113 Commits

Author SHA1 Message Date
Michal Vavřík a05b1c9e46 feat(admin-api-v2): rename 'update' command to 'apply' (#48134)
* Closes: https://github.com/keycloak/keycloak/issues/47472
* Problem with 'update' command is that it is misleading, therefore the command we generate for 'PUT' HTTP method, which either creates or updates a resource, is now called 'apply'.
* The '--uuid' option is removed from commands

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-04-22 09:47:40 +02:00
Steven Hawkins e9f593020a fix: creating a cleaner module for use by java clients (#47874)
* fix: minimizing the dependencies for the rest module

closes: #48114

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* renaming the modules

also remove jsonnode logic from the oas filter and the databind
dependency

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* addressing review comments

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2026-04-16 15:18:41 +02:00
Michal Vavřík f303cc806c feat(admin-api-v2): make CLI discriminator subcommand optional (#48018)
* Closes: https://github.com/keycloak/keycloak/issues/47463

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-04-15 15:10:27 -04:00
Michal Vavřík d4cd08824d feat(admin cli client v2): show help based on Keycloak server version (#47525)
* Closes: https://github.com/keycloak/keycloak/issues/47171
* Adds information about autocomplete to the v2 help

**More about OpenAPI document fetching:**

When Admin CLI is used with a different Keycloak server version, we need to update help and autocomplete according to OpenAPI document, which describes what endpoints and schemas can be used. This can only be done when the Keycloak server has enabled (currently experimental) OpenAPI feature and users specify OpenAPI path. The management path and port can be changed by user, therefore we ask them to specify OpenAPI URL entirely.

This feature is only provided for the current session (when user is logged in into some server). We cannot easily provide help and autocomplete based on inline arguments like `--server` because it is bit chicken-egg problem (injected options are available after you provided command to PicoCLI, so we would need to do a lot manually).

Here is how it works:

```bash
mvavrik@fedora:~/sources/keycloak$ kcadm.sh --v2 config credentials --server http://localhost:8080 --realm master --user admin --password admin
Logging into http://localhost:8080 as user admin of realm master
OpenAPI descriptor cached for http://localhost:8080 (version 999.0.0-SNAPSHOT)

```

or for non-default management port:

```bash
mvavrik@fedora:~/sources/keycloak$ kcadm.sh --v2 config credentials --server http://localhost:8080 --realm master --user admin --password admin
Logging into http://localhost:8080 as user admin of realm master
mvavrik@fedora:~/sources/keycloak$ kcadm.sh --v2 config openapi http://localhost:9004/openapi
OpenAPI descriptor cached for http://localhost:8080 (version 999.0.0-SNAPSHOT)
```

or alternatively:

```bash
mvavrik@fedora:~/sources/keycloak$ kcadm.sh --v2 config credentials --server http://localhost:8080 --realm master --user admin --password admin --openapi-url http://localhost:9004/openapi
Logging into http://localhost:8080 as user admin of realm master
OpenAPI descriptor cached for http://localhost:8080 (version 999.0.0-SNAPSHOT)
```

After that, command structure reflects the OpenAPI document, including help and autocomplete. If you switch server using `config credentials`, command changes as well. If the server you are communicating does not provide OpenAPI endpoint, we silently fallback to the default OpenAPI document (bundled with the command). However,
the `kcadm.sh --v2 config openapi` fails if the OpenAPI endpoint wasn't available.

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-04-10 17:52:54 +02:00
Martin Bartoš 0b2ce29e89 [client-v2] Require 'clientId' in the payload (#47533)
* Require clientId in the payload

Closes #47524

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Require 'protocol' field to be specified

Closes #47579

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Client API v2 CLI Client: Jakarta validation errors are not handled

Closes #47574

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Use getRequest() for POST in test

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2026-04-07 14:07:32 +02:00
Ricardo Martin 2daea53e70 Support Java 25 with FIPS enabled (#47581)
Closes #47666

Signed-off-by: rmartinc <rmartinc@redhat.com>
2026-04-01 09:57:25 +02:00
Michal Vavřík 8543f62100 chore(admin-cli): use junit in test scope (#47553)
Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-03-28 08:40:42 -04:00
Michal Vavřík 859a7a095e feat(admin-cli): provide basic Client API v2 CLI client (#47173)
* Closes: https://github.com/keycloak/keycloak/issues/47166
* Closes: https://github.com/keycloak/keycloak/issues/47311

Provides basic Client API v2 CLI client.

Supports:

- client operations: create, patch, list, delete, get, update
- authetication options matching those of v1 CLI

Omitted changes:

- documentation, we do not advertise this new client and it is hidden behind `--v2` flag that is not mentioned anywhere in doc or help, hence invisible; until we implement remaining https://github.com/keycloak/keycloak/issues/45366 tasks
- "config" subcommand is shared between v1 and v2, hence its printed "help" follows the v1 style to keep status quo

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-03-27 12:56:08 +01:00
mposolda 416a6017c2 Make authorizationDetails processing more generic and not tightly coupled to OID4VCI. Fixes
closes #44961

Signed-off-by: mposolda <mposolda@gmail.com>
2026-01-26 08:45:41 +01:00
Stian Thorgersen a2c1055f8d Proposed import order (#43432)
* Add importOrder to Spotless

Closes #43235

Signed-off-by: stianst <stianst@gmail.com>

* Re-order imports with Spotless

Signed-off-by: stianst <stianst@gmail.com>

---------

Signed-off-by: stianst <stianst@gmail.com>
2025-11-14 09:34:49 +01:00
Steven Hawkins 6d93df8cad fix: using RFC6749 for kcadm / kcreg
closes: #43532

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-10-16 16:52:51 +00:00
stianst aedd7fe5db Remove unused imports as part of #43233
Signed-off-by: stianst <stianst@gmail.com>
2025-10-13 13:32:01 +02:00
Steven Hawkins 817c78f0d9 fix: adds error handling for common redirect codes (#43276)
closes: #31401

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-10-08 08:55:07 +02:00
Steven Hawkins 2ce3474ed5 fix: addressing possible npes (#41944)
close: #40659

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-08-18 23:51:17 +02:00
Steven Hawkins fdca122469 fix: ensuring streams are closed
closes: #40660

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-08-15 07:40:54 +02:00
Akbar Husain 06f80416fb Replace keySet with entrySet
Closes #40064

Signed-off-by: akbarhusainpatel <apatel@intermiles.com>
Co-authored-by: akbarhusainpatel <apatel@intermiles.com>
2025-08-14 17:31:15 +02:00
Peter Skopek 651d651c30 Add missing artifact descriptions to allow Maven Central Portal Publisher pass validation process. (#40822)
Signed-off-by: Peter Skopek <pskopek@redhat.com>
2025-08-12 16:50:17 +02:00
Douglas Palmer a981f6b6d5 Access Token IDs have less than 128 bits of entropy
Closes #38663

Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
2025-06-26 16:48:03 +02:00
Steven Hawkins f69261daad fix: turning off default picocli behavior we don't want (#38070)
closes: #38065

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-03-14 10:20:26 +01:00
mposolda 8f038f19dd Upgrade BCFIPS to 2.0
closes #30415

Signed-off-by: mposolda <mposolda@gmail.com>
2024-09-26 06:52:21 +02:00
keshavprashantdeshpande 4e23b450be Add status option to kcadm for validity (#32883)
Closes #23179

Signed-off-by: Keshav Deshpande <keshavprashantdeshpande@gmail.com>
2024-09-24 13:18:54 +02:00
Steven Hawkins 96511e55c6 startup, welcome, and cli handling of bootstrap-admin user (#30054)
* fix: adding password and service account based bootstrap and recovery

closes: #29324, #30002, #30003

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Fix tests

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Co-authored-by: Václav Muzikář <vmuzikar@redhat.com>
2024-07-03 15:23:40 +02:00
Steven Hawkins d534860e2b fix: admin cli client should set the content when performing a merge (#30539)
closes: #29878

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-06-28 15:56:07 +02:00
Steven Hawkins aae1fa1417 fix: addresses cli erroneously wants a secret when env password is set (#30892)
closes: #30866

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-06-28 11:48:42 +02:00
Steven Hawkins c7e9ee2bff fix: adds handling for all kcadm prompts as env variables (#29430)
closes: #21961

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-06-06 13:08:23 +00:00
Dimitri Papadopoulos Orfanos 64a145e960 Fix user-facing typos in error messages (#29326)
Update resource file and tests accordingly

Signed-off-by: Dimitri Papadopoulos <3234522+DimitriPapadopoulos@users.noreply.github.com>
2024-05-16 09:55:41 +02:00
Steven Hawkins 3b1ca46be2 fix: updating docs around -q parameter (#29151)
closes: #27877

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-05-02 16:48:43 +02:00
Steven Hawkins f42185b319 task: combine the kcreg and kcadmin modules (#28918)
closes #28904

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-04-25 18:08:45 +00:00
Steven Hawkins 9486432f3f fix: removing httpclient override (#28304)
we need to have a dependency on commons-logging-jboss-logging

closes: #21392

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-04-23 10:09:06 +02:00
Mark Banierink ad32896725 replaced and removed deprecated token methods (#27715)
closes #19671 

Signed-off-by: Mark Banierink <mark.banierink@nedap.com>


Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-04-23 09:23:37 +02:00
Steve Hawkins 0be34d64e7 task: refactor overlap between cli clients
also repackaging to more clearly delineate code roles

closes: #28329

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-04-18 17:39:16 -03:00
Steven Hawkins e9ad9d0564 fix: replace aesh with picocli (#27458)
* fix: replace aesh with picocli

closes: #27388

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/AbstractRequestCmd.java

Co-authored-by: Martin Bartoš <mabartos@redhat.com>

* splitting the error handling for password input

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* adding a change note about kcadm

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/documentation/upgrading/topics/changes/changes-25_0_0.adoc

Co-authored-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
2024-03-28 14:34:06 +01:00
Steven Hawkins 619775b8db fix: simplifies the parsing routine, which accounts for leading 0's (#28102)
closes: #27839

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-03-22 09:19:52 +01:00
Steven Hawkins 51590668f5 fix: provide a better error message when option parsing fails (#27354)
closes: #16260

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-02-29 08:22:21 -05:00
Steven Hawkins ec28b68554 fix: improve group matching (#25627)
closes #25451

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2023-12-18 11:46:02 +01:00
Peter Zaoral 340eb99412 Unable to use < as part of a password (admin-cli) (#24939)
* escaped angle bracket characters in password

Closes #21951

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-12-06 17:27:44 +01:00
rokkiter c38fadcdec fix cli output token can not return token 2023-11-10 05:47:39 -08:00
Peter Zaoral f2dc57bfe1 kcadm.bat, kcreg.bat do not respect environment variables JAVA, JAVA_… (#23630)
* kcadm.bat, kcreg.bat do not respect environment variables JAVA, JAVA_HOME to select JVM

* edited kcadm.bat and kcreg.bat scripts

Closes #23214

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>

* kcadm.bat, kcreg.bat do not respect environment variables JAVA, JAVA_HOME to select JVM

* incorporated suggestions

Closes #23214

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>

* kcadm.bat, kcreg.bat do not respect environment variables JAVA, JAVA_HOME to select JVM

* incorporated suggestions

Closes #23214

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>

---------

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-10-20 15:51:54 +02:00
Steven Hawkins 9a93b9a273 allows csv output to handle missing requested fields (#23459)
* allows csv output to handle missing requested fields

Closes #12330

* fixes the handling of the content type

also makes it more explicit the expectation of applying csv and return
fields

* fix: consolidating the logic dealing with the content-type

Closes #23580
2023-10-04 15:49:19 +02:00
Bruno Oliveira da Silva 609d036094 Outdated kcadm.sh help examples can be misleading to our users (#23403)
Closes #23402
2023-09-21 13:30:48 +02:00
Jakub Jirutka d50fa65247 Refactor kc.sh, kcadm.sh and kcreg.sh scripts, make kc.sh POSIX shell compatible (#21124)
Closes #22041
2023-07-27 17:54:18 +02:00
Peter Zaoral db49430efb Downgrade Jansi library to prevent kcadm exception on Windows (#21926)
Closes #21851

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-07-26 12:29:53 +02:00
Václav Muzikář 776bcbcbd4 Update bcpkix and bcprov dependencies (#21543)
Closes #21360
2023-07-20 11:57:18 +02:00
A. Tammy 497d08af1c make cli usable on OpenBSD (#16462)
Signed-off-by: Aisha Tammy <aisha@bsd.ac>
Co-authored-by: Aisha Tammy <aisha@bsd.ac>
2023-07-07 08:58:41 +02:00
Mitsuru Kariya f62c5ea1d6 Fix usage typo of config truststore command of admin-cli (#16488)
The option to save the truststore password in config truststore command
of admin-cli is -trustpass, not -storepass.
2023-07-07 00:01:56 +02:00
Martin Bartoš 6118e5cfb7 Use JakartaEE dependencies
---
Quarkus3 branch sync no. 14 (24.4.2023)
Resolved conflicts:
keycloak/pom.xml - Modified
---
Quarkus3 branch sync no. 5 (10.2.2023)
Resolved conflicts:
keycloak/pom.xml - Modified
2023-04-27 13:36:54 +02:00
Jon Koops 972ebb9650 Use a valid SemVer format for the SNAPSHOT version (#17334)
* Use a valid SemVer format for the SNAPSHOT version

* Update pom.xml

* Update pom.xml

---------

Co-authored-by: Stian Thorgersen <stianst@gmail.com>
Co-authored-by: Stian Thorgersen <stian@redhat.com>
2023-03-03 11:11:44 +01:00
rmartinc fbc9177f27 Doublecheck if we need to override properties in java.security
Closes https://github.com/keycloak/keycloak/issues/16702
2023-02-15 12:33:48 +01:00
Alexander Schwartz d4604984d0 Compatibility with Maven4 and parallel builds (#16312)
Closes #16308
2023-02-14 11:44:53 +01:00
mposolda 36bd76957d Make Keycloak FIPS working with OpenJDK 17 on FIPS enabled RHEL
Closes #15721
2022-12-20 21:03:55 +01:00