libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Validation of providerId during required action registration

Browse source 
Closes #26109

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
This commit is contained in:
Giuseppe Graziano 2024-04-18 12:19:20 +02:00 committed by Marek Posolda
parent 4f30400e07
commit 897c44bd1f
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java
View file

@ -1070,6 +1070,11 @@ public class AuthenticationManagementResource {
auth.realm().requireManageRealm(); auth.realm().requireManageRealm();
String providerId = data.get("providerId"); String providerId = data.get("providerId");
if (providerId == null || session.getKeycloakSessionFactory().getProviderFactory(RequiredActionProvider.class, providerId) == null) {
throw new BadRequestException("Required Action Provider with given providerId not found");
}
String name = data.get("name"); String name = data.get("name");
RequiredActionProviderModel requiredAction = new RequiredActionProviderModel(); RequiredActionProviderModel requiredAction = new RequiredActionProviderModel();
requiredAction.setAlias(providerId); requiredAction.setAlias(providerId);

11
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RequiredActionsTest.java
View file

@ -109,6 +109,17 @@ public class RequiredActionsTest extends AbstractAuthenticationTest {
// Expected // Expected
} }
// Try to register required action with fake providerId
RequiredActionProviderSimpleRepresentation requiredAction = new RequiredActionProviderSimpleRepresentation();
requiredAction.setName("not-existent");
requiredAction.setProviderId("not-existent");
try {
authMgmtResource.registerRequiredAction(requiredAction);
Assert.fail("Didn't expect to register requiredAction with providerId: 'not-existent'");
} catch (Exception ex) {
// Expected
}
// Try to find not-existent action - should fail // Try to find not-existent action - should fail
try { try {
authMgmtResource.getRequiredAction("not-existent"); authMgmtResource.getRequiredAction("not-existent");