16:33:01 +00:00
Martin Bartoš 74988b5c0a Extend client policies tests to check exact events (#46093) 
Closes #46114

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
 2026-02-13 15:47:38 +01:00
Thomas Diesler 80839bfc44 -- make ctors package protected 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-13 15:29:04 +01:00
Thomas Diesler 4341b8a314 [OID4VCI] Revisit and fix OAuthClient.preAuthorizedCodeGrantRequest() 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-13 15:29:04 +01:00
Giuseppe Graziano a8418b251d Unique issuer for identity providers 
Closes #45747

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2026-02-13 08:44:07 +01:00
Thomas Diesler 44e7cf2da9 [OID4VCI] Simplify OID4VCAuthorizationDetail handling 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-12 17:09:07 +01:00
Thomas Diesler 5659fa9ac7 [OID4VCI] Revisit and fix OAuthClient.credentialRequest() 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-11 12:05:06 +01:00
Lukas Hanusovsky 8839c831b9 [Test Framework] testcontainers dependency refactor. (#46131) 
Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
 2026-02-11 10:07:12 +00:00
Thomas Diesler de0ae92ebe [OID4VCI] Wrong typ value for SD-JWT VC 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-11 08:28:07 +01:00
Giuseppe Graziano d6f07f27ec User validation in JWT Authorization Grant (#46149) 
Closes #46144

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2026-02-10 13:09:05 +00:00
Thomas Diesler 64dee82f9f [OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest() 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-10 13:15:45 +01:00
Valeria 05ff44b8a0 Patch CVE-2026-0707. Add validation on Authorization Header with Bearer, add tests (#45787) 
Closes #45649

Signed-off-by: Valeria Epifanova <lerkamandarinka24@gmail.com>
 2026-02-10 13:10:29 +01:00
Giuseppe Graziano 176dc8902c Check if idp is enabled for JWT Auth Grant and Federated Client Auth (#46148) 
Closes #46146

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2026-02-10 13:01:42 +01:00
Thomas Diesler b4c1a2a890 [OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest() 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
 2026-02-10 11:50:55 +01:00
Alexander Schwartz fc7b1b1e83 Check if two IDPs with the same issuer URL exist before caching them 
Closes #45453

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-02-09 11:30:09 +01:00
Stefan Guilhen 9a32b5e2c4 Add ProviderEvents to workflows 
- custom listeners can now react to workflow operations

Closes #45170

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-02-06 16:48:03 -03:00
Pedro RuivoandPedro Ruivo 02c6499d96 Deprecate unused methods in UserSessionProvider 
Closes #45823

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
 2026-02-06 19:04:19 +01:00
Lukas Hanusovsky a21a53667e Creating user with roles/clientRoles via UserSupplier is not supported. (#46070) 
Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
 2026-02-06 08:55:19 +00:00
Aggelos Sachtouris 6c003a41aa Format: apply code formatting using spotless 
Signed-off-by: Aggelos Sachtouris <aggelos_sachtouris@hotmail.com>
 2026-02-05 12:22:37 -03:00
Aggelos Sachtouris fb58f1c40f fix: Test Old ResourceOperationType to UserCreatedWorkflowEventFactory 
Signed-off-by: Aggelos Sachtouris <aggelos_sachtouris@hotmail.com>
 2026-02-05 12:22:37 -03:00
Aggelos Sachtouris e6e4017d3d doc: Changed comment on Unlink User Test 
Signed-off-by: Aggelos Sachtouris <aggelos_sachtouris@hotmail.com>
 2026-02-05 12:22:37 -03:00
Aggelos Sachtouris dc6c1683bd Create test for unlink user workflow step 
Signed-off-by: Aggelos Sachtouris <aggelos_sachtouris@hotmail.com>
 2026-02-05 12:22:37 -03:00
Stian Thorgersen ea4c8f65b6 Review realm cleanup in test framework 
Closes #45973

Signed-off-by: stianst <stianst@gmail.com>
 2026-02-04 18:03:15 +01:00
Awambeng c40590762e [OID4VCI] Add comprehensive tests for OID4VC authorization code flow (#45391) 
closes #44795


Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
 2026-02-04 11:50:49 +01:00
Pedro RuivoandPedro Ruivo 297d8ac95d Refactor ClientResource for better performance 
Closes #45838

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
 2026-02-04 11:29:18 +01:00
Stefan Guilhen 2111dcf913 Check only for the existence of the attribute if only the key is specified 
Closes #45983

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-02-03 14:52:34 -03:00
Stefan Guilhen 021d544000 Ensure required action is enabled at the realm level before adding it to the user via workflow step 
Closes #45976

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-02-03 14:51:28 -03:00
Martin BartošandAlexander Schwartz 3e568fc81b OTEL: Use suggested 'code.function.name' for span attributes 
Closes #45944

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
 2026-02-03 15:56:48 +01:00
rmartinc c63f54ba3a Client policy executor to allow extra audiences for JWT authorization grant 
Closes #45180

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2026-02-03 13:39:31 +01:00
Stefan Guilhen 6e408dd7bc Introduce WorkflowEventSpi 
- supports custom event handling beyond the built-in workflow capabilities.

Closes #43916

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-02-02 11:18:27 -03:00
rmartinc d4e9b16ea9 Include version in system-info for manage-realm and restrict view-system mapping 
Closes #45776

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2026-02-02 12:40:57 +01:00
Pedro Igor 13cf35ded3 Only realm admins can manage workflows 
Closes #45875

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-01-30 21:18:06 +01:00
Pedro RuivoandPedro Ruivo 02066f4985 Bugfix Refactor SessionsResource 
Closes #45727

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
 2026-01-29 14:51:50 +01:00
Pedro RuivoPedro RuivoAlexander Schwartz
 		bae3963d25 Refactor SessionsResource for better memory usage and performance 
Closes #45727

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-01-29 11:38:54 +01:00
Tero Saarni cb4c533464 Add support for looking up client secrets via Vault SPI (#39650) 
Fixes #13102


Signed-off-by: Tero Saarni <tero.saarni@est.tech>
 2026-01-28 16:45:30 +01:00
Pedro Igor b9243a7270 Only enable JS policies if the scripts feature is enabled 
Closes #44132

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-01-28 12:28:32 +01:00
Alexander Schwartz 0ddb355d3d Optimize deletion of composite roles 
Closes #45065

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-01-28 08:05:16 -03:00
forkimenjeckayang f2f185b367 [OID4VCI] Add OID4VCI request/response support to OAuthClient utility (#45784) 
closes: #44671


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
 2026-01-28 11:54:42 +01:00
Stefan Guilhen c13a1772f8 Adds ability to migrate scheduled workflow resources from one step to another step in the same or different workflow 
Closes #45174

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-01-27 13:46:18 -03:00
Steven Hawkins 38b5466093 fix: aligns our dev http-host default behavior with that of quarkus (#45691) 
closes: #42876

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
 2026-01-27 16:51:47 +01:00