libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Merge remote-tracking branch 'upstream/master'

Browse source
This commit is contained in:
Bill Burke 2014-05-21 10:56:21 -04:00
commit 0d9e14d4c7
61 changed files with 4521 additions and 6804 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
audit/mongo/pom.xml
View file

@ -37,6 +37,11 @@
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.jboss.logging</groupId>
<artifactId>jboss-logging</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.mongodb</groupId>
<artifactId>mongo-java-driver</artifactId>
@ -85,9 +90,6 @@
<keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
<keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
</systemPropertyVariables>
<dependenciesToScan>
<dependency>org.keycloak:keycloak-model-tests</dependency>
</dependenciesToScan>
</configuration>
</execution>
<execution>

5
audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java
View file

@ -5,6 +5,7 @@ import com.mongodb.MongoClient;
import com.mongodb.MongoCredential;
import com.mongodb.ServerAddress;
import com.mongodb.WriteConcern;
import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.audit.AuditProvider;
import org.keycloak.audit.AuditProviderFactory;
@ -21,6 +22,8 @@ import java.util.Set;
*/
public class MongoAuditProviderFactory implements AuditProviderFactory {
protected static final Logger logger = Logger.getLogger(MongoAuditProviderFactory.class);
public static final String ID = "mongo";
private MongoClient client;
private DB db;
@ -55,6 +58,8 @@ public class MongoAuditProviderFactory implements AuditProviderFactory {
if (clearOnStartup) {
db.getCollection("audit").drop();
}
logger.infof("Initialized mongo audit. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
} catch (UnknownHostException e) {
throw new RuntimeException(e);
}

7
distribution/appliance-dist/assembly.xml
View file

@ -38,6 +38,13 @@
<exclude>keycloak-ds.xml</exclude>
</excludes>
</fileSet>
<fileSet>
<directory>${project.build.directory}/unpacked/deployments/auth-server.war/WEB-INF/classes/META-INF</directory>
<outputDirectory>keycloak/standalone/configuration</outputDirectory>
<includes>
<include>keycloak-server.json</include>
</includes>
</fileSet>
<fileSet>
<directory>${project.build.directory}/unpacked/themes</directory>
<outputDirectory>keycloak/standalone/configuration/themes</outputDirectory>

7
distribution/war-zip/assembly.xml
View file

@ -19,5 +19,12 @@
</includes>
<outputDirectory>deployments</outputDirectory>
</fileSet>
<fileSet>
<directory>${project.build.directory}/unpacked/deployments/auth-server.war/WEB-INF/classes/META-INF</directory>
<outputDirectory>configuration</outputDirectory>
<includes>
<include>keycloak-server.json</include>
</includes>
</fileSet>
</fileSets>
</assembly>

2
docbook/reference/en/en-US/modules/social-twitter.xml
View file

@ -33,8 +33,6 @@
<para>
Twitter doesn't allow <literal>localhost</literal> in the redirect URI. To test on a local server
replace <literal>localhost</literal> with <literal>127.0.0.1</literal>.
Twitter also restricts connection to TLS/SSL connections only, so you are required to use HTTPS to access
Keycloak to enable log in with Twitter.
</para>
</tip>
</section>

2
forms/common-themes/src/main/resources/theme/account/base/log.ftl
View file

@ -24,7 +24,7 @@
<td>${event.date?datetime}</td>
<td>${event.event}</td>
<td>${event.ipAddress}</td>
<td>${event.client}</td>
<td>${event.client!}</td>
<td><#list event.details as detail>${detail.key} = ${detail.value} <#if detail_has_next>, </#if></#list></td>
</tr>
</#list>

10
forms/common-themes/src/main/resources/theme/account/base/sessions.ftl
View file

@ -7,7 +7,7 @@
</div>
</div>
<table class="table">
<table class="table table-striped table-bordered">
<thead>
<tr>
<td>IP</td>
@ -27,18 +27,14 @@
<td>${session.lastAccess?datetime}</td>
<td>${session.expires?datetime}</td>
<td>
<ul style="list-style: none; ">
<#list session.applications as app>
<li>${app}</li>
${app}<br/>
</#list>
</ul>
</td>
<td>
<ul style="list-style: none; ">
<#list session.clients as client>
<li>${client}</li>
${client}<br/>
</#list>
</ul>
</td>
</tr>
</#list>

2
forms/common-themes/src/main/resources/theme/account/patternfly/resources/css/account.css
View file

@ -91,7 +91,7 @@ header .navbar {
background-color: #c7e5f0;
border-color: #56bae0;
font-weight: bold;
background-image: url(../img/icon-sidebar-active.svg);
background-image: url(../img/icon-sidebar-active.png);
background-repeat: no-repeat;
background-position: right center;
}

BIN
forms/common-themes/src/main/resources/theme/account/patternfly/resources/img/icon-sidebar-active.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 202 B

3
forms/common-themes/src/main/resources/theme/admin/base/resources/index.html
View file

@ -15,7 +15,7 @@
<script src="lib/angular/angular.js"></script>
<script src="lib/angular/angular-resource.js"></script>
<script src="lib/angular/angular-route.js"></script>
<script src="lib/angular/ui-bootstrap-tpls-0.4.0.js"></script>
<script src="lib/angular/ui-bootstrap-tpls-0.11.0.js"></script>
<script src="lib/jquery/jquery.idletimer.js" type="text/javascript"></script>
<script src="lib/jquery/jquery.idletimeout.js" type="text/javascript"></script>
@ -39,6 +39,7 @@
</head>
<body class="admin-console" data-ng-controller="GlobalCtrl" data-ng-cloak>
<div id="idletimeout">
You will be logged off in <strong><span></span> seconds</strong> due to inactivity.
<a id="idletimeout-resume" href="#">Click here to continue using this web page</a>.

102
forms/common-themes/src/main/resources/theme/admin/base/resources/js/services.js
View file

@ -2,9 +2,40 @@
var module = angular.module('keycloak.services', [ 'ngResource', 'ngRoute' ]);
module.service('Dialog', function($dialog) {
module.service('Dialog', function($modal) {
var dialog = {};
var openDialog = function(title, message, btns) {
var controller = function($scope, $modalInstance, title, message, btns) {
$scope.title = title;
$scope.message = message;
$scope.btns = btns;
$scope.ok = function () {
$modalInstance.close();
};
$scope.cancel = function () {
$modalInstance.dismiss('cancel');
};
};
return $modal.open({
templateUrl: 'templates/kc-modal.html',
controller: controller,
resolve: {
title: function() {
return title;
},
message: function() {
return message;
},
btns: function() {
return btns;
}
}
}).result;
}
var escapeHtml = function(str) {
var div = document.createElement('div');
div.appendChild(document.createTextNode(str));
@ -13,64 +44,53 @@ module.service('Dialog', function($dialog) {
dialog.confirmDelete = function(name, type, success) {
var title = 'Delete ' + escapeHtml(type.charAt(0).toUpperCase() + type.slice(1));
var msg = '<span class="primary">Are you sure you want to permanently delete the ' + escapeHtml(type) + ' <strong>' + escapeHtml(name) + '</strong>?</span>';
var btns = [ {
result : 'cancel',
label : 'Cancel',
cssClass : 'btn btn-default'
}, {
result : 'ok',
var msg = 'Are you sure you want to permanently delete the ' + type + ' ' + name + '?';
var btns = {
ok: {
label: 'Delete',
cssClass: 'btn btn-danger'
} ];
$dialog.messageBox(title, msg, btns).open().then(function(result) {
if (result == "ok") {
success();
},
cancel: {
label: 'Cancel',
cssClass: 'btn btn-default'
}
});
}
openDialog(title, msg, btns).then(success);
}
dialog.confirmGenerateKeys = function(name, type, success) {
var title = 'Generate new keys for realm';
var msg = '<span class="primary">Are you sure you want to permanently generate new keys for <strong>' + name + '</strong>?</span>';
var btns = [ {
result : 'cancel',
var msg = 'Are you sure you want to permanently generate new keys for ' + name + '?';
var btns = {
ok: {
label: 'Generate Keys',
cssClass: 'btn btn-danger'
},
cancel: {
label: 'Cancel',
cssClass: 'btn btn-default'
}, {
result : 'ok',
label : 'Generate new keys',
cssClass : 'btn btn-danger'
} ];
$dialog.messageBox(title, msg, btns).open().then(function(result) {
if (result == "ok") {
success();
}
});
}
openDialog(title, msg, btns).then(success);
}
dialog.confirm = function(title, message, success, cancel) {
var title = title;
var msg = '<span class="primary">' + message + '"</span>';
var btns = [ {
result : 'cancel',
label : 'Cancel',
cssClass : 'btn btn-default'
}, {
result : 'ok',
var btns = {
ok: {
label: title,
cssClass: 'btn btn-danger'
} ];
$dialog.messageBox(title, msg, btns).open().then(function(result) {
if (result == "ok") {
success();
} else {
cancel && cancel();
},
cancel: {
label: 'Cancel',
cssClass: 'btn btn-default'
}
});
}
openDialog(title, msg, btns).then(success).reject(cancel);
}
return dialog

6
forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-auth-detail.html
View file

@ -37,17 +37,13 @@
</div>
</div>
<div class="form-group clearfix block">
<div class="form-group clearfix block" data-ng-show="authProvider.providerName">
<label class="col-sm-2 control-label" for="passwordUpdateSupported">Password Update Supported</label>
<div class="col-sm-4">
<input ng-model="authProvider.passwordUpdateSupported" name="passwordUpdateSupported" id="passwordUpdateSupported" onoffswitch />
</div>
</div>
</fieldset>
<fieldset>
<legend data-ng-show="authProvider.providerName"><span class="text">{{authProvider.providerName|capitalize}}'s provider options</span></legend>
<div data-ng-repeat="option in authProviderOptionNames" class="form-group">
<label class="col-sm-2 control-label">{{option|capitalize}} </label>

9
forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-auth-list.html
View file

@ -28,7 +28,14 @@
<tr ng-repeat="authProvider in authenticationProviders">
<td><a href="#/realms/{{realm.realm}}/auth-settings/{{$index}}">{{authProvider.providerName|capitalize}}</a></td>
<td>{{authProvider.passwordUpdateSupported}}</td>
<td>{{authProvider.config}}</td>
<td>
<table class="table table-striped table-bordered" data-ng-show="authProvider.config">
<tr data-ng-repeat="(key, value) in authProvider.config">
<td>{{key}}</td>
<td>{{value}}</td>
</tr>
</table>
</td>
</tr>
<tr data-ng-show="!authenticationProviders || authenticationProviders.length == 0">
<td>No authentication providers available</td>

13
forms/common-themes/src/main/resources/theme/admin/base/resources/templates/kc-modal.html
View file

@ -1,14 +1,11 @@
<div class="modal-dialog" tabindex="-1" role="dialog">
<div class="modal-content">
<div class="modal-header">
<button type="button" class="close" data-dismiss="modal" aria-hidden="true">
<button type="button" class="close" ng-click="cancel()">
<span class="pficon pficon-close"></span>
</button>
<h4 class="modal-title" id="myModalLabel">{{ title }}</h4>
<h4 class="modal-title">{{title}}</h4>
</div>
<div class="modal-body"><p ng-bind-html-unsafe="message"></p></div>
<div class="modal-body">{{message}}</div>
<div class="modal-footer">
<button ng-repeat="btn in buttons" ng-click="close(btn.result)" class="" ng-class="btn.cssClass">{{ btn.label }}</button>
</div>
</div>
<button type="button" data-ng-class="btns.cancel.cssClass" ng-click="cancel()">{{btns.cancel.label}}</button>
<button type="button" data-ng-class="btns.ok.cssClass" ng-click="ok()">{{btns.ok.label}}</button>
</div>

2
forms/common-themes/src/main/resources/theme/admin/base/resources/templates/kc-navigation.html
View file

@ -1,6 +1,6 @@
<ul class="nav nav-tabs nav-tabs-pf">
<li ng-class="{active: !path[2]}"><a href="#/realms/{{realm.realm}}">General</a></li>
<li ng-class="{active: path[2] == 'social'}" data-ng-show="realm.social && access.viewRealm"><a href="#/realms/{{realm.realm}}/social-settings">Social</a></li>
<li ng-class="{active: path[2] == 'social-settings'}" data-ng-show="realm.social && access.viewRealm"><a href="#/realms/{{realm.realm}}/social-settings">Social</a></li>
<li ng-class="{active: path[2] == 'roles'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/roles">Roles</a></li>
<li ng-class="{active: path[2] == 'default-roles'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/default-roles">Default Roles</a></li>
<li ng-class="{active: path[2] == 'required-credentials'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/required-credentials">Credentials</a></li>

4
forms/common-themes/src/main/resources/theme/admin/keycloak/resources/css/admin-console.css
View file

@ -310,7 +310,7 @@ form .btn + .btn {
background-color: #c7e5f0;
border-color: #56bae0;
font-weight: bold;
background-image: url(../img/icon-sidebar-active.svg);
background-image: url(../img/icon-sidebar-active.png);
background-repeat: no-repeat;
background-position: right center;
}
@ -522,7 +522,7 @@ legend .kc-icon-collapse {
.header .navbar-primary li > .select-kc {
background-color: #555A5E;
background-image: url("../img/sprite-arrow-down.svg");
background-image: url("../img/sprite-arrow-down.png");
background-position: right -26px;
background-repeat: no-repeat;
border: 1px solid #676C6E;

7
forms/common-themes/src/main/resources/theme/admin/keycloak/resources/img/icon-sidebar-active.svg
View file

@ -1,7 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
width="23px" height="14px" viewBox="0 0 23 14" enable-background="new 0 0 23 14" xml:space="preserve">
<polyline fill="none" stroke="#009AD8" stroke-miterlimit="10" points="1,13 7,7 1,1 "/>
</svg>
Side by side

Before

Width:  |  Height:  |  Size: 573 B

8
forms/common-themes/src/main/resources/theme/admin/keycloak/resources/img/sprite-arrow-down.svg
View file

@ -1,8 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
width="22px" height="52px" viewBox="0 0 22 52" enable-background="new 0 0 22 52" xml:space="preserve">
<polygon fill="#828487" points="11,16 6.818,11.818 7.525,11.111 11,14.586 14.475,11.111 15.182,11.818 "/>
<polygon fill="#DBDADA" points="11,42 6.818,37.818 7.525,37.111 11,40.586 14.475,37.111 15.182,37.818 "/>
</svg>
Side by side

Before

Width:  |  Height:  |  Size: 699 B

1328
forms/common-themes/src/main/resources/theme/admin/keycloak/resources/img/sprites-white.svg
View file

File diff suppressed because it is too large Load diff
Side by side

Before

Width:  |  Height:  |  Size: 250 KiB

4
forms/common-themes/src/main/resources/theme/admin/patternfly/resources/css/styles.css
View file

@ -1,6 +1,2 @@
@import url("../lib/patternfly/css/patternfly.css");
@import url("../lib/select2-3.4.1/select2.css");
@import url("admin-console.css");
@import url("tables.css");
@import url("sprites.css");

1835
forms/common-themes/src/main/resources/theme/common/keycloak/resources/lib/angular/angular-bootstrap-prettify.js vendored
View file

File diff suppressed because it is too large Load diff

175
forms/common-themes/src/main/resources/theme/common/keycloak/resources/lib/angular/angular-bootstrap.js vendored
View file

@ -1,175 +0,0 @@
/**
* @license AngularJS v1.0.7
* (c) 2010-2012 Google, Inc. http://angularjs.org
* License: MIT
*/
(function(window, angular, undefined) {
'use strict';
var directive = {};
directive.dropdownToggle =
['$document', '$location', '$window',
function ($document, $location, $window) {
var openElement = null, close;
return {
restrict: 'C',
link: function(scope, element, attrs) {
scope.$watch(function dropdownTogglePathWatch(){return $location.path();}, function dropdownTogglePathWatchAction() {
close && close();
});
element.parent().bind('click', function(event) {
close && close();
});
element.bind('click', function(event) {
event.preventDefault();
event.stopPropagation();
var iWasOpen = false;
if (openElement) {
iWasOpen = openElement === element;
close();
}
if (!iWasOpen){
element.parent().addClass('open');
openElement = element;
close = function (event) {
event && event.preventDefault();
event && event.stopPropagation();
$document.unbind('click', close);
element.parent().removeClass('open');
close = null;
openElement = null;
}
$document.bind('click', close);
}
});
}
};
}];
directive.tabbable = function() {
return {
restrict: 'C',
compile: function(element) {
var navTabs = angular.element('<ul class="nav nav-tabs"></ul>'),
tabContent = angular.element('<div class="tab-content"></div>');
tabContent.append(element.contents());
element.append(navTabs).append(tabContent);
},
controller: ['$scope', '$element', function($scope, $element) {
var navTabs = $element.contents().eq(0),
ngModel = $element.controller('ngModel') || {},
tabs = [],
selectedTab;
ngModel.$render = function() {
var $viewValue = this.$viewValue;
if (selectedTab ? (selectedTab.value != $viewValue) : $viewValue) {
if(selectedTab) {
selectedTab.paneElement.removeClass('active');
selectedTab.tabElement.removeClass('active');
selectedTab = null;
}
if($viewValue) {
for(var i = 0, ii = tabs.length; i < ii; i++) {
if ($viewValue == tabs[i].value) {
selectedTab = tabs[i];
break;
}
}
if (selectedTab) {
selectedTab.paneElement.addClass('active');
selectedTab.tabElement.addClass('active');
}
}
}
};
this.addPane = function(element, attr) {
var li = angular.element('<li><a href></a></li>'),
a = li.find('a'),
tab = {
paneElement: element,
paneAttrs: attr,
tabElement: li
};
tabs.push(tab);
attr.$observe('value', update)();
attr.$observe('title', function(){ update(); a.text(tab.title); })();
function update() {
tab.title = attr.title;
tab.value = attr.value || attr.title;
if (!ngModel.$setViewValue && (!ngModel.$viewValue || tab == selectedTab)) {
// we are not part of angular
ngModel.$viewValue = tab.value;
}
ngModel.$render();
}
navTabs.append(li);
li.bind('click', function(event) {
event.preventDefault();
event.stopPropagation();
if (ngModel.$setViewValue) {
$scope.$apply(function() {
ngModel.$setViewValue(tab.value);
ngModel.$render();
});
} else {
// we are not part of angular
ngModel.$viewValue = tab.value;
ngModel.$render();
}
});
return function() {
tab.tabElement.remove();
for(var i = 0, ii = tabs.length; i < ii; i++ ) {
if (tab == tabs[i]) {
tabs.splice(i, 1);
}
}
};
}
}]
};
};
directive.table = function() {
return {
restrict: 'E',
link: function(scope, element, attrs) {
element[0].className = 'table table-bordered table-striped code-table';
}
};
};
directive.tabPane = function() {
return {
require: '^tabbable',
restrict: 'C',
link: function(scope, element, attrs, tabsCtrl) {
element.bind('$remove', tabsCtrl.addPane(element, attrs));
}
};
};
angular.module('bootstrap', []).directive(directive);
})(window, window.angular);

4116
forms/common-themes/src/main/resources/theme/common/keycloak/resources/lib/angular/ui-bootstrap-tpls-0.11.0.js Normal file
View file

File diff suppressed because it is too large Load diff

3170
forms/common-themes/src/main/resources/theme/common/keycloak/resources/lib/angular/ui-bootstrap-tpls-0.4.0.js
View file

File diff suppressed because it is too large Load diff

4
forms/common-themes/src/main/resources/theme/login/base/code.ftl
View file

@ -10,9 +10,9 @@
<div id="kc-code">
<#if code.success>
<p>Please copy this code and paste it into your application:</p>
<textarea id="code">${code.code}</textarea>
<textarea id="code" class="${properties.kcTextareaClass!}">${code.code}</textarea>
<#else>
<p>${code.error}</p>
<p id="error">${code.error}</p>
</#if>
</div>
</#if>

4
forms/common-themes/src/main/resources/theme/login/patternfly/resources/css/login.css
View file

@ -186,6 +186,10 @@ ol#kc-totp-settings li:first-of-type {
width: 125px;
}
.zocial:hover {
color: #fff !important;
}
.zocial.facebook,
.zocial.github,
.zocial.google,

1
forms/common-themes/src/main/resources/theme/login/patternfly/theme.properties
View file

@ -23,5 +23,6 @@ kcInputClass=form-control
kcInputWrapperClass=col-xs-12 col-sm-12 col-md-8 col-lg-9
kcFormOptionsClass=col-xs-4 col-sm-5 col-md-offset-4 col-md-4 col-lg-offset-3 col-lg-5
kcFormButtonsClass=col-xs-8 col-sm-7 col-md-4 col-lg-4 submit
kcTextareaClass=form-control
kcInfoAreaClass=col-xs-12 col-sm-4 col-md-4 col-lg-6 details

4
integration/js/src/main/resources/keycloak.js
View file

@ -532,7 +532,6 @@ var Keycloak = function (config) {
}
var src = getRealmUrl() + '/login-status-iframe.html?client_id=' + encodeURIComponent(kc.clientId);
console.log('iframe src='+ src);
iframe.setAttribute('src', src );
iframe.style.display = 'none';
document.body.appendChild(iframe);
@ -571,7 +570,6 @@ var Keycloak = function (config) {
msg.callbackId = createCallbackId();
loginIframe.callbackMap[msg.callbackId] = promise;
var origin = loginIframe.iframeOrigin;
console.log('*** origin: ' + origin);
loginIframe.iframe.contentWindow.postMessage(msg, origin);
} else {
promise.setSuccess();
@ -612,8 +610,6 @@ var Keycloak = function (config) {
}
if (type == 'cordova') {
console.debug('Enabling Cordova support');
return {
login: function(options) {
var promise = createPromise();

2
integration/undertow/src/main/java/org/keycloak/adapters/undertow/ServletRequestAuthenticator.java
View file

@ -66,7 +66,7 @@ public class ServletRequestAuthenticator extends UndertowRequestAuthenticator {
HttpServletRequest req = (HttpServletRequest) servletRequestContext.getServletRequest();
HttpSession session = req.getSession(true);
session.setAttribute(KeycloakUndertowAccount.class.getName(), account);
userSessionManagement.login(servletRequestContext.getDeployment().getSessionManager(), session, account.getPrincipal().getName(), account.getKeycloakSecurityContext().getToken().getSessionState());
userSessionManagement.login(servletRequestContext.getDeployment().getSessionManager(), session.getId(), account.getPrincipal().getName(), account.getKeycloakSecurityContext().getToken().getSessionState());
}
}

5
integration/undertow/src/main/java/org/keycloak/adapters/undertow/UndertowUserSessionManagement.java
View file

@ -8,7 +8,6 @@ import io.undertow.server.session.SessionManager;
import io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler;
import org.jboss.logging.Logger;
import javax.servlet.http.HttpSession;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
@ -62,9 +61,7 @@ public class UndertowUserSessionManagement implements SessionListener {
return set;
}
public synchronized void login(SessionManager manager, HttpSession session, String username, String keycloakSessionId) {
String sessionId = session.getId();
public synchronized void login(SessionManager manager, String sessionId, String username, String keycloakSessionId) {
UserSessions sessions = userSessionMap.get(username);
if (sessions == null) {
sessions = new UserSessions();

2
model/mongo/src/main/java/org/keycloak/models/mongo/impl/MongoStoreImpl.java
View file

@ -237,7 +237,7 @@ public class MongoStoreImpl implements MongoStore {
public <T extends MongoIdentifiableEntity> T loadEntity(Class<T> type, String id, MongoStoreInvocationContext context) {
// First look if we already read the object with this oid and type during this transaction. If yes, use it instead of DB lookup
T cached = context.getLoadedEntity(type, id);
if (cached != null) return cached;
if (cached != null && type.isAssignableFrom(cached.getClass())) return cached;
DBCollection dbCollection = getDBCollectionForType(type);

2
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ApplicationAdapter.java
View file

@ -22,7 +22,7 @@ import java.util.Set;
*/
public class ApplicationAdapter extends ClientAdapter<MongoApplicationEntity> implements ApplicationModel {
public ApplicationAdapter(RealmModel realm, MongoApplicationEntity applicationEntity, MongoStoreInvocationContext invContext) {
public ApplicationAdapter(RealmAdapter realm, MongoApplicationEntity applicationEntity, MongoStoreInvocationContext invContext) {
super(realm, applicationEntity, invContext);
}

18
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ClientAdapter.java
View file

@ -9,12 +9,11 @@ import com.mongodb.DBObject;
import com.mongodb.QueryBuilder;
import org.keycloak.models.ClientModel;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.UserSessionModel;
import org.keycloak.models.entities.ClientEntity;
import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
import org.keycloak.models.mongo.keycloak.entities.MongoClientUserSessionAssociationEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoUserSessionEntity;
/**
* @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@ -22,9 +21,9 @@ import org.keycloak.models.mongo.keycloak.entities.MongoClientUserSessionAssocia
public class ClientAdapter<T extends MongoIdentifiableEntity> extends AbstractMongoAdapter<T> implements ClientModel {
protected final T clientEntity;
private final RealmModel realm;
private final RealmAdapter realm;
public ClientAdapter(RealmModel realm, T clientEntity, MongoStoreInvocationContext invContext) {
public ClientAdapter(RealmAdapter realm, T clientEntity, MongoStoreInvocationContext invContext) {
super(invContext);
this.clientEntity = clientEntity;
this.realm = realm;
@ -154,7 +153,7 @@ public class ClientAdapter<T extends MongoIdentifiableEntity> extends AbstractMo
}
@Override
public RealmModel getRealm() {
public RealmAdapter getRealm() {
return realm;
}
@ -172,14 +171,13 @@ public class ClientAdapter<T extends MongoIdentifiableEntity> extends AbstractMo
@Override
public Set<UserSessionModel> getUserSessions() {
DBObject query = new QueryBuilder()
.and("clientId").is(getId())
.and("associatedClientIds").is(getId())
.get();
List<MongoClientUserSessionAssociationEntity> associations = getMongoStore().loadEntities(MongoClientUserSessionAssociationEntity.class, query, invocationContext);
List<MongoUserSessionEntity> sessions = getMongoStore().loadEntities(MongoUserSessionEntity.class, query, invocationContext);
Set<UserSessionModel> result = new HashSet<UserSessionModel>();
for (MongoClientUserSessionAssociationEntity association : associations) {
UserSessionModel session = realm.getUserSession(association.getSessionId());
result.add(session);
for (MongoUserSessionEntity session : sessions) {
result.add(new UserSessionAdapter(session, realm, invocationContext));
}
return result;

4
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoKeycloakSessionFactory.java
View file

@ -64,7 +64,7 @@ public class MongoKeycloakSessionFactory implements KeycloakSessionFactory {
try {
String host = config.get("host", ServerAddress.defaultHost());
int port = config.getInt("port", ServerAddress.defaultPort());
String dbName = config.get("db", "keycloak-audit");
String dbName = config.get("db", "keycloak");
boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
String user = config.get("user");
@ -79,6 +79,8 @@ public class MongoKeycloakSessionFactory implements KeycloakSessionFactory {
DB db = client.getDB(dbName);
this.mongoStore = new MongoStoreImpl(db, clearOnStartup, MANAGED_ENTITY_TYPES);
logger.infof("Initialized mongo model. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
} catch (UnknownHostException e) {
throw new RuntimeException(e);
}

2
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/OAuthClientAdapter.java
View file

@ -10,7 +10,7 @@ import org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity;
*/
public class OAuthClientAdapter extends ClientAdapter<MongoOAuthClientEntity> implements OAuthClientModel {
public OAuthClientAdapter(RealmModel realm, MongoOAuthClientEntity oauthClientEntity, MongoStoreInvocationContext invContext) {
public OAuthClientAdapter(RealmAdapter realm, MongoOAuthClientEntity oauthClientEntity, MongoStoreInvocationContext invContext) {
super(realm, oauthClientEntity, invContext);
}

2
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java
View file

@ -299,6 +299,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
@Override
public void setSsoSessionIdleTimeout(int seconds) {
realm.setSsoSessionIdleTimeout(seconds);
updateRealm();
}
@Override
@ -309,6 +310,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
@Override
public void setSsoSessionMaxLifespan(int seconds) {
realm.setSsoSessionMaxLifespan(seconds);
updateRealm();
}
@Override

7
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RoleAdapter.java
View file

@ -7,7 +7,6 @@ import java.util.Set;
import com.mongodb.DBObject;
import com.mongodb.QueryBuilder;
import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleContainerModel;
import org.keycloak.models.RoleModel;
import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
@ -25,13 +24,13 @@ public class RoleAdapter extends AbstractMongoAdapter<MongoRoleEntity> implement
private final MongoRoleEntity role;
private RoleContainerModel roleContainer;
private RealmModel realm;
private RealmAdapter realm;
public RoleAdapter(RealmModel realm, MongoRoleEntity roleEntity, MongoStoreInvocationContext invContext) {
public RoleAdapter(RealmAdapter realm, MongoRoleEntity roleEntity, MongoStoreInvocationContext invContext) {
this(realm, roleEntity, null, invContext);
}
public RoleAdapter(RealmModel realm, MongoRoleEntity roleEntity, RoleContainerModel roleContainer, MongoStoreInvocationContext invContext) {
public RoleAdapter(RealmAdapter realm, MongoRoleEntity roleEntity, RoleContainerModel roleContainer, MongoStoreInvocationContext invContext) {
super(invContext);
this.role = roleEntity;
this.roleContainer = roleContainer;

77
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserSessionAdapter.java
View file

@ -2,27 +2,27 @@ package org.keycloak.models.mongo.keycloak.adapters;
import com.mongodb.DBObject;
import com.mongodb.QueryBuilder;
import org.jboss.logging.Logger;
import org.keycloak.models.ApplicationModel;
import org.keycloak.models.ClientModel;
import org.keycloak.models.RoleModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.UserSessionModel;
import org.keycloak.models.entities.ClientEntity;
import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
import org.keycloak.models.mongo.keycloak.entities.MongoClientUserSessionAssociationEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoUserEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity;
import org.keycloak.models.mongo.keycloak.entities.MongoUserSessionEntity;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
/**
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
*/
public class UserSessionAdapter extends AbstractMongoAdapter<MongoUserSessionEntity> implements UserSessionModel {
private static final Logger logger = Logger.getLogger(RealmAdapter.class);
private MongoUserSessionEntity entity;
private RealmAdapter realm;
@ -46,6 +46,7 @@ public class UserSessionAdapter extends AbstractMongoAdapter<MongoUserSessionEnt
@Override
public void setId(String id) {
entity.setId(id);
updateMongoEntity();
}
@Override
@ -56,6 +57,7 @@ public class UserSessionAdapter extends AbstractMongoAdapter<MongoUserSessionEnt
@Override
public void setUser(UserModel user) {
entity.setUser(user.getId());
updateMongoEntity();
}
@Override
@ -66,6 +68,7 @@ public class UserSessionAdapter extends AbstractMongoAdapter<MongoUserSessionEnt
@Override
public void setIpAddress(String ipAddress) {
entity.setIpAddress(ipAddress);
updateMongoEntity();
}
@Override
@ -76,6 +79,7 @@ public class UserSessionAdapter extends AbstractMongoAdapter<MongoUserSessionEnt
@Override
public void setStarted(int started) {
entity.setStarted(started);
updateMongoEntity();
}
@Override
@ -86,58 +90,39 @@ public class UserSessionAdapter extends AbstractMongoAdapter<MongoUserSessionEnt
@Override
public void setLastSessionRefresh(int seconds) {
entity.setLastSessionRefresh(seconds);
updateMongoEntity();
}
@Override
public void associateClient(ClientModel client) {
List<ClientModel> clients = getClientAssociations();
for (ClientModel ass : clients) {
if (ass.getId().equals(client.getId())) return;
}
MongoClientUserSessionAssociationEntity association = new MongoClientUserSessionAssociationEntity();
association.setClientId(client.getId());
association.setSessionId(getId());
getMongoStore().insertEntity(association, invocationContext);
getMongoStore().pushItemToList(entity, "associatedClientIds", client.getId(), true, invocationContext);
}
@Override
public List<ClientModel> getClientAssociations() {
DBObject query = new QueryBuilder()
.and("sessionId").is(getId())
.get();
List<MongoClientUserSessionAssociationEntity> associations = getMongoStore().loadEntities(MongoClientUserSessionAssociationEntity.class, query, invocationContext);
List<String> associatedClientIds = getMongoEntity().getAssociatedClientIds();
List<ClientModel> result = new ArrayList<ClientModel>();
for (MongoClientUserSessionAssociationEntity association : associations) {
ClientModel client = realm.findClientById(association.getClientId());
result.add(client);
List<ClientModel> clients = new ArrayList<ClientModel>();
for (String clientId : associatedClientIds) {
// Try application first
ClientModel client = realm.getApplicationById(clientId);
// And then OAuthClient
if (client == null) {
client = realm.getOAuthClientById(clientId);
}
return result;
if (client != null) {
clients.add(client);
} else {
logger.warnf("Not found associated client with Id: %s", clientId);
}
}
return clients;
}
@Override
public void removeAssociatedClient(ClientModel client) {
DBObject query = new QueryBuilder()
.and("sessionId").is(getId())
.and("clientId").is(client.getId())
.get();
getMongoStore().removeEntities(MongoClientUserSessionAssociationEntity.class, query, invocationContext);
}
@Override
public boolean equals(Object o) {
if (this == o) return true;
if (o == null || getClass() != o.getClass()) return false;
if (!super.equals(o)) return false;
UserSessionAdapter that = (UserSessionAdapter) o;
return getId().equals(that.getId());
}
@Override
public int hashCode() {
return getId().hashCode();
getMongoStore().pullItemFromList(entity, "associatedClientIds", client.getId(), invocationContext);
}
}

12
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoApplicationEntity.java
View file

@ -1,7 +1,10 @@
package org.keycloak.models.mongo.keycloak.entities;
import java.util.List;
import com.mongodb.DBObject;
import com.mongodb.QueryBuilder;
import org.jboss.logging.Logger;
import org.keycloak.models.entities.ApplicationEntity;
import org.keycloak.models.mongo.api.MongoCollection;
import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
@ -23,10 +26,13 @@ public class MongoApplicationEntity extends ApplicationEntity implements MongoId
.get();
context.getMongoStore().removeEntities(MongoRoleEntity.class, query, context);
// Remove all session associations
query = new QueryBuilder()
.and("clientId").is(getId())
.and("associatedClientIds").is(getId())
.get();
context.getMongoStore().removeEntities(MongoClientUserSessionAssociationEntity.class, query, context);
List<MongoUserSessionEntity> sessions = context.getMongoStore().loadEntities(MongoUserSessionEntity.class, query, context);
for (MongoUserSessionEntity session : sessions) {
context.getMongoStore().pullItemFromList(session, "associatedClientIds", getId(), context);
}
}
}

37
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoClientUserSessionAssociationEntity.java
View file

@ -1,37 +0,0 @@
package org.keycloak.models.mongo.keycloak.entities;
import org.keycloak.models.entities.AbstractIdentifiableEntity;
import org.keycloak.models.mongo.api.MongoCollection;
import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@MongoCollection(collectionName = "session-client-associations")
public class MongoClientUserSessionAssociationEntity extends AbstractIdentifiableEntity implements MongoIdentifiableEntity {
private String clientId;
private String sessionId;
public String getClientId() {
return clientId;
}
public void setClientId(String clientId) {
this.clientId = clientId;
}
public String getSessionId() {
return sessionId;
}
public void setSessionId(String sessionId) {
this.sessionId = sessionId;
}
@Override
public void afterRemove(MongoStoreInvocationContext invocationContext) {
}
}

12
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoOAuthClientEntity.java
View file

@ -1,5 +1,7 @@
package org.keycloak.models.mongo.keycloak.entities;
import java.util.List;
import com.mongodb.DBObject;
import com.mongodb.QueryBuilder;
import org.keycloak.models.entities.OAuthClientEntity;
@ -16,10 +18,14 @@ import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
public class MongoOAuthClientEntity extends OAuthClientEntity implements MongoIdentifiableEntity {
@Override
public void afterRemove(MongoStoreInvocationContext invocationContext) {
public void afterRemove(MongoStoreInvocationContext context) {
// Remove all session associations
DBObject query = new QueryBuilder()
.and("clientId").is(getId())
.and("associatedClientIds").is(getId())
.get();
invocationContext.getMongoStore().removeEntities(MongoClientUserSessionAssociationEntity.class, query, invocationContext);
List<MongoUserSessionEntity> sessions = context.getMongoStore().loadEntities(MongoUserSessionEntity.class, query, context);
for (MongoUserSessionEntity session : sessions) {
context.getMongoStore().pullItemFromList(session, "associatedClientIds", getId(), context);
}
}
}

20
model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoUserSessionEntity.java
View file

@ -1,7 +1,8 @@
package org.keycloak.models.mongo.keycloak.entities;
import com.mongodb.DBObject;
import com.mongodb.QueryBuilder;
import java.util.ArrayList;
import java.util.List;
import org.keycloak.models.entities.AbstractIdentifiableEntity;
import org.keycloak.models.mongo.api.MongoCollection;
import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
@ -23,6 +24,8 @@ public class MongoUserSessionEntity extends AbstractIdentifiableEntity implement
private int lastSessionRefresh;
private List<String> associatedClientIds = new ArrayList<String>();
public String getRealmId() {
return realmId;
}
@ -63,13 +66,16 @@ public class MongoUserSessionEntity extends AbstractIdentifiableEntity implement
this.lastSessionRefresh = lastSessionRefresh;
}
public List<String> getAssociatedClientIds() {
return associatedClientIds;
}
public void setAssociatedClientIds(List<String> associatedClientIds) {
this.associatedClientIds = associatedClientIds;
}
@Override
public void afterRemove(MongoStoreInvocationContext context) {
// Remove all roles, which belongs to this application
DBObject query = new QueryBuilder()
.and("sessionId").is(getId())
.get();
context.getMongoStore().removeEntities(MongoClientUserSessionAssociationEntity.class, query, context);
}
}

45
model/tests/src/test/java/org/keycloak/model/test/AdapterTest.java
View file

@ -762,4 +762,49 @@ public class AdapterTest extends AbstractModelTest {
assertNull(realmManager.getRealmByName("userSessions").getUserSession(userSession.getId()));
}
@Test
public void userSessionAssociations() {
RealmModel realm = realmManager.createRealm("userSessions");
UserModel user = realm.addUser("userSessions1");
UserSessionModel userSession = realm.createUserSession(user, "127.0.0.1");
ApplicationModel app1 = realm.addApplication("app1");
ApplicationModel app2 = realm.addApplication("app2");
OAuthClientModel client1 = realm.addOAuthClient("client1");
Assert.assertEquals(0, userSession.getClientAssociations().size());
userSession.associateClient(app1);
userSession.associateClient(client1);
Assert.assertEquals(2, userSession.getClientAssociations().size());
Assert.assertTrue(app1.getUserSessions().contains(userSession));
Assert.assertFalse(app2.getUserSessions().contains(userSession));
Assert.assertTrue(client1.getUserSessions().contains(userSession));
commit();
// Refresh all
realm = realmManager.getRealm("userSessions");
userSession = realm.getUserSession(userSession.getId());
app1 = realm.getApplicationByName("app1");
client1 = realm.getOAuthClient("client1");
userSession.removeAssociatedClient(app1);
Assert.assertEquals(1, userSession.getClientAssociations().size());
Assert.assertEquals(client1, userSession.getClientAssociations().get(0));
Assert.assertFalse(app1.getUserSessions().contains(userSession));
commit();
// Refresh all
realm = realmManager.getRealm("userSessions");
userSession = realm.getUserSession(userSession.getId());
client1 = realm.getOAuthClient("client1");
userSession.removeAssociatedClient(client1);
Assert.assertEquals(0, userSession.getClientAssociations().size());
Assert.assertFalse(client1.getUserSessions().contains(userSession));
}
}

2
services/src/main/java/org/keycloak/services/DefaultProviderSessionFactory.java
View file

@ -33,7 +33,6 @@ public class DefaultProviderSessionFactory implements ProviderSessionFactory {
ProviderFactory factory = loadProviderFactory(spi, provider);
Config.Scope scope = Config.scope(spi.getName(), provider);
factory.init(scope);
log.debug("Initialized " + factory.getClass().getName() + " (config = " + scope + ")");
factories.put(factory.getId(), factory);
@ -42,7 +41,6 @@ public class DefaultProviderSessionFactory implements ProviderSessionFactory {
for (ProviderFactory factory : ServiceLoader.load(spi.getProviderFactoryClass())) {
Config.Scope scope = Config.scope(spi.getName(), factory.getId());
factory.init(scope);
log.debug("Initialized " + factory.getClass().getName() + " (config = " + scope + ")");
factories.put(factory.getId(), factory);
}

18
services/src/main/java/org/keycloak/services/resources/AccountService.java
View file

@ -160,7 +160,9 @@ public class AccountService {
}
}
account.setFeatures(realm.isSocial(), auditProvider != null, passwordUpdateSupported);
boolean auditEnabled = auditProvider != null && realm.isAuditEnabled();
account.setFeatures(realm.isSocial(), auditEnabled, passwordUpdateSupported);
}
public static UriBuilder accountServiceBaseUrl(UriInfo uriInfo) {
@ -246,6 +248,16 @@ public class AccountService {
public Response logPage() {
if (auth != null) {
List<Event> events = auditProvider.createQuery().event(AUDIT_EVENTS).user(auth.getUser().getId()).maxResults(30).getResultList();
for (Event e : events) {
if (e.getDetails() != null) {
Iterator<Map.Entry<String, String>> itr = e.getDetails().entrySet().iterator();
while (itr.hasNext()) {
if (!AUDIT_DETAILS.contains(itr.next().getKey())) {
itr.remove();
}
}
}
}
account.setEvents(events);
}
return forwardToPage("log", AccountPages.LOG);
@ -560,7 +572,7 @@ public class AccountService {
ApplicationModel application = realm.getApplicationByName(referrer);
if (application != null) {
if (referrerUri != null) {
referrerUri = TokenService.verifyRedirectUri(uriInfo, referrerUri, application);
referrerUri = TokenService.verifyRedirectUri(uriInfo, referrerUri, realm, application);
} else {
referrerUri = ResolveRelative.resolveRelativeUri(uriInfo.getRequestUri(), application.getBaseUrl());
}
@ -571,7 +583,7 @@ public class AccountService {
} else if (referrerUri != null) {
ClientModel client = realm.getOAuthClient(referrer);
if (client != null) {
referrerUri = TokenService.verifyRedirectUri(uriInfo, referrerUri, application);
referrerUri = TokenService.verifyRedirectUri(uriInfo, referrerUri, realm, application);
if (referrerUri != null) {
return new String[]{referrer, referrerUri};

20
services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java
View file

@ -84,12 +84,12 @@ public class KeycloakApplication extends Application {
classes.add(JsResource.class);
classes.add(WelcomeResource.class);
checkExportImportProvider();
setupDefaultRealm(context.getContextPath());
setupScheduledTasks(providerSessionFactory);
importRealms(context);
checkExportImportProvider();
}
public String getContextPath() {
@ -108,7 +108,19 @@ public class KeycloakApplication extends Application {
protected void loadConfig() {
try {
URL config = Thread.currentThread().getContextClassLoader().getResource("META-INF/keycloak-server.json");
URL config = null;
String configDir = System.getProperty("jboss.server.config.dir");
if (configDir != null) {
File f = new File(configDir + File.separator + "keycloak-server.json");
if (f.isFile()) {
config = f.toURI().toURL();
}
}
if (config == null) {
config = Thread.currentThread().getContextClassLoader().getResource("META-INF/keycloak-server.json");
}
if (config != null) {
JsonNode node = new ObjectMapper().readTree(config);
@ -116,6 +128,8 @@ public class KeycloakApplication extends Application {
log.info("Loaded config from " + config);
return;
} else {
log.warn("Config 'keycloak-server.json' not found");
}
} catch (IOException e) {
throw new RuntimeException("Failed to load config", e);

6
services/src/main/java/org/keycloak/services/resources/SocialResource.java
View file

@ -122,6 +122,10 @@ public class SocialResource {
Map<String, String[]> queryParams = getQueryParams();
RequestDetails requestData = getRequestDetails(queryParams);
if (requestData == null) {
Flows.forms(providerSession, null, uriInfo).setError("Unexpected callback").createErrorPage();
}
SocialProvider provider = SocialLoader.load(requestData.getProviderId());
String realmName = requestData.getClientAttribute("realm");
@ -296,7 +300,7 @@ public class SocialResource {
logger.warn("Login requester not enabled.");
return Flows.forms(providerSession, realm, uriInfo).setError("Login requester not enabled.").createErrorPage();
}
redirectUri = TokenService.verifyRedirectUri(uriInfo, redirectUri, client);
redirectUri = TokenService.verifyRedirectUri(uriInfo, redirectUri, realm, client);
if (redirectUri == null) {
audit.error(Errors.INVALID_REDIRECT_URI);
return Flows.forms(providerSession, realm, uriInfo).setError("Invalid redirect_uri.").createErrorPage();

35
services/src/main/java/org/keycloak/services/resources/TokenService.java
View file

@ -18,6 +18,7 @@ import org.keycloak.authentication.AuthenticationProviderException;
import org.keycloak.authentication.AuthenticationProviderManager;
import org.keycloak.jose.jws.JWSInput;
import org.keycloak.jose.jws.crypto.RSAProvider;
import org.keycloak.login.LoginFormsProvider;
import org.keycloak.models.ApplicationModel;
import org.keycloak.models.ClientModel;
import org.keycloak.models.Constants;
@ -42,6 +43,7 @@ import org.keycloak.services.managers.TokenManager;
import org.keycloak.services.messages.Messages;
import org.keycloak.services.resources.flows.Flows;
import org.keycloak.services.resources.flows.OAuthFlows;
import org.keycloak.services.resources.flows.Urls;
import org.keycloak.services.validation.Validation;
import org.keycloak.util.BasicAuthHelper;
import org.keycloak.util.Time;
@ -363,7 +365,7 @@ public class TokenService {
return oauth.forwardToSecurityFailure("Login requester not enabled.");
}
redirect = verifyRedirectUri(uriInfo, redirect, client);
redirect = verifyRedirectUri(uriInfo, redirect, realm, client);
if (redirect == null) {
audit.error(Errors.INVALID_REDIRECT_URI);
return oauth.forwardToSecurityFailure("Invalid redirect_uri.");
@ -457,7 +459,7 @@ public class TokenService {
return oauth.forwardToSecurityFailure("Login requester not enabled.");
}
redirect = verifyRedirectUri(uriInfo, redirect, client);
redirect = verifyRedirectUri(uriInfo, redirect, realm, client);
if (redirect == null) {
audit.error(Errors.INVALID_REDIRECT_URI);
return oauth.forwardToSecurityFailure("Invalid redirect_uri.");
@ -754,7 +756,7 @@ public class TokenService {
audit.error(Errors.NOT_ALLOWED);
return oauth.forwardToSecurityFailure("Bearer-only applications are not allowed to initiate login");
}
redirect = verifyRedirectUri(uriInfo, redirect, client);
redirect = verifyRedirectUri(uriInfo, redirect, realm, client);
if (redirect == null) {
audit.error(Errors.INVALID_REDIRECT_URI);
return oauth.forwardToSecurityFailure("Invalid redirect_uri.");
@ -811,7 +813,7 @@ public class TokenService {
return oauth.forwardToSecurityFailure("Login requester not enabled.");
}
redirect = verifyRedirectUri(uriInfo, redirect, client);
redirect = verifyRedirectUri(uriInfo, redirect, realm, client);
if (redirect == null) {
audit.error(Errors.INVALID_REDIRECT_URI);
return oauth.forwardToSecurityFailure("Invalid redirect_uri.");
@ -937,6 +939,17 @@ public class TokenService {
return oauth.redirectAccessCode(accessCodeEntry, session, state, redirect);
}
@Path("oauth/oob")
@GET
public Response installedAppUrnCallback(final @QueryParam("code") String code, final @QueryParam("error") String error, final @QueryParam("error_description") String errorDescription) {
LoginFormsProvider forms = Flows.forms(providerSession, realm, uriInfo);
if (code != null) {
return forms.setAccessCode(null, code).createCode();
} else {
return forms.setError(error).createCode();
}
}
protected Response redirectAccessDenied(String redirect, String state) {
UriBuilder redirectUri = UriBuilder.fromUri(redirect).queryParam(OAuth2Constants.ERROR, "access_denied");
if (state != null)
@ -961,7 +974,7 @@ public class TokenService {
return false;
}
public static String verifyRedirectUri(UriInfo uriInfo, String redirectUri, ClientModel client) {
public static String verifyRedirectUri(UriInfo uriInfo, String redirectUri, RealmModel realm, ClientModel client) {
Set<String> validRedirects = client.getRedirectUris();
if (redirectUri == null) {
if (validRedirects.size() != 1) return null;
@ -970,10 +983,10 @@ public class TokenService {
if (idx > -1) {
validRedirect = validRedirect.substring(0, idx);
}
return validRedirect;
redirectUri = validRedirect;
} else if (validRedirects.isEmpty()) {
logger.error("Redirect URI is required for client: " + client.getClientId());
return null;
redirectUri = null;
} else {
String r = redirectUri.indexOf('?') != -1 ? redirectUri.substring(0, redirectUri.indexOf('?')) : redirectUri;
Set<String> resolveValidRedirects = resolveValidRedirects(uriInfo, validRedirects);
@ -996,7 +1009,13 @@ public class TokenService {
valid = matchesRedirects(resolveValidRedirects, r);
}
return valid ? redirectUri : null;
redirectUri = valid ? redirectUri : null;
}
if (Constants.INSTALLED_APP_URN.equals(redirectUri)) {
return Urls.realmInstalledAppUrnCallback(uriInfo.getBaseUri(), realm.getName()).toString();
} else {
return redirectUri;
}
}

8
services/src/main/java/org/keycloak/services/resources/admin/AdminConsole.java
View file

@ -250,9 +250,11 @@ public class AdminConsole {
@GET
public Response getMainPage() throws URISyntaxException {
return Response.status(302).location(
AdminRoot.adminConsoleUrl(uriInfo).path("index.html").build(realm.getName())
).build();
if (!uriInfo.getRequestUri().getPath().endsWith("/")) {
return Response.status(302).location(uriInfo.getRequestUriBuilder().path("/").build()).build();
} else {
return getResource("index.html");
}
}
@GET

2
services/src/main/java/org/keycloak/services/resources/admin/AdminRoot.java
View file

@ -64,7 +64,7 @@ public class AdminRoot {
public Response masterRealmAdminConsoleRedirect() {
RealmModel master = new RealmManager(session).getKeycloakAdminstrationRealm();
return Response.status(302).location(
uriInfo.getBaseUriBuilder().path(AdminRoot.class).path(AdminRoot.class, "getAdminConsole").path("index.html").build(master.getName())
uriInfo.getBaseUriBuilder().path(AdminRoot.class).path(AdminRoot.class, "getAdminConsole").path("/").build(master.getName())
).build();
}

9
services/src/main/java/org/keycloak/services/resources/flows/OAuthFlows.java
View file

@ -86,10 +86,6 @@ public class OAuthFlows {
public Response redirectAccessCode(AccessCodeEntry accessCode, UserSessionModel session, String state, String redirect, boolean rememberMe) {
String code = accessCode.getCode();
if (Constants.INSTALLED_APP_URN.equals(redirect)) {
return Flows.forms(providerSession, realm, uriInfo).setAccessCode(accessCode.getId(), code).createCode();
} else {
UriBuilder redirectUri = UriBuilder.fromUri(redirect).queryParam(OAuth2Constants.CODE, code);
log.debugv("redirectAccessCode: state: {0}", state);
if (state != null)
@ -102,19 +98,14 @@ public class OAuthFlows {
if (rememberMe) authManager.createRememberMeCookie(realm, uriInfo);
return location.build();
}
}
public Response redirectError(ClientModel client, String error, String state, String redirect) {
if (Constants.INSTALLED_APP_URN.equals(redirect)) {
return Flows.forms(providerSession, realm, uriInfo).setError(error).createCode();
} else {
UriBuilder redirectUri = UriBuilder.fromUri(redirect).queryParam(OAuth2Constants.ERROR, error);
if (state != null) {
redirectUri.queryParam(OAuth2Constants.STATE, state);
}
return Response.status(302).location(redirectUri.build()).build();
}
}
public Response processAccessCode(String scopeParam, String state, String redirect, ClientModel client, UserModel user, UserSessionModel session, String username, boolean rememberMe, String authMethod, Audit audit) {
isTotpConfigurationRequired(user);

4
services/src/main/java/org/keycloak/services/resources/flows/Urls.java
View file

@ -148,6 +148,10 @@ public class Urls {
return tokenBase(baseUri).path(TokenService.class, "registerPage").build(realmId);
}
public static URI realmInstalledAppUrnCallback(URI baseUri, String realmId) {
return tokenBase(baseUri).path(TokenService.class, "installedAppUrnCallback").build(realmId);
}
public static URI realmOauthAction(URI baseUri, String realmId) {
return tokenBase(baseUri).path(TokenService.class, "processOAuth").build(realmId);
}

8
services/src/main/java/org/keycloak/services/util/JsonConfigProvider.java
View file

@ -74,11 +74,11 @@ public class JsonConfigProvider implements Config.ConfigProvider {
if (n == null) {
return null;
} else if (n.isArray()) {
ArrayList<String> l = new ArrayList<String>();
for (JsonNode e : n) {
l.add(StringPropertyReplacer.replaceProperties(e.getTextValue()));
String[] a = new String[n.size()];
for (int i = 0; i < a.length; i++) {
a[i] = StringPropertyReplacer.replaceProperties(n.get(i).getTextValue());
}
return (String[]) l.toArray();
return a;
} else {
return new String[] { StringPropertyReplacer.replaceProperties(n.getTextValue()) };
}

5
social/twitter/src/main/java/org/keycloak/social/twitter/TwitterProvider.java
View file

@ -48,10 +48,7 @@ public class TwitterProvider implements SocialProvider {
Twitter twitter = new TwitterFactory().getInstance();
twitter.setOAuthConsumer(config.getKey(), config.getSecret());
String redirectUri = config.getCallbackUrl();
redirectUri = redirectUri.replace("//localhost", "//127.0.0.1");
RequestToken requestToken = twitter.getOAuthRequestToken(redirectUri);
RequestToken requestToken = twitter.getOAuthRequestToken(config.getCallbackUrl());
return AuthRequest.create(requestToken.getToken(), requestToken.getAuthenticationURL())
.setAttribute("token", requestToken.getToken()).setAttribute("tokenSecret", requestToken.getTokenSecret())

2
testsuite/integration/README.md
View file

@ -58,6 +58,8 @@ By default it's using database `keycloak` on localhost/27017 and it uses already
mvn exec:java -Pkeycloak-server -Dkeycloak.model.provider=mongo -Dkeycloak.model.mongo.host=localhost -Dkeycloak.model.mongo.port=27017 -Dkeycloak.model.mongo.db=keycloak -Dkeycloak.model.mongo.clearOnStartup=false
Note that if you are using Mongo model, it would mean that Mongo will be used for audit as well. You may need to use audit related properties for configuration of Mongo if you want to override default ones (For example keycloak.audit.mongo.host, keycloak.audit.mongo.port etc)
TOTP codes
----------

6
testsuite/integration/pom.xml
View file

@ -439,7 +439,7 @@
<id>mongo</id>
<activation>
<property>
<name>keycloak.model</name>
<name>keycloak.model.provider</name>
<value>mongo</value>
</property>
</activation>
@ -471,13 +471,13 @@
<keycloak.model.mongo.host>${keycloak.model.mongo.host}</keycloak.model.mongo.host>
<keycloak.model.mongo.port>${keycloak.model.mongo.port}</keycloak.model.mongo.port>
<keycloak.model.mongo.db>${keycloak.model.mongo.db}</keycloak.model.mongo.db>
<keycloak.model.mongo.clearOnStartup>${keycloak.model.mongo.clearOnStartup}</keycloak.model.mongo.clearOnStartup>
<keycloak.audit.provider>mongo</keycloak.audit.provider>
<keycloak.audit.mongo.host>${keycloak.model.mongo.host}</keycloak.audit.mongo.host>
<keycloak.audit.mongo.port>${keycloak.model.mongo.port}</keycloak.audit.mongo.port>
<keycloak.audit.mongo.db>${keycloak.model.mongo.db}</keycloak.audit.mongo.db>
<keycloak.model.mongo.clearOnStartup>${keycloak.model.mongo.clearOnStartup}</keycloak.model.mongo.clearOnStartup>
<keycloak.audit.mongo.clearOnStartup>${keycloak.model.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
</systemPropertyVariables>
</configuration>
</execution>

16
testsuite/integration/src/main/resources/META-INF/keycloak-server.json
View file

@ -4,11 +4,23 @@
},
"audit": {
"provider": "${keycloak.audit.provider:jpa}"
"provider": "${keycloak.audit.provider,keycloak.model.provider:jpa}",
"mongo": {
"host": "${keycloak.audit.mongo.host:127.0.0.1}",
"port": "${keycloak.audit.mongo.port:27017}",
"db": "${keycloak.audit.mongo.db:keycloak-audit}",
"clearOnStartup": "${keycloak.audit.mongo.clearOnStartup:false}"
}
},
"model": {
"provider": "${keycloak.model.provider:jpa}"
"provider": "${keycloak.model.provider:jpa}",
"mongo": {
"host": "${keycloak.model.mongo.host:127.0.0.1}",
"port": "${keycloak.model.mongo.port:27017}",
"db": "${keycloak.model.mongo.db:keycloak}",
"clearOnStartup": "${keycloak.model.mongo.clearOnStartup:false}"
}
},
"timer": {

2
testsuite/integration/src/test/java/org/keycloak/testsuite/org/keycloak/testsuite/util/MailUtil.java → testsuite/integration/src/test/java/org/keycloak/testsuite/MailUtil.java
View file

@ -1,4 +1,4 @@
package org.keycloak.testsuite.org.keycloak.testsuite.util;
package org.keycloak.testsuite;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

4
testsuite/integration/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java
View file

@ -34,7 +34,7 @@ import org.keycloak.models.UserModel;
import org.keycloak.services.managers.RealmManager;
import org.keycloak.testsuite.AssertEvents;
import org.keycloak.testsuite.OAuthClient;
import org.keycloak.testsuite.org.keycloak.testsuite.util.MailUtil;
import org.keycloak.testsuite.MailUtil;
import org.keycloak.testsuite.pages.AppPage;
import org.keycloak.testsuite.pages.AppPage.RequestType;
import org.keycloak.testsuite.pages.LoginPage;
@ -50,8 +50,6 @@ import org.openqa.selenium.WebDriver;
import javax.mail.MessagingException;
import javax.mail.internet.MimeMessage;
import java.io.IOException;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
/**
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>

2
testsuite/integration/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java
View file

@ -36,7 +36,7 @@ import org.keycloak.representations.idm.CredentialRepresentation;
import org.keycloak.services.managers.RealmManager;
import org.keycloak.testsuite.AssertEvents;
import org.keycloak.testsuite.OAuthClient;
import org.keycloak.testsuite.org.keycloak.testsuite.util.MailUtil;
import org.keycloak.testsuite.MailUtil;
import org.keycloak.testsuite.pages.AppPage;
import org.keycloak.testsuite.pages.AppPage.RequestType;
import org.keycloak.testsuite.pages.LoginPage;

29
testsuite/integration/src/test/java/org/keycloak/testsuite/oauth/AuthorizationCodeTest.java
View file

@ -112,6 +112,35 @@ public class AuthorizationCodeTest {
});
}
@Test
public void authorizationRequestInstalledAppCancel() throws IOException {
keycloakRule.configure(new KeycloakRule.KeycloakSetup() {
@Override
public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
appRealm.getApplicationNameMap().get("test-app").addRedirectUri(Constants.INSTALLED_APP_URN);
}
});
oauth.redirectUri(Constants.INSTALLED_APP_URN);
oauth.openLoginForm();
driver.findElement(By.name("cancel")).click();
String title = driver.getTitle();
Assert.assertTrue(title.equals("Error error=access_denied"));
String error = driver.findElement(By.id(OAuth2Constants.ERROR)).getText();
Assert.assertEquals("access_denied", error);
events.expectLogin().error("rejected_by_user").user((String) null).session((String) null).removeDetail(Details.USERNAME).removeDetail(Details.CODE_ID).detail(Details.REDIRECT_URI, Constants.INSTALLED_APP_URN).assertEvent().getDetails().get(Details.CODE_ID);
keycloakRule.configure(new KeycloakRule.KeycloakSetup() {
@Override
public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
appRealm.getApplicationNameMap().get("test-app").removeRedirectUri(Constants.INSTALLED_APP_URN);
}
});
}
@Test
public void authorizationValidRedirectUri() throws IOException {
keycloakRule.configure(new KeycloakRule.KeycloakSetup() {