libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

KEYCLOAK-11003 Remove UPDATE_PASSWORD RequiredAction on non-temporary password reset

Browse source 
We now remove a potentially existing UPDATE_PASSWORD action when
explicitly assigning a non-temporary password.

Adapted tests to use a temporary password when UpdatePassword required actions
were used.
This commit is contained in:
Thomas Darimont 2020-02-03 16:46:17 +01:00 committed by Marek Posolda
parent 74c379c3df
commit 12e53e6f11
5 changed files with 48 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
services/src/main/java/org/keycloak/services/resources/admin/UserResource.java
View file

@ -617,7 +617,12 @@ public class UserResource {
throw new ErrorResponseException(e.getMessage(), MessageFormat.format(messages.getProperty(e.getMessage(), e.getMessage()), e.getParameters()),
Status.BAD_REQUEST);
}
if (cred.isTemporary() != null && cred.isTemporary()) user.addRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD);
if (cred.isTemporary() != null && cred.isTemporary()) {
user.addRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD);
} else {
// Remove a potentially existing UPDATE_PASSWORD action when explicitly assigning a non-temporary password.
user.removeRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD);
}
adminEvent.operation(OperationType.ACTION).resourcePath(session.getContext().getUri()).success();
}

14
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/admin/ApiUtil.java
View file

@ -173,8 +173,20 @@ public class ApiUtil {
* @return ID of the new user
*/
public static String createUserAndResetPasswordWithAdminClient(RealmResource realm, UserRepresentation user, String password) {
return createUserAndResetPasswordWithAdminClient(realm, user, password, false);
}
/**
* Creates a user and sets the password
* @param realm
* @param user
* @param password
* @param temporary
* @return ID of the new user
*/
public static String createUserAndResetPasswordWithAdminClient(RealmResource realm, UserRepresentation user, String password, boolean temporary) {
String id = createUserWithAdminClient(realm, user);
resetUserPassword(realm.users().get(id), password, false);
resetUserPassword(realm.users().get(id), password, temporary);
return id;
}

27
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserTest.java
View file

@ -194,6 +194,33 @@ public class UserTest extends AbstractAdminTest {
createUser();
}
/**
* See KEYCLOAK-11003
*/
@Test
public void createUserWithTemporaryPasswordWithAdditionalPasswordUpdateShouldRemoveUpdatePasswordRequiredAction() {
String userId = createUser();
CredentialRepresentation credTmp = new CredentialRepresentation();
credTmp.setType(CredentialRepresentation.PASSWORD);
credTmp.setValue("temp");
credTmp.setTemporary(Boolean.TRUE);
realm.users().get(userId).resetPassword(credTmp);
CredentialRepresentation credPerm = new CredentialRepresentation();
credPerm.setType(CredentialRepresentation.PASSWORD);
credPerm.setValue("perm");
credPerm.setTemporary(null);
realm.users().get(userId).resetPassword(credPerm);
UserRepresentation userRep = realm.users().get(userId).toRepresentation();
Assert.assertFalse(userRep.getRequiredActions().contains(UserModel.RequiredAction.UPDATE_PASSWORD.name()));
}
@Test
public void createDuplicatedUser1() {
createUser();

2
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserButtonsTest.java
View file

@ -74,7 +74,7 @@ public class BrowserButtonsTest extends AbstractTestRealmKeycloakTest {
.requiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.toString())
.build();
userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password", true);
expectedMessagesCount = 0;
getCleanup().addUserId(userId);

2
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultipleTabsLoginTest.java
View file

@ -80,7 +80,7 @@ public class MultipleTabsLoginTest extends AbstractTestRealmKeycloakTest {
.requiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.toString())
.build();
userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password", true);
getCleanup().addUserId(userId);
oauth.clientId("test-app");