From 942d5d0aa309839bf8b6da28367bd8e6adbec856 Mon Sep 17 00:00:00 2001 From: rmartinc Date: Wed, 31 Jul 2024 10:20:50 +0200 Subject: [PATCH] Convert chapter planning for securing applications and services to guides Final removal of the securing_apps documentation Final checks for links, order and other minor things Closes #31328 Signed-off-by: rmartinc --- docs/documentation/aggregation/pom.xml | 22 --------- docs/documentation/aggregation/src/index.html | 1 - docs/documentation/build-auto.sh | 2 +- docs/documentation/pom.xml | 1 - .../release_notes/topics/23_0_0.adoc | 2 +- .../securing_apps/.asciidoctorconfig | 2 - .../securing_apps/docinfo-footer.html | 1 - docs/documentation/securing_apps/docinfo.html | 1 - .../securing_apps/images/keycloak_logo.png | Bin 18350 -> 0 bytes docs/documentation/securing_apps/index.adoc | 16 ------ docs/documentation/securing_apps/pom.xml | 46 ------------------ docs/documentation/securing_apps/topics.adoc | 17 ------- .../topics/oidc/oidc-overview.adoc | 4 -- .../topics/saml/saml-overview.adoc | 5 -- .../securing_apps/topics/templates | 1 - .../authentication-sessions.adoc | 4 +- .../topics/clients/client-policies.adoc | 4 +- .../clients/oidc/con-basic-settings.adoc | 4 +- .../topics/admin-rest-api.adoc | 1 - .../server_development/topics/auth-spi.adoc | 2 +- .../topics/saml-role-mappings-spi.adoc | 4 +- docs/documentation/tests/pom.xml | 6 --- .../keycloak/documentation/test/Guides.java | 1 - .../src/test/resources/guide-url-fragments | 3 +- .../topics/templates/document-attributes.adoc | 8 +-- .../topics/templates/release-header.adoc | 4 +- .../upgrading/topics/changes/changes.adoc | 2 +- docs/guides/attributes.adoc | 3 ++ .../client-registration-cli.adoc | 4 +- .../securing-apps/client-registration.adoc | 4 +- .../guides/securing-apps/docker-registry.adoc | 4 +- .../securing-apps/javascript-adapter.adoc | 6 ++- .../guides/securing-apps/mod-auth-mellon.adoc | 2 +- .../securing-apps/mod-auth-openidc.adoc | 2 +- docs/guides/securing-apps/oidc-layers.adoc | 2 +- .../securing-apps}/overview.adoc | 12 ++++- .../partials}/overview/basic-steps.adoc | 5 +- .../partials}/overview/getting-started.adoc | 37 +++++++++----- .../partials}/overview/terminology.adoc | 2 +- .../partials}/saml/saml-errors.adoc | 7 +-- .../saml-galleon-layers-detailed-config.adoc | 2 +- .../securing-apps/saml-galleon-layers.adoc | 3 +- docs/guides/securing-apps/token-exchange.adoc | 2 +- 43 files changed, 79 insertions(+), 182 deletions(-) delete mode 100644 docs/documentation/securing_apps/.asciidoctorconfig delete mode 120000 docs/documentation/securing_apps/docinfo-footer.html delete mode 120000 docs/documentation/securing_apps/docinfo.html delete mode 100644 docs/documentation/securing_apps/images/keycloak_logo.png delete mode 100644 docs/documentation/securing_apps/index.adoc delete mode 100644 docs/documentation/securing_apps/pom.xml delete mode 100644 docs/documentation/securing_apps/topics.adoc delete mode 100644 docs/documentation/securing_apps/topics/oidc/oidc-overview.adoc delete mode 100644 docs/documentation/securing_apps/topics/saml/saml-overview.adoc delete mode 120000 docs/documentation/securing_apps/topics/templates rename docs/{documentation/securing_apps/topics/overview => guides/securing-apps}/overview.adoc (73%) rename docs/{documentation/securing_apps/topics => guides/securing-apps/partials}/overview/basic-steps.adoc (89%) rename docs/{documentation/securing_apps/topics => guides/securing-apps/partials}/overview/getting-started.adoc (69%) rename docs/{documentation/securing_apps/topics => guides/securing-apps/partials}/overview/terminology.adoc (98%) rename docs/{documentation/securing_apps/topics => guides/securing-apps/partials}/saml/saml-errors.adoc (80%) diff --git a/docs/documentation/aggregation/pom.xml b/docs/documentation/aggregation/pom.xml index af92b7cdde..778c61ef0e 100644 --- a/docs/documentation/aggregation/pom.xml +++ b/docs/documentation/aggregation/pom.xml @@ -26,12 +26,6 @@ ${project.version} pom - - org.keycloak.documentation - securing-apps - ${project.version} - pom - org.keycloak.documentation server-admin @@ -107,22 +101,6 @@ - - copy-securing_apps - process-resources - - copy-resources - - - ${project.build.outputDirectory}/securing_apps/ - - - ../securing_apps/target/generated-docs - **/** - - - - copy-server_admin process-resources diff --git a/docs/documentation/aggregation/src/index.html b/docs/documentation/aggregation/src/index.html index d5de0085c5..91ee2109e8 100644 --- a/docs/documentation/aggregation/src/index.html +++ b/docs/documentation/aggregation/src/index.html @@ -34,7 +34,6 @@ li a:hover {
    -
  • Securing Apps
  • Server Admin
  • Server Development
  • Authorization Services
    • diff --git a/docs/documentation/build-auto.sh b/docs/documentation/build-auto.sh index 35a1dd55a2..308c2924b9 100755 --- a/docs/documentation/build-auto.sh +++ b/docs/documentation/build-auto.sh @@ -3,7 +3,7 @@ OPTS=$1 while true; do - CHANGED=`inotifywait -r -e modify,move,create,delete authorization_services getting_started securing_apps server_admin server_development server_installation upgrading --format %w` + CHANGED=`inotifywait -r -e modify,move,create,delete authorization_services getting_started server_admin server_development server_installation upgrading --format %w` GUIDE=`echo $CHANGED | cut -d '/' -f 1` mvn clean install -f $GUIDE $OPTS done diff --git a/docs/documentation/pom.xml b/docs/documentation/pom.xml index aae4b5da34..24fe1917d0 100644 --- a/docs/documentation/pom.xml +++ b/docs/documentation/pom.xml @@ -35,7 +35,6 @@ header-maven-plugin api_documentation authorization_services - securing_apps server_admin server_development release_notes diff --git a/docs/documentation/release_notes/topics/23_0_0.adoc b/docs/documentation/release_notes/topics/23_0_0.adoc index 4d5d34cfdd..63db11f55a 100644 --- a/docs/documentation/release_notes/topics/23_0_0.adoc +++ b/docs/documentation/release_notes/topics/23_0_0.adoc @@ -95,7 +95,7 @@ It is being replaced by the Elytron OIDC adapter,which is included in WildFly, a The SAML adapter for WildFly and JBoss EAP is no longer distributed as a ZIP download, but rather a Galleon feature pack, making it easier and more seamless to install. -See the link:{adapterguide_link}[{adapterguide_name}] for the details. +See the link:{securing_apps_link}[{securing_apps_name}] for the details. endif::[] diff --git a/docs/documentation/securing_apps/.asciidoctorconfig b/docs/documentation/securing_apps/.asciidoctorconfig deleted file mode 100644 index 16c70ad6ae..0000000000 --- a/docs/documentation/securing_apps/.asciidoctorconfig +++ /dev/null @@ -1,2 +0,0 @@ -// show images in the preview when using an IDE like IntelliJ -:imagesdir: {asciidoctorconfigdir} \ No newline at end of file diff --git a/docs/documentation/securing_apps/docinfo-footer.html b/docs/documentation/securing_apps/docinfo-footer.html deleted file mode 120000 index a39d3bd0f6..0000000000 --- a/docs/documentation/securing_apps/docinfo-footer.html +++ /dev/null @@ -1 +0,0 @@ -../aggregation/navbar.html \ No newline at end of file diff --git a/docs/documentation/securing_apps/docinfo.html b/docs/documentation/securing_apps/docinfo.html deleted file mode 120000 index 14514f94d2..0000000000 --- a/docs/documentation/securing_apps/docinfo.html +++ /dev/null @@ -1 +0,0 @@ -../aggregation/navbar-head.html \ No newline at end of file diff --git a/docs/documentation/securing_apps/images/keycloak_logo.png b/docs/documentation/securing_apps/images/keycloak_logo.png deleted file mode 100644 index 4883f523023502c83147b99ad2693b840a018c53..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18350 zcmZs@1ytNo&nG;%yBBvaP~3{ULvi=wF2&u8Ly^HL6d2syy-0!LZiBn)H+|lH_MC5b z55q9zZ@EcslAHYQM5`*xpdo)i1^@tParGzCIIa+cL~0{~EP{{2D$vVepTB7(b|k`%%wEIa}i|1mMGBmh7GkdqYq;=O#D z^Ud#zX4Cn?X9-QFFig740d|j-^@X)Co9)Aiy%MOU((VsfA(j$tCo{Uy3vKTjw}PLoG_1`3p_M;|{w?p_D) z&Xu{{J*?POcj9jWVL~VnA+K!`Y<#Hy`H0K{D~1Vq;p+T55JJIF^Y6d^2SL?@^8bIv ze+l_L;{S8W|3wH6|IgDxpi%yFM_94{lK_YRKTQ1ZGyY5XFITYtC*i+rBL4S`{}TSo z_kWrA-vjwCp}{XT{pM46cz6+1J_%s?W#G6G86d6w<%|6=UHm^j4@(DiYLHP-d;vWv z3{?=$L`G07#Pn5uGt9NY34MU+eNkNm+K?)N12Gt^2Ut@xYkB<-4gQ8V&PCKwa;pyVgdi238dX& z)q%+G8pa4|?89`{Tb%BOE#e_U^hHv17?^vQ#Bdyhk5 zUSsorj8T><WNSm)0znCV-2ogcCAwaGR`1wBJ| z3bg*7P1RGli@=N8);OjF%a*LDZrnSGA;JF{~SfDCH4fB8I1kdO% zcC>;T)cE0!^6{}?2}3r_u3V2(C<^+ISqasIR*d$cTerQ|axcwC43S3~r4-fQ7kfu% zC8R}%Z&6l%#kc~zvDy(rX!Zkh{XHq1TVMeKP@-Zt8~k8o^AmnRP;xTXS5nX5zZDCp z2tgl#*W-YEyEp}9=pJ-HP&5v`2`PmQbrJOU$y{My?MQS|cpjg^jD(DrRy--Fes&X1 zJA~)fjN9_Y1sHCyF^l_YDqEBILXb|?uHk7QI-5r;!=c9~sE2zkY<4-t=ey?@!-Gc& z+F#|!F@>UrhKAe8Ti?eK0XAa!8=C6zGvJ@<@8K$js<%(06cg{f2tp4G^Nr7Nzgl$M=chL90P|Qmp^e08SZ(jB-@%EL3tUW7 z4o)5Xn1GMbT|8<#+kofl_PgaZ$9NpJ?w2uV^y#0yyqx=cfLiK1_`KKf!ouuw_181& zJby<%gaBTs7R(R?3E8@-jFP3zZh$jtPzN%ASYBS5PfJThq?3^x5L09qlQoBcS@G(+ z@k^};pIcC@(dv|H^TlWK8~LPe{CArv3|MrS#8W_x^UMH}X6Da#W z@!LZY{E~?8-S4$SzoDgi@V?vT;OJ0Ol(GN&bSQ?s%M-u6g7qGR2(0x4>`Hbx@iN{* z1$Fl>N{_tZjsM`+awMXzS^sAJeDvAhC&B9|AdbT%uGd#&zGs9qFDCH9x*Pr?I=WW- zO6h^OTIW&NMLh%|AT_*7c#2ssd#$KAXXL{*C}WA_^yKiEcR#G)~cQEQVM?D@e~ z-2ty=@Y>HS&*z*}>{uusI^scY=p}Mu3yqRfFcGGbfgfn1MSr{QzYJ0?7-*0@w)1ZI zjZ+NNrDbQ+bzZd{uVU%4bzhCyM<<5YuJfwt?*X;f-Dj2j?PJP=0T+mXciP38Cwd!^ z0Q4Fp0De3Rqnu6QMuW}ueV8cttILlT1CxP+KSfQV5%pFR%cH<+Bw+pepW8FhY5{0b zqZ}@qzMM>^D#D`n!oX@9y}mL-wYl7S>nX)-Zx+^^N8z7V*35ZoU#1Z0rL=4gL4HFA zVw0I{OC(l=(nWU?h+7yUFE!>>8btL{i$&H6?Ky4QyC%;U^pW8r3k4D~d~^&|j-!@+ z+sFVDMSXY`ErpAmB){BOy&`AFbl49n0S=_}7bip*tLtOuEiJAeG&O1SrtT2{8JOHq zmN3o~yC=JBa@exTuyGvhN;rJrTM4)rE_jT#$*Fr_mq>xg0ZmmMIC@3H z1>#g~kTv=b(6u_1s5GPbQ}Pi zof>}olBdHmfFbCf45e(|bJ!p?M#M@M=4~d)AE*Rc$As2J6v}}FhuP4=6`TO_cH6(@ zYJgos03o-{%s^bNt;;0u05*c$XDL2wVki^mO_(|r>>7cu=`}Gas@}tH2FoZO4mjHa=bFH+!g}Mdbd|BjlVJqny=0v?9(cC|?gDJKtK(_oKVeb=LJ@lkl(Ko8RBi>~2Jrx* z?QytTb_>czojx9<=I$(f9U1cW&YPit2Z9PM;W{P>koF_6-sln)F?yKRhyO(~ioU9l z0GM>Wp=&zW!-bZJck8sb$4uI2#?#v4bK2PbR_=R$_I_5}vJLFF3GM5{7{sBjAZ@4d zuuo`^&Z*GLJ9)NtI{@Q68+;!Xg>u2VKghI4u}n1@*JMhO+|A#P=s}KQX56BY$0p1t zG#`GtKR=IYq+{Xg?_*Nj^|UDr=86AVo-`e!UA2JTS`x$YmYie#gZ7Y8X7KNL^{zsg zfsM?F^JKV6h|u$iTP)y#l0GbLLJFA@7T#gKLw5x-qnv+0#vR0#^7N8N?kf~{x-8<~ z$6z?h?^JHB0eBeDtRUlWwf#%o?WlgNdC`MaYt>oqbU)S?jsbdRL}VE{tn%JwTF#O} zEHgIAvU0Z9#BIFVx=MS^38*v2@(l#A#MmwZEL0J6m1yZOMH`6w(jqT zmB<8be7v>P8&S!yzqasv4L`G~$iz2^D&|>Yw~>Q-yohM3B5*eIIHcKXmiY{ldB2s| zkm#s2)s3P2NaMj6p$x6o9ik@Bsjr>pWW%cD`Ip%0?5U@3Lz zDz5ygL0Uhl!yvq9jtif8RBVBT7R%77Zq*EHog{D!swZ#E>tv-lFo#91sc7D9@-_7m z1s)go3;*MKgeeV>#vBRcyf#!Jh?O)Lyg>Vvch*6-*23oZeC3LIyv_a9c(o#3*bTlz z1;pK;!f+|=(ETh*iKzhRP9ba}Is?(+%8@$RB>6HTB&KBiD#d5>nsin4^Gu27FgFpInwWYU@*`l@yAjbHM*x8 zM70eU#1=f*m0%S60kd2oTIJIiU>2*uREs6H@hdz>VdE5JP~Pof{Zd&Kc5AqWrCp7K zqhsG@Uee9AOA8PEE!0Ww9j+cq`U?RRa!fw)Zw|U%W0>`a?HH@KCW@b^tGP6Hrz_pc z=|5{36%&D<0)~S^-WX$<$tXd|ND5iM-mpRTQm|T7Riv&;{NRq|AsHk}iz1k9Nd_Jx z9i2lTXAk+P2DbxN-g9NDst6eC$ez8*PvR#Sjj;Kgl+Ns#BW7{g)2QE0YKIq~E~0^M z*myIA(ZhvNmEQ8P>D4-yQa+X1FI5M%e@eEtdfk5*7K@xNrEH=yptTFb1}e_pEWgH= z&6aeVWJR1xCDDurBph{`SS}$ipmT9$_AGb#58GBRRPZ(8B6&sJ2Y`Zk(PO9J=-XrT z;laS2IMLCx5GsX(PQISztcUy0#y{XZ)Jicl@U?B~OyC5~`<+phuiv^}V?i+$2etjh zAPZ5k_tbd&1r%mOg2qK!d>y$lX3eBQ!tOsMcy`ke8-QPKGU~iK5)h|gTk_aq{Tp?~ z9h|5Jy=}``Y^pFF{Bf5W7X34;$*66_wk=Cgi<4Sg6uvL8cKr}r7m~sdPx6o3JqSfi zbSe0<`E80VtbE6xo*Qv!snL{!s2CLnRRW=Zx|d5SpX&hzXy@5wx7=`ejA~e)<06@C zk)D>e)(x_6ttgesRy4UiTeI_vOVb-;{vM7nP^o2rH`$7Wfm&z%%aZQ0;&BZN&K8l@)mJd}UGp}X86I1IL%c3ftaDpjKEla=CE9t1=me>kbzVOfLjWAH4=TSUls8U%jYF6{uF6eZF=0I$Ok?0_c!#^i2DoGq@u zRX%)eJpP0AF>(cNh6dX1{jEE2>kF-Rh0a^(Xz-56AQfhhi_=5$D?kor_w z^dS7MM(;?rUiK}2EH!5h-~DgQpc^p?qBY)pm;W<8L!E`MI4wYwNZ(j>x_i}8@Vf_< zsvq8%dKZr-Gd_6LY7suU*`wmN1`XE4ypV&bgO-q5$K-appm{Y@$KWzF(aPGBUJ`)h zXo=qpaN!nWsp|8mPRXBBw7@!QHWO|8^n7Li{(>V|-7l$uT{OR_K! zF{zqDQcn@F3|E&TDlE)2F5XbBX@(Sh$zZ49{(&<)mU=;gM^!J}iHn5;V>0a!!!wp-I!gL*m$J>sd+TGO5S zS1v^znR7+WyI#v4^e#gh8mq66k0R+U@|Eers~?7-qK$g$SaD!?4mL!|C5=sPceF;D zra(7FKjVhMGVO<<=izDDT;tx9a{w%#--o9+76A4p6%xwv`#?QXB;me6Apn!pU1^tG z8Yu?!zS!iD4F!$bHGghgKqq2hILQ0H@Nql*0@1(D^g+lF?i!MS?G+F(8m+a z>s{|5#=s4M*2*vxF7b5=mj0AHa=d`}4=C}cT7}iI$dMyrKePKx#dD!5D*hJd{UwUT z5eOyGw66dkilQ6j1HS$xbRv^bj`3_&xl`b{ zHK(6%II0s+_^Sf;I_h>a7hBC$FhM@Yz55eWAehZ&0FBprLJtPXlLRNYc9_f*dWwFz=^hr!Ny;Rk=lZs0-lEcZ)i(QS*D3A1vZ zxy*Ch*KfJ#9d+CP?K%O?B&R-e`uk!7DJkgFJkOHwdApNzz|r>Db+daca}bvk*4@$4 z4ph?53eAe1n^$8b5s8&12Pjw9@Tybr&a}u1zZh1gc6IP!{&%EG+S>C+D$!m$O8b5- z)*@(b6m(ehXy#-c18(dSwF;>r9S@DD3PmtP46I<1a%u#{B)MqVYuv6hcU7tymUKd8k|tXRQef(Bqc(pmi4_DV32Gm+-dLfpmUJcPj+`wAwfOfZ`+nc^;SXDWp#T8A;4N;mkw-~9ciZNlxyAeOG``>VY&?sq=&F|g zk1mMo8^^mc1b!V(@pkqT5DsiIv-=M z?s$Th)R`yF!&ama55lFbF+z)TCsCd^Ht$B@XNQQwzP*nrVwwq#!XL0Hn>^fF*&17c zN!;&Ymo?uEPb+66V%ql*3-rsE!=X=wPLl5njVHBsom_&K0ck4`M_APmr&C5#oOE6U zBOtWtj>c^N9$NIjpBmwHKcy&|Yf2MMPouW9WX`fr0^$eXKI|lb^Ssu-@d_r@@Cy9d zyYY_<6Ip2+Z|yTBI;+WaQk}EKo0#CIGf1bk%6d~a-)zKe+6rv6mpS6Vxr&Ucae9Aa zqv;*la9PgCQ@?Y1eKMTKrsLLbd3!qcomso6OSM&WrbNEN6JMb}0`x+@Yo9Z0z zIMoC=-}1*@`&CK*K@y3JoE}zflJDsP$Zln6qI33SB9Gf9NJh2MZvi3fyXb}()qzye+;2mq8EQC$;N1%E94K%lqljA_p zA*ZdHZ-#Zj!|&N@YlK9cD0hp#hs)44zc#rPI{U2-(?|UV)StN4wxh{EyZ2cZrTfLA z)Ley%jKj+g1ymMCUEh1+C(^HiafPd?H9avQQYp3ZZ~ch=V9<9|F~Kq}BMl|bf) zqf~f_%z5QjiiWJB<7`iF=!+a_nc;@6#K;obn0BxGalB9!NX=6=r-nWtPVYwv1Ja4( zK!kg`5a?62BQ9 zi32HV#wsO!RhuexHg8eF)2JpaXA{yYXQb(gi@wJcrX8m&i&ElRm z%vnma+QHT(4L|sAr|&&|ax^V-sCY&=LKi;z`1D75V(4$A;Z>bIv2>)0(65Eh=c5g%6YI^I`)0Je%NYsaVNH-p(47QYDik zpcVx@Sy>I6{E}Wjt5nB<=zDuJm}9_36!UotToc&M<1@-8J7pTB{+O&)W{o?Wgn#%F zZP?}8n=KyeezsG>IBS}8*84vn&GYkD;waJ7!q4iYc<=7M$a#9d8 z#8oR*HE}vI&JrWl@FsmJ72mdL@e=68Yv5b;Kipuo{$-8Woab5)-K}*;BY#Aq3x_UYE;*8EuG2IF~q9v3rX&fs@Rmh+- zaPBigk{HEO4ENKQDM$t68qM=yT8)pTKas?WnMGpS)^duG!^hGli|*y~3WlL&ZSV!B z2uwmyfBO%OU#QOBy7Ax3`Cw*LhK=$5IjmB*iNq)JO@+$u^! zg}_kbW}Aq4^;IL4nsSCAoBZT!_4=YL0ATB)9Vt5lX?4mahb?=z7>0F+s`+$}pQ`b> z4K&!yF4*Yxcp{Sw5&kN-_NR+x)`pv3@AUPG3bVw-(oMp-aWf{xK_B1Lu;8Q1aKZ$b zD9c#Ys#oe)hRg%&Lrp+wmUhwouiv1ye95lp3E0UWL-*S68VI^Le}0jn*iw*ER+avd zAm!4i3;NBNQG(P~6-t!l=gnT|yB8D^BFOnuqK#47kWA63;fd(qVwr^PE%gM`OlALl42t=cNJv9v%;a>>lB&4d7trMkUzY!^1& zHv3N)x;m8)Msjt27I&b`b|`?=R935g^6rtOc}&&u_kBkBiOFj)n=`kC#EgUZq@Yp` zkH01pqyXBpb6I6vYxbCvIZtnhrBe+tx9T>JW6z(1%8Mo@6j-I`{W=r8zuZr#NYb}* z@8x)5=k+7g#Zl-;`-pr0 ziv?)(IBt?QB|6coquM#})34A)9ybBb8bYSI@M)&14!pb#j0;{a;ZdbV1XOBP{NwbC z_)lkzri}bKA_U=x3qe!WY2BUprW<$9*Ls9X+xgr~8Z5!X#iJM&-+sNNXMRy>DH|u` z4QBED$bKzQm?^QlA%esLG3tw{8tn(9&o`T1t@`Y}G%H_wU5k_Uu*HuE4Ehd@5x+Gu zj$1+eSOp?w$?XDdOgOSPpr`G+n`Sh7+wYn9Pkxc@fHqzCn#(p{`s+ z=RsW1CKP<$qj~p=bqTb}f)#hhDr!G~iEniHnB5bnB?k3j3nwtb6xP2?yl>j}(Je>? z0TK{O>dfP3s%diC=voF}e>=VH-y8the1L_9n&x6XfUP*LdA>kWFeM5Q zlJPVBOsP`cygl&5?^c3uYiCDI=bn|DW*jw-9l7E*0Mbc?@gqnoWzW2R&YQI0MPBKl zQs$)dowC^C0%jt5ce=Hi5{j}4Obqj=_JsT1olOvum+pJJvYX~y*8fL=O0(PZnYcx0 zw2MajfL&YBtjJrYQE#koAp%#$e3S!uNS2a_k7LrK$Z*64b?!?70E+ZV?K*7Uuz`+N zw{i>J#~B}elb97sV&DiH@%JjbdzHL^zyP{?P8qoQZ;y{VC!kdi!$?sI%zMdo3G!IM zCa;5OsGbG+gXKaJoR7Czw=h08D${dgVOJHcqb;jJ&WjOFT<}K9z5R?N9M~e~M9Q0g zIG2#%s?$#Uzl<@ww94A)sm^_HjKUBH&|k_atGih8Yp4vJZ3GfBX`$W z12n@-kvj~B2Mx`N-bfF#!d=>K-a}CmqSw|WML9u1LBtLEGMS~B z<$UbE-qG4_sauAR)h5<2=G{ERXMMK%tt!Gk(cq%LaPD`ufX6b52vTs`FXJ%kk%;DZ zNfmyB=^=#f5xknVF=X$_W0*z?m>+lrd27;IAxPUNH01mY?9$l-S&gUlOnfhw!HXjA z_757?s=tcNrtY&@E(gtY2qTZU?sqhgI%@6%)7Ir_F&N_hRW~{ug_~h_3_4~zgp?IO;%=P0O zCL9wt+4YD3Qufo~{#(G#%iWB>ss^BBGNadc=Lah$;oXujEefS>|e5(s>^I9^| zLX~D&4Z%^!PUqpTB~;BHl;j&FD^}c{hOvX{Aj;qw{rnj`O$7Zm+=;%(P*u z;>GYTgemYhJl|2klR4){I$!BU3J@bqh4>ww{E5H`d%t=<2zg(?c5hU3UsS|kiOr8m zq63_DBS~7?+(O)Wb0ava<88J}7P{wn?!;p7LpX>nQ$tJi=Lm7<{oX=Njx_;ocbHxG z4wcY-(Lc?xgkYWFxmc$~C6`zeoWX+aq}lkFVu(GyN`D?tO0;c1;;ws3;8Cj2cuPxC zjlyQE)u3*yysWb6*WA*q8Grk~f-#&tRHday@hmi@H|f5Ol_{aG}~h+@^#~Y-nf_+ zzbb$HV$I#;_?n+Nt%s#x|MH{FzGc9T$wD(9DUW*HepGxo&Ot^xq1P(_=Iyxx$Be+Y z!@0yzd&`&2-fd_osNa0Q0UA-S9#=~4nuAfRJXgaLyGK2L#{aplH<{B8uS z1`osP$2)Qt-r{wK32x~vXBwgl(DzDRUSmaj%;TT78)})$T;s`veawxFvIF`2H&%Q- zg1#G**pt%4Jwp#i^iVw>!L(MLRMb^%N4!L7 zMC%{JdDm6n)TIW6YBHLnlZ!DR)398=R$WC`w6GBtX&8U-pT%j&u}3;H!*93KdY^gkxR#(;KJ$%p9-#j)_sV+yD?ll$y3BZ7-kU5zehJ*sLdvV^EFMiebI$5jOp4Ifm*kb-5 z-u~&(r4NLiRhH2eB_RDn2|8eN4E`dCPdPf?7R()+I2Q8uO3hggL5$1>_=ZBl#46I-^o$C62|H4| z$FWRGOnD+4<jC(K;M+t-LTN65DrJHD1m8lB8Uw}-}ae>{Qpvi4VJnps! zqjLr6_?-%SW>W-PRAd!W?BDGS%%TEb1Of5Su68&PmWWOW>XE1kWl=0r?3K`9=Z5^i zclcphh#Iw_5?9nY{rJe+penVar5cG*NqrRXD6Ltuq9rwppnx+R*}Nht^NRv1LYKSC z^tr35M}8}I0yy(6E?!QQVHu+$90zD#wMvggyucs0cu-$H2~z?4+*qg zBYl$d6!MIOZAK#KVdn5w+ZjC!X$;(?{1%w!uT(Gz<>jTWgE4!d#B+l)wC%#{Alljp z>wb2zg@%Dx-Ps$Z4E9>NdXE;exZR7be)CmAl9C3_FmpbCJ5iY72T4D9;ftz6H_Jrq zS}WGi-e34wBv#IZDJXQpMYI(eZfsmOn1M|rV}daTcFSCDu~E9>QF*fJ-8zBH3Zcq4Xn2*4emp(BoNOw1BuRG` zx=#=)3;#gyFn3f5|Ek|3__qE1Apu-op~4?vQ3vVNe5q>rxrdO0EZEWg3oJ_NRr(cM zxBksT0Kn$Y?2SLY6Q0sa%BoX+wC!2!ZKWjx?>O1Zej;^|06q!OG8iQ=_?%DSxWdG6 zV2lcoQU6uhm(%Wv;a;~+tWz%@;Iq}!(N?u!E&MQg$m}(^^15o33O%X2UZRxUB^%rF zDXw;_$uw)oPDd7zvVQQX1J~S@CzedNb6GPmYma&CN@>;`(ut~I#Fk@P zv6EW^+?8PZr;nSF)T2W-KE>&rjexNFohp-QzgZ)nb~I;G9Y@pW`cXofyszPI(m-t8 z%;}P$@9n#|wC0P_~9ZHmb2H8z^W~#c} z0H0YodjC2e`^5|h$`EHGyF?AwH+hFK7NmG}o754L3^C$gq7q0C_6r6qZ6rqS2|Jo<^$mB){uR7$JsgsBhdr!>f%Zw#uzsWcCoxX3#BKhl( z(hG3=usr3W69TNC2k%RuVF{WpNLgJxpKOXko}Rsj#8V0q?tRed>pdfG=ATSIU2PQH z_~Z46gv2`eP1!Yg?~F4wHI7h`hEWrNw~vt32LeO=UYfUlGh_VrY_r94Ij0dw)MdIe zgh6N?sW?lR`g;Rxe_hX3_sL;A6Z4b&uB2%(#UGE(;K4Pnn?lR+9}6G|SgU7}lf_t# z#~D)9G|ryWK?2Y$UQE7)6^+ZFl$*qH;Xi&fP!r}@GbZ!<`bSiLqQjX~G6v-Q5aOL1 z8B?eg`^w-FxO+g(|3IxO_I)|7%BE8R0?BQkBU9FEHM;e#(!w2dD#dV~j4pX>{#oD2 zeE3p#T;1(Bia<`1k(P66ce?A(cEQdt#<4ZXX;!UK84G4y1%dmZH);>0w-$Rm7M*$m zwUL@QbfJn2tzC{aD+E+MLUKA zGn|;m{sM=}9~o8|i^4ZJv8V@%&svIdd?7sUnn#uGSCn_zWlbYBLtXA_4b&N-upYx$ zw`|@PaP583JOP8dtPCL96Vq(=`);_X;>!na$5lg3Na47=(eB+n+vdX*4R(5J)-BfW zokSRb8v&cqCn>cw)-YM(66IDeuZ~!45W_eaxG_jbY?UQ_E_sfJnr9;ZX@fCg_<7*> z3{m@zPB0G_CVctw2$*Mep})2U0PyQN8N3EhF?&?JPUUiXwHMfhZZ~D}xwI(SI>H9^ zDhU&SSoGDnzg?vYGE}bp=BL(r4z|hay2PP#G_HS2YUqefK7)SR&#q<@d4IWf*n5zt zvA1fP-KrEIvV|RcLBPrXE=H-X)b)CUrm+c0%6`a1S<%DI=P@OqK%j_AaY#oq-o+Ke| z-vG8Jc1Cv+f|xNzc)e@xX7yZ3_VA45vb~ZYE|HUy8%>^=5^{qpy74Nz*&5L(h~pp! z91}myQbaa-g`Mq&aojN=?vLXha>mt80ZM2Y+&YYY&`+PFXIEPd^ zB&J(WWD&WMcz^w~?Pr_SDG9E27G{hoY-fb*4ziFVv&42~$i1D5nng!7>=x44552mo zV@)~B6dEwr7SytEAzO=Y2nw8TaoHgN8Ma&H9;39m6DXUSZpr-p`!_z)VI&O{?(jfI zLDpoNl6x$_81YJfw7J(`I{0yNG<;|2H0=B}^2B7@_H3rfM4*`rc%$9&as}lEH4=ZZ z1$}%zJbVHvso#C>qB*d3=gIQd^XFbJIgZ_y`lcM|BtII3#VecaH{!Xu35$~i0UqVY zA?l1*GN@x5`u?boBNsVS23$d!tCSnl0Lgo~3UgF*#e%utoJvK_rU#*l66XqKnbw*H z;oaGo>g4M5SGpFucT<_1?J6D5s@WyMp9vAmlyMD3*00$oqisGoEfU1e zS35x$r14EGJd6-I?WO?9|HO|oS;Ro|@T1DM(w1wyIAti|f)F zQ2a@2t#k!RXx`I;FI&>$E0k{fE1AkXT=bcg()E$|e5&`k6yjDLsF;?bgoU~2G%d*` zHgtTyCNO8}jP%Q2w?>xnlCL5Z1zb`En>8^daO-aEpzPo6ciGk5Mmt0P1YXl&)s=HC zr!{D0=m5M(mHrKtn8%}Ug6<*al!(q#{nlp^$N5@mW6;;rHyWL@YdXaGhj zDC+HO=p6&CuQw4z_g{y`b0udoLc>?*D|e~4fM=MNHzq2rvj?|J5zROOHq~P#(8ygn zQAfmI0rAo5cZT2--(Qhg+A2b@ZuHw{%dt*>2m-`@tchT1p`w=iJFHMH2t{7uJfR)t zdNUNG(mamw@`z)ducSPe4Lp&pkrsddx)bu)jwdBN)8asX=2&97JCTuOHWHDjIelJ@ z0{4Y3puJhI)m2JUOY6>oYKMigSnVs7;jF-huwzGsRx2Hjjzk1%rU|{hL>W6kUg7;VbkkJ=N`>IkFO=Hf!x?=c9K=zk9HpG1Xu(e;V!PQh z4gtRGOY0~ENh``*tK^2|7!l`En8l&{fOAfpw18z@k^17X>dRd=5Qsk}VFXlTV`ILJ zp7+eS>$R^8YImdU?ntt|Tr!iCBz|M&-6&M7#NJ}9`IKATIRu^Zpu3gq9+yB{H={Y( zRz;86M1n6_Uan%+o?E7am z>BC7^+}hkjKNKPxu1Hz2>+vV?#D)^nVCyRD*TSQByg-Q;KM83IF=-du%t-f@7o-J! z^o5M}aenxN^+3|Bcq~VNkgx+nkTgv@w-Pn(p-~0Fr#Ozyo(Xp$6}i!<&&f2WvNUyl z{NS1Ig};u6<4I?S$E>l1OINnb*GrG=(-8{q`aq!ExSEx@B2H&#?oAaUZ!Q6?G;&tEI#i!Zj@#ya zA&H4H=AKm|%B41xty6FURU|+Nov=u;r+i2a-Yi``!+#-+!*by1h z^B82ljtuf(PB#p8fdurT!Y*wxwha8fPl}TQnVw>)%1L_>f2|+}z!t-$!8zG`ejmDV zjxehTJj`{gVxP1>-4V3;?k4`V6%(dqtJrAvq|QXAk-K6pw;ssg@Y4BQ`=PqJowACGIxAAcX^GShvNqwG*_rqthFIX3 zpiQ+MgV_hER}4Zbka$2pu%6or-*v;hcM7Z*k7~YJv=;Y zmSVKNs6cGSdN`pzmP#&JG=1-hTrNF0>}4wifk<&9@O9yRZA)In@o4l0vhLMxH|5Vv zv=+6KgKUzdc2*~_GwBryue9$zpHUgSwJ-{BLPXU1(_JB8K)E2MK$$yImps`QBHEhn zW&&wpcUM&fBqMsM_OqMi(jiv{2|(O~VEX;#n(U91m}&XYAjE-k6~l$1WE0*sag%|l zt-U&$`&638@q?y=UyF+B^L2%1iI%q^99~g_?efhnF}Rvp_|6Tdie1(-_)?cQcitU> ztL4^MEFXkbSJavTSZ+1qLY3Lgy31ANa7p+j;*vf#lYk_o4WRbJje6 zxX>nnWvy2jfi2^g67WhN|LwXJ5%7F@*Z?WhjE80W=K}}e|5Y>uVA-`f`s1#0qu~+ftg%#f^_k)O=>yA zTZ;vgUeD4r8c_=D>A!w`%Iv*GT(5uY_KKBOA5Vv=MSp@~#{(03Uc{8`0Pwt%RG?RG ziP`Fa3YE@RrNpDKL9mv6C<7nyg?}hdSr1FMjs*sj@9@Ug(Czjwfn4%#^HY2;Cd}MD zWJQM7P-ss}0CLd^*9t`%4*%pJ#7^9InhM}wn%kLy6e#k@1w9p;1m6@@j?2n=gZ!FluK4%%$F*gZbmRkiwf z0X4VN0M2qZGPIK&`3!o6&pa>aNwA?VZv*_8(5HMo(GVQwq+d+o6BNL);}U+s6$@ML z16*nx1Z5KKJq6hfJBk%;00F0^O2BjY-274pFu(y8Yc9)zVNKXAZ$4}~qnm@qmqO@! zr*VLcJ;Acc7GrfUY*cdOI6=HaaYXflX-&+d1PaLpBx9imMRAY9M*M{}->53g1cw%p zuz~s84YVI2tF8yXN*=z)c#Tr!vg**fy0k~&wHf}{;|N20jZ3{*ooUwQrMJjd4@@1X z1Bs+*D#Inuy!7rLEXa2Y1|uGTZb&8H!z@>auglbN3I0^*?<=%Ej;qP4%#{)OZkc5z zIJt_x~-mZ~DPoTUW1sCuhEoKV2v7mj0<3`g?Jalf`uB^CG9G)&G`atMDE(qboXyPL z3o9P1_0DH=_LM1de0hQM%(}fT?_RF9WV~);db@Yk3dlJISHWBBJ5rbURL$t>>RQi` z(0KX#*>#qD_V>T9`tbGsHMRSvPS-w`^gh2}mem)V8iSKThqQHoJtMuU*P7c`B^h;T z19zmeWGXUgyI8X5YV=)teR%u9aAmO;;|CuPPQ3il|95Kr7WO^y^;th9&#nI@P!p9~ zQ+qYiCaL=O;rY(L-`f>0{!QQfyBq&L*RFRe>(!3*H46&~ zkvWhDK661gAfa`}`(wW6>*Mc;zjpWMyW%=y#)H7W9uM?FE~~hpJ0fIi1;DO@Fcl(=b=7eYB?Ce13F9KkxYK1HRONQix++7Lzth)W$haMRtgAfulMg!Bp6Z(ZD=u zs^zg7p3`7^>lf5o=k4d0bM7-%Tp4Hdenma=ju^M?>c1_#lEIR+rdWEw@aOtuD}nBbwN zm?#KJ>L9N{k7GeUY=w%aufPsl!8kPrcGwEW=__zo!BoHnV9vx4fSnoxI|Akr%YXTr Yc_&{j_2)SNJXwdq)78&qol`;+023O}B>(^b diff --git a/docs/documentation/securing_apps/index.adoc b/docs/documentation/securing_apps/index.adoc deleted file mode 100644 index 1540014600..0000000000 --- a/docs/documentation/securing_apps/index.adoc +++ /dev/null @@ -1,16 +0,0 @@ -:toc: -:toclevels: 3 -:numbered: -:linkattrs: - -include::topics/templates/document-attributes.adoc[] - -:secure_applications_and_services_guide: - -= {adapterguide_name} - -:release_header_guide: {adapterguide_name_short} -:release_header_latest_link: {adapterguide_link_latest} -include::topics/templates/release-header.adoc[] - -include::topics.adoc[] \ No newline at end of file diff --git a/docs/documentation/securing_apps/pom.xml b/docs/documentation/securing_apps/pom.xml deleted file mode 100644 index 6d8dce060e..0000000000 --- a/docs/documentation/securing_apps/pom.xml +++ /dev/null @@ -1,46 +0,0 @@ - - - 4.0.0 - - - org.keycloak.documentation - documentation-parent - 999.0.0-SNAPSHOT - ../pom.xml - - - Securing Applications and Services - securing-apps - pom - - - - - org.keycloak.documentation - header-maven-plugin - - - add-file-headers - - - - - org.asciidoctor - asciidoctor-maven-plugin - - - asciidoc-to-html - - - - - maven-antrun-plugin - - - echo-output - - - - - - diff --git a/docs/documentation/securing_apps/topics.adoc b/docs/documentation/securing_apps/topics.adoc deleted file mode 100644 index bacdcda71f..0000000000 --- a/docs/documentation/securing_apps/topics.adoc +++ /dev/null @@ -1,17 +0,0 @@ -include::topics/overview/overview.adoc[] - -include::topics/overview/basic-steps.adoc[] - -include::topics/overview/getting-started.adoc[] - -include::topics/overview/terminology.adoc[] - -include::topics/oidc/oidc-overview.adoc[] - -include::topics/saml/saml-overview.adoc[] -ifeval::[{project_product}==true] -include::topics/saml/java/java-adapters-product.adoc[] -endif::[] -include::topics/saml/saml-errors.adoc[] - - diff --git a/docs/documentation/securing_apps/topics/oidc/oidc-overview.adoc b/docs/documentation/securing_apps/topics/oidc/oidc-overview.adoc deleted file mode 100644 index 6b566c7978..0000000000 --- a/docs/documentation/securing_apps/topics/oidc/oidc-overview.adoc +++ /dev/null @@ -1,4 +0,0 @@ -[[_oidc]] -== Using OpenID Connect to secure applications and services - -This section describes how you can secure applications and services with OpenID Connect using {project_name}. diff --git a/docs/documentation/securing_apps/topics/saml/saml-overview.adoc b/docs/documentation/securing_apps/topics/saml/saml-overview.adoc deleted file mode 100644 index 59cd9c535b..0000000000 --- a/docs/documentation/securing_apps/topics/saml/saml-overview.adoc +++ /dev/null @@ -1,5 +0,0 @@ - -[[_saml]] -== Using SAML to secure applications and services - -This section describes how you can secure applications and services with SAML using either {project_name} client adapters or generic SAML provider libraries. \ No newline at end of file diff --git a/docs/documentation/securing_apps/topics/templates b/docs/documentation/securing_apps/topics/templates deleted file mode 120000 index d191264115..0000000000 --- a/docs/documentation/securing_apps/topics/templates +++ /dev/null @@ -1 +0,0 @@ -../../topics/templates \ No newline at end of file diff --git a/docs/documentation/server_admin/topics/authentication/authentication-sessions.adoc b/docs/documentation/server_admin/topics/authentication/authentication-sessions.adoc index 36345b106a..bde07e7b93 100644 --- a/docs/documentation/server_admin/topics/authentication/authentication-sessions.adoc +++ b/docs/documentation/server_admin/topics/authentication/authentication-sessions.adoc @@ -19,7 +19,7 @@ authentication factor than the currently authenticated factor. In some rare cases, it can happen that after authentication in the first browser tab, other browser tabs are not able to restart authentication because the authentication session is already expired. In this case, the particular browser tab will redirect the error about the expired authentication session back to the client in a protocol specific way. For more details, see the corresponding sections -of *OIDC documentation* in the link:{securing_apps_link}[securing apps] section and link:{adapterguide_link}#_saml-errors[SAML documentation]. When the client application receives such an error, it can immediately resubmit the OIDC/SAML authentication request to {project_name} as +of *OIDC documentation* in the link:{securing_apps_link}[securing apps] section. When the client application receives such an error, it can immediately resubmit the OIDC/SAML authentication request to {project_name} as this should usually automatically authenticate the user due to the existing SSO session as described earlier. As a result, the end user is authenticated automatically in all browser tabs. -The *Keycloak JavaScript adapter* in the link:{securing_apps_link}[securing apps] section, link:{adapterguide_link}#_saml[{project_name} SAML adapter], and <<_identity_broker, {project_name} Identity provider>> +The *Keycloak JavaScript adapter* in the link:{securing_apps_link}[securing apps] section, and <<_identity_broker, {project_name} Identity provider>> support to handle this error automatically and retry the authentication to the {project_name} server in such a case. diff --git a/docs/documentation/server_admin/topics/clients/client-policies.adoc b/docs/documentation/server_admin/topics/clients/client-policies.adoc index 97d9202dea..c40923e340 100644 --- a/docs/documentation/server_admin/topics/clients/client-policies.adoc +++ b/docs/documentation/server_admin/topics/clients/client-policies.adoc @@ -37,8 +37,8 @@ Conformance to a required security standards and profiles such as FAPI and OAuth == Protocol -The client policy concept is independent of any specific protocol. {project_name} currently supports especially client profiles for the link:{securing_apps_link}[OpenID Connect (OIDC) protocol], but there is -also a client profile available for the link:{adapterguide_link}#_saml[SAML protocol]. +The client policy concept is independent of any specific protocol. {project_name} currently supports especially client profiles for the link:{adminguide_link}#con-oidc_server_administration_guide[OpenID Connect (OIDC) protocol], but there is +also a client profile available for the link:{adminguide_link}#_saml[SAML protocol]. == Architecture diff --git a/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc b/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc index 4a35b8c290..da3ada2e2a 100644 --- a/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc +++ b/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc @@ -38,11 +38,11 @@ This option handles link:https://fetch.spec.whatwg.org/[Cross-Origin Resource Sh If browser JavaScript attempts an AJAX HTTP request to a server whose domain is different from the one that the JavaScript code came from, the request must use CORS. The server must handle CORS requests, otherwise the browser will not display or allow the request to be processed. This protocol protects against XSS, CSRF, and other JavaScript-based attacks. + -Domain URLs listed here are embedded within the access token sent to the client application. The client application uses this information to decide whether to allow a CORS request to be invoked on it. Only {project_name} client adapters support this feature. See link:{adapterguide_link}[{adapterguide_name}] for more information. +Domain URLs listed here are embedded within the access token sent to the client application. The client application uses this information to decide whether to allow a CORS request to be invoked on it. Only {project_name} client adapters support this feature. See link:{securing_apps_link}[{securing_apps_name}] for more information. [[_admin-url]] Admin URL:: Callback endpoint for a client. The server uses this URL to make callbacks like pushing revocation policies, performing backchannel logout, and other administrative operations. For {project_name} servlet adapters, this URL can be the root URL of the servlet application. -For more information, see link:{adapterguide_link}[{adapterguide_name}]. +For more information, see link:{securing_apps_link}[{securing_apps_name}]. == Capability Config [[_access-type]] diff --git a/docs/documentation/server_development/topics/admin-rest-api.adoc b/docs/documentation/server_development/topics/admin-rest-api.adoc index 37e74ad85e..17c4c5fc2a 100644 --- a/docs/documentation/server_development/topics/admin-rest-api.adoc +++ b/docs/documentation/server_development/topics/admin-rest-api.adoc @@ -97,5 +97,4 @@ endif::[] === Additional resources [role="_additional-resources"] * {adminguide_link}[{adminguide_name}] -* {adapterguide_link}[{adapterguide_name}] * {apidocs_link}[{apidocs_name}] diff --git a/docs/documentation/server_development/topics/auth-spi.adoc b/docs/documentation/server_development/topics/auth-spi.adoc index 509c244837..9542a63cda 100644 --- a/docs/documentation/server_development/topics/auth-spi.adoc +++ b/docs/documentation/server_development/topics/auth-spi.adoc @@ -1194,7 +1194,7 @@ or during `Service account` authentication (represented by OAuth2 `Client Creden [role="_additional-resource"] .Additional resources -* For more details about {project_name} adapter and OAuth2 flows see link:{adapterguide_link}[{adapterguide_name}]. +* For more details about {project_name} adapter and OAuth2 flows see link:{securing_apps_link}[{securing_apps_name}]. ==== Default implementations diff --git a/docs/documentation/server_development/topics/saml-role-mappings-spi.adoc b/docs/documentation/server_development/topics/saml-role-mappings-spi.adoc index 8c99f12449..98a7c7009b 100644 --- a/docs/documentation/server_development/topics/saml-role-mappings-spi.adoc +++ b/docs/documentation/server_development/topics/saml-role-mappings-spi.adoc @@ -11,7 +11,7 @@ Implementations can not only map roles into other roles but also add or remove r roles assigned to the SAML principal) depending on the use case. For details about the configuration of the role mappings provider for the SAML adapter as well as a description of the default -implementations available see the link:{adapterguide_link}[{adapterguide_name}]. +implementations available see the link:{securing_apps_link}[{securing_apps_name}]. === Implementing a custom role mappings provider @@ -26,4 +26,4 @@ of the custom implementation must be added to the archive that also contains the When the SP application is deployed, the role mappings provider that will be used is selected by the id that was set in `keycloak-saml.xml` or in the `keycloak-saml` subsystem. So to enable your custom provider simply make sure that its id is -properly set in the adapter configuration. \ No newline at end of file +properly set in the adapter configuration. diff --git a/docs/documentation/tests/pom.xml b/docs/documentation/tests/pom.xml index c65992a416..a8d4ec97ce 100644 --- a/docs/documentation/tests/pom.xml +++ b/docs/documentation/tests/pom.xml @@ -80,12 +80,6 @@ ${project.version} pom - - org.keycloak.documentation - securing-apps - ${project.version} - pom - org.keycloak.documentation server-admin diff --git a/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/Guides.java b/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/Guides.java index 8b7aa09f6a..1a1e84e552 100644 --- a/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/Guides.java +++ b/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/Guides.java @@ -12,7 +12,6 @@ public class Guides { List g = new LinkedList<>(); g.add("authorization_services"); g.add("release_notes"); - g.add("securing_apps"); g.add("server_admin"); g.add("server_development"); g.add("upgrading"); diff --git a/docs/documentation/tests/src/test/resources/guide-url-fragments b/docs/documentation/tests/src/test/resources/guide-url-fragments index c0d6feae62..2796a01598 100644 --- a/docs/documentation/tests/src/test/resources/guide-url-fragments +++ b/docs/documentation/tests/src/test/resources/guide-url-fragments @@ -1,9 +1,8 @@ api_documentation=api_documentation authorization_services=authorization_services getting_started=getting_started -securing_apps=securing_apps server_admin=server_admin server_development=server_development server_installation=server_installation upgrading=upgrading -release_notes=release_notes \ No newline at end of file +release_notes=release_notes diff --git a/docs/documentation/topics/templates/document-attributes.adoc b/docs/documentation/topics/templates/document-attributes.adoc index 0abccbae54..75503f62d5 100644 --- a/docs/documentation/topics/templates/document-attributes.adoc +++ b/docs/documentation/topics/templates/document-attributes.adoc @@ -40,13 +40,6 @@ :authorizationguide_name_short: Authorization Services :authorizationguide_link: {project_doc_base_url}/authorization_services/ :authorizationguide_link_latest: {project_doc_base_url_latest}/authorization_services/ -:adapterguide_name: Securing Applications and Services Guide -:adapterguide_name_short: Securing Apps -:adapterguide_link: {project_doc_base_url}/securing_apps/ -:adapterguide_link_js_adapter: {adapterguide_link}#_javascript_adapter -:adapterguide_link_nodejs_adapter: {adapterguide_link}#_nodejs_adapter -:adapterguide_link_latest: {project_doc_base_url_latest}/securing_apps/ -:adapterguide_logout_link: {adapterguide_link}#_java_adapter_logout :adminguide_name: Server Administration Guide :adminguide_name_short: Server Administration :adminguide_link: {project_doc_base_url}/server_admin/ @@ -128,4 +121,5 @@ :section: guide :sections: guides :securing_apps_name: Securing applications Guides +:securing_apps_name_short: Securing applications :securing_apps_link: https://www.keycloak.org/guides#securing-apps diff --git a/docs/documentation/topics/templates/release-header.adoc b/docs/documentation/topics/templates/release-header.adoc index 7ce98e925e..be4a8afaaf 100644 --- a/docs/documentation/topics/templates/release-header.adoc +++ b/docs/documentation/topics/templates/release-header.adoc @@ -6,7 +6,7 @@ ifeval::["{release_header_guide}" != "{gettingstarted_name_short}"] * {gettingstarted_link}[{gettingstarted_name_short}] endif::[] ifeval::["{release_header_guide}" != "{adapterguide_name_short}"] -* {adapterguide_link}[{adapterguide_name_short}] +* {securing_apps_link}[{securing_apps_name_short}] endif::[] ifeval::["{release_header_guide}" != "{adminguide_name_short}"] * {adminguide_link}[{adminguide_name_short}] @@ -28,4 +28,4 @@ endif::[] [.top-menu-version] ==== Version *{project_version}* -==== \ No newline at end of file +==== diff --git a/docs/documentation/upgrading/topics/changes/changes.adoc b/docs/documentation/upgrading/topics/changes/changes.adoc index 64b5fcf414..b8a54a1c0d 100644 --- a/docs/documentation/upgrading/topics/changes/changes.adoc +++ b/docs/documentation/upgrading/topics/changes/changes.adoc @@ -1091,7 +1091,7 @@ There are now 3 separate adapter downloads for WildFly, JBoss EAP and JBoss AS7: Make sure you grab the correct one. You also need to update standalone.xml as the extension module and subsystem definition has changed. -See link:{adapterguide_link}[{adapterguide_name}] for details. +See link:{securing_apps_link}[{securing_apps_name}] for details. === Migrating from 1.2.0.Beta1 to 1.2.0.RC1 diff --git a/docs/guides/attributes.adoc b/docs/guides/attributes.adoc index f63a909e49..c67289cd88 100644 --- a/docs/guides/attributes.adoc +++ b/docs/guides/attributes.adoc @@ -8,6 +8,8 @@ :authorizationguide_name: Authorization Services Guide :authorizationguide_name_short: Authorization Services :authorizationguide_link: {project_doc_base_url}/authorization_services/ +:developerguide_name: Server Developer Guide +:developerguide_link: {project_doc_base_url}/server_development/ :section: guide :sections: guides :archivedownloadurl: https://github.com/keycloak/keycloak/releases/download/{version}/keycloak-{version}.zip @@ -26,3 +28,4 @@ :quickstartRepo_dir: keycloak-quickstarts :securing_apps_link: https://www.keycloak.org/guides#securing-apps :kc_js_path: /js +:kc_realms_path: /realms diff --git a/docs/guides/securing-apps/client-registration-cli.adoc b/docs/guides/securing-apps/client-registration-cli.adoc index 0c11325a36..3913a87e4c 100644 --- a/docs/guides/securing-apps/client-registration-cli.adoc +++ b/docs/guides/securing-apps/client-registration-cli.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="Client registration CLI" -priority=60 +priority=110 summary="Automating Client Registration with the CLI"> The Client Registration CLI is a command-line interface (CLI) tool for application developers to configure new clients in a self-service manner when integrating with {project_name}. It is specifically designed to interact with {project_name} Client Registration REST endpoints. @@ -383,4 +383,4 @@ Run the [command]`kcreg update-token --help` command for more information about + A: This error means your client is configured with [filename]`Signed JWT` token credentials, which means you have to use the [command]`--keystore` parameter when logging in. - \ No newline at end of file + diff --git a/docs/guides/securing-apps/client-registration.adoc b/docs/guides/securing-apps/client-registration.adoc index 93538a4561..531494c6ce 100644 --- a/docs/guides/securing-apps/client-registration.adoc +++ b/docs/guides/securing-apps/client-registration.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="Client registration service" -priority=50 +priority=100 summary="Using the client registration service"> In order for an application or service to utilize {project_name} it has to register a client in {project_name}. @@ -218,4 +218,4 @@ realm roles or client roles of other clients. * Client Disabled Policy - Newly registered client will be disabled. This means that admin needs to manually approve and enable all newly registered clients. This policy is not used by default even for anonymous registration. - \ No newline at end of file + diff --git a/docs/guides/securing-apps/docker-registry.adoc b/docs/guides/securing-apps/docker-registry.adoc index 071f87062c..79a745c9ea 100644 --- a/docs/guides/securing-apps/docker-registry.adoc +++ b/docs/guides/securing-apps/docker-registry.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="Docker registry" -priority=40 +priority=90 summary="Configuring a Docker registry to use {project_name}"> NOTE: Docker authentication is disabled by default. To enable see the https://www.keycloak.org/server/features[Enabling and disabling features] {section}. @@ -64,4 +64,4 @@ Once the above configuration has taken place, and the keycloak server and Docker Password: ******* Login Succeeded - \ No newline at end of file + diff --git a/docs/guides/securing-apps/javascript-adapter.adoc b/docs/guides/securing-apps/javascript-adapter.adoc index 02a941ece6..df4ba8c6f4 100644 --- a/docs/guides/securing-apps/javascript-adapter.adoc +++ b/docs/guides/securing-apps/javascript-adapter.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="{project_name} JavaScript adapter" -priority=20 +priority=30 summary="Client-side JavaScript library that can be used to secure web applications."> {project_name} comes with a client-side JavaScript library called `keycloak-js` that can be used to secure web applications. The adapter also comes with built-in support for Cordova applications. @@ -216,8 +216,10 @@ The technical details for linking to an app differ on each platform and special Please refer to the Android and iOS sections of the https://github.com/e-imaxina/cordova-plugin-deeplinks/blob/master/README.md[deeplinks plugin documentation] for further instructions. Different kinds of links exist for opening apps: -* custom schemes, such as `myapp://login` or `android-app://com.example.myapp/https/example.com/login` + +* custom schemes, such as `myapp://login` or `android-app://com.example.myapp/https/example.com/login`. * https://developer.apple.com/ios/universal-links/[Universal Links (iOS)]) / https://developer.android.com/training/app-links/deep-linking[Deep Links (Android)]. + While the former are easier to set up and tend to work more reliably, the latter offer extra security because they are unique and only the owner of a domain can register them. Custom-URLs are deprecated on iOS. For best reliability, we recommend that you use universal links combined with a fallback site that uses a custom-url link. Furthermore, we recommend the following steps to improve compatibility with the adapter: diff --git a/docs/guides/securing-apps/mod-auth-mellon.adoc b/docs/guides/securing-apps/mod-auth-mellon.adoc index 81018a1095..a36d8b4a2f 100644 --- a/docs/guides/securing-apps/mod-auth-mellon.adoc +++ b/docs/guides/securing-apps/mod-auth-mellon.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="mod_auth_mellon Apache Module" -priority=30 +priority=80 summary="Configuring the mod_auth_mellon Apache module with {project_name}"> The https://github.com/latchset/mod_auth_mellon[mod_auth_mellon] is an authentication module for Apache. If your language/environment supports using Apache HTTPD as a proxy, then you can use mod_auth_mellon to secure your web application with SAML. For more details on this module see the _mod_auth_mellon_ GitHub repo. diff --git a/docs/guides/securing-apps/mod-auth-openidc.adoc b/docs/guides/securing-apps/mod-auth-openidc.adoc index b45df39ee8..8ceb2b660e 100644 --- a/docs/guides/securing-apps/mod-auth-openidc.adoc +++ b/docs/guides/securing-apps/mod-auth-openidc.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="mod_auth_openidc Apache HTTPD Module" -priority=40 +priority=50 summary="Configuring the mod_auth_openidc Apache module with {project_name}"> diff --git a/docs/guides/securing-apps/oidc-layers.adoc b/docs/guides/securing-apps/oidc-layers.adoc index 704421a432..3eea1d15ac 100644 --- a/docs/guides/securing-apps/oidc-layers.adoc +++ b/docs/guides/securing-apps/oidc-layers.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="Secure applications and services with OpenID Connect" -priority=10 +priority=20 summary="Using OpenID Connect with Keycloak to secure applications and services"> <#include "partials/oidc/available-endpoints.adoc" /> diff --git a/docs/documentation/securing_apps/topics/overview/overview.adoc b/docs/guides/securing-apps/overview.adoc similarity index 73% rename from docs/documentation/securing_apps/topics/overview/overview.adoc rename to docs/guides/securing-apps/overview.adoc index 37654e21c6..e54603f91c 100644 --- a/docs/documentation/securing_apps/topics/overview/overview.adoc +++ b/docs/guides/securing-apps/overview.adoc @@ -1,4 +1,10 @@ -== Planning for securing applications and services +<#import "/templates/guide.adoc" as tmpl> +<#import "/templates/links.adoc" as links> + +<@tmpl.guide +title="Planning for securing applications and services" +priority=10 +summary="Introduction and basic concepts for securing applications"> As an OAuth2, OpenID Connect, and SAML compliant server, {project_name} can secure any application and service as long as the technology stack they are using supports any of these protocols. For more details about the security protocols @@ -13,4 +19,8 @@ a particular security protocol or to provide a more rich and tightly coupled int are known by *Keycloak Client Adapters*, and they should be used as a last resort if you cannot rely on what is available from the application ecosystem. +include::partials/overview/basic-steps.adoc[] +<#include "partials/overview/getting-started.adoc" /> +include::partials/overview/terminology.adoc[] + diff --git a/docs/documentation/securing_apps/topics/overview/basic-steps.adoc b/docs/guides/securing-apps/partials/overview/basic-steps.adoc similarity index 89% rename from docs/documentation/securing_apps/topics/overview/basic-steps.adoc rename to docs/guides/securing-apps/partials/overview/basic-steps.adoc index 4bdf39fc8b..753f7c256c 100644 --- a/docs/documentation/securing_apps/topics/overview/basic-steps.adoc +++ b/docs/guides/securing-apps/partials/overview/basic-steps.adoc @@ -1,4 +1,4 @@ -=== Basic steps to secure applications and services +== Basic steps to secure applications and services These are the basic steps for securing an application or a service in {project_name}. @@ -17,4 +17,5 @@ These are the basic steps for securing an application or a service in {project_n This guide provides the detailed instructions for these steps. You can find more details in the link:{adminguide_link}[Server Administration Guide] about how to register a client to {project_name} through the -administration console. \ No newline at end of file +administration console. + diff --git a/docs/documentation/securing_apps/topics/overview/getting-started.adoc b/docs/guides/securing-apps/partials/overview/getting-started.adoc similarity index 69% rename from docs/documentation/securing_apps/topics/overview/getting-started.adoc rename to docs/guides/securing-apps/partials/overview/getting-started.adoc index d5d960f1d1..5435b319de 100644 --- a/docs/documentation/securing_apps/topics/overview/getting-started.adoc +++ b/docs/guides/securing-apps/partials/overview/getting-started.adoc @@ -1,4 +1,4 @@ -=== Getting Started +== Getting Started The link:{quickstartRepo_link}[{quickstartRepo_name}] provides examples about how to secure applications and services using different programming languages and frameworks. By going through their documentation and codebase, you will @@ -7,35 +7,46 @@ understand the bare minimum changes required in your application and service in Also, see the following sections for recommendations for trusted and well-known client-side implementations for both OpenID Connect and SAML protocols. -==== OpenID Connect +=== OpenID Connect ifeval::[{project_community}==true] -===== Java +==== Java * {quickstartRepo_link}/tree/latest/jakarta/servlet-authz-client[Wildfly Elytron OIDC] * {quickstartRepo_link}/tree/latest/spring/rest-authz-resource-server[Spring Boot] endif::[] -===== JavaScript (client-side) -* JavaScript - -===== Node.js (server-side) -* Node.js +==== JavaScript (client-side) +* <@links.securingapps id="javascript-adapter"/> +==== Node.js (server-side) +* <@links.securingapps id="nodejs-adapter"/> ifeval::[{project_community}==true] -===== C# +==== C# * https://github.com/dylanplecki/KeycloakOwinAuthentication[OWIN] -===== Python +==== Python * https://pypi.org/project/oic/[oidc] -===== Android +==== Android * https://github.com/openid/AppAuth-Android[AppAuth] -===== iOS +==== iOS * https://github.com/openid/AppAuth-iOS[AppAuth] -===== Apache HTTP Server +==== Apache HTTP Server * https://github.com/OpenIDC/mod_auth_openidc[mod_auth_openidc] endif::[] +=== SAML + +==== Java + +* <@links.securingapps id="saml-galleon-layers"/> + +ifeval::[{project_community}==true] +==== Apache HTTP Server + +* <@links.securingapps id="mod-auth-mellon"/> +endif::[] + diff --git a/docs/documentation/securing_apps/topics/overview/terminology.adoc b/docs/guides/securing-apps/partials/overview/terminology.adoc similarity index 98% rename from docs/documentation/securing_apps/topics/overview/terminology.adoc rename to docs/guides/securing-apps/partials/overview/terminology.adoc index cbf88ab8e3..9d978a755c 100644 --- a/docs/documentation/securing_apps/topics/overview/terminology.adoc +++ b/docs/guides/securing-apps/partials/overview/terminology.adoc @@ -1,4 +1,4 @@ -=== Terminology +== Terminology These terms are used in this guide: diff --git a/docs/documentation/securing_apps/topics/saml/saml-errors.adoc b/docs/guides/securing-apps/partials/saml/saml-errors.adoc similarity index 80% rename from docs/documentation/securing_apps/topics/saml/saml-errors.adoc rename to docs/guides/securing-apps/partials/saml/saml-errors.adoc index 25eb9e90b1..b7c463c14f 100644 --- a/docs/documentation/securing_apps/topics/saml/saml-errors.adoc +++ b/docs/guides/securing-apps/partials/saml/saml-errors.adoc @@ -1,6 +1,6 @@ [[_saml-errors]] -=== {project_name} specific errors +== {project_name} specific errors {project_name} server can send an error to the client application in the SAML response, which may contain a SAML status such as: @@ -16,5 +16,6 @@ {project_name} sends this error when a user is authenticated and has an SSO session, but the authentication session expired in the current browser tab and hence {project_name} server cannot automatically do SSO re-authentication of the user and redirect back to client with successful response. When a client application receives this type of error, it is ideal to retry authentication immediately and send a new -SAML request to the {project_name} server, which should typically always authenticate the user due to the SSO session and redirect back. More details in -the link:{adminguide_link}#_authentication-sessions[{adminguide_name}]. +SAML request to the {project_name} server, which should typically always authenticate the user due to the SSO session and redirect back. +The SAML adapter performs that retry automatically if the commented status is returned by the server. +More details in the link:{adminguide_link}#_authentication-sessions[{adminguide_name}]. diff --git a/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc b/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc index 8c2682cdbd..ebfa1bd6b2 100644 --- a/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc +++ b/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="{project_name} SAML Galleon feature pack detailed configuration" -priority=20 +priority=70 tileVisible="false" summary="Detailed list of elements for the `keycloak-saml.xml` configuration file"> diff --git a/docs/guides/securing-apps/saml-galleon-layers.adoc b/docs/guides/securing-apps/saml-galleon-layers.adoc index 2acf8c4f12..96c34cbb4f 100644 --- a/docs/guides/securing-apps/saml-galleon-layers.adoc +++ b/docs/guides/securing-apps/saml-galleon-layers.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="{project_name} SAML Galleon feature pack for WildFly and EAP" -priority=10 +priority=60 summary="Using {project_name} SAML Galleon feature pack to secure applications in WildFly and EAP"> The SAML adapter is distributed as a Galleon feature pack for wildfly 29 or newer. More details about the subject @@ -20,5 +20,6 @@ include::partials/saml/assertion-api.adoc[] include::partials/saml/error_handling.adoc[] include::partials/saml/debugging.adoc[] include::partials/saml/multi-tenancy.adoc[] +include::partials/saml/saml-errors.adoc[] diff --git a/docs/guides/securing-apps/token-exchange.adoc b/docs/guides/securing-apps/token-exchange.adoc index 2d74fcb90e..1afe142a53 100644 --- a/docs/guides/securing-apps/token-exchange.adoc +++ b/docs/guides/securing-apps/token-exchange.adoc @@ -3,7 +3,7 @@ <@tmpl.guide title="Using token exchange" -priority=40 +priority=120 summary="Configuring and using Token exchange with {project_name}"> :tech_feature_name: Token Exchange