diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java b/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java index 876dcd4cd9..fb6e120502 100755 --- a/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java +++ b/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java @@ -31,6 +31,7 @@ import org.keycloak.events.EventBuilder; import org.keycloak.events.EventType; import org.keycloak.forms.login.LoginFormsProvider; import org.keycloak.models.*; +import org.keycloak.protocol.AuthorizationEndpointBase; import org.keycloak.services.Urls; import org.keycloak.services.validation.Validation; @@ -71,6 +72,7 @@ public class VerifyEmail implements RequiredActionProvider, RequiredActionFactor LoginFormsProvider loginFormsProvider = context.form(); Response challenge; + authSession.setClientNote(AuthorizationEndpointBase.APP_INITIATED_FLOW, null); // Do not allow resending e-mail by simple page refresh, i.e. when e-mail sent, it should be resent properly via email-verification endpoint if (! Objects.equals(authSession.getAuthNote(Constants.VERIFY_EMAIL_KEY), email)) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java index 7bc45c6415..1f5cdcaf00 100755 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java @@ -965,4 +965,35 @@ public class RequiredActionEmailVerificationTest extends AbstractTestRealmKeyclo driver.navigate().refresh(); accountPage.assertCurrent(); } + + @Test + public void verifyEmailExpiredRegistration() throws IOException, MessagingException { + final String COMMON_ATTR = "verifyEmailRegistrationUser"; + + String appInitiatedRegisterUrl = oauth.getLoginFormUrl(); + appInitiatedRegisterUrl = appInitiatedRegisterUrl.replace("openid-connect/auth", "openid-connect/registrations"); + driver.navigate().to(appInitiatedRegisterUrl); + + registerPage.assertCurrent(); + registerPage.register(COMMON_ATTR, COMMON_ATTR, COMMON_ATTR + "@" + COMMON_ATTR, COMMON_ATTR, COMMON_ATTR, COMMON_ATTR); + + verifyEmailPage.assertCurrent(); + + Assert.assertEquals(1, greenMail.getReceivedMessages().length); + + MimeMessage message = greenMail.getLastReceivedMessage(); + + String verificationUrl = getPasswordResetEmailLink(message); + + try { + setTimeOffset(3600); + + driver.navigate().to(verificationUrl.trim()); + + loginPage.assertCurrent(); + assertEquals("Action expired. Please start again.", loginPage.getError()); + } finally { + setTimeOffset(0); + } + } }