Commit graph

393 commits

Author SHA1 Message Date
Bill Burke
3ce0c57e17 Merge pull request #3831 from Hitachi/master
KEYCLOAK-2604 Proof Key for Code Exchange by OAuth Public Clients
2017-04-06 15:36:08 -04:00
Marko Strukelj
0269db0e85 KEYCLOAK-4719 CLI tests fail when run from within the IDE 2017-04-06 12:46:05 +02:00
Vaclav Muzikar
5e360cf919 KEYCLOAK-4351 Stabilize TermsAndConditions test in IE 2017-04-04 07:40:16 +02:00
Takashi Norimatsu
ef3aef9381 Merge branch 'master' into master 2017-03-28 16:21:40 +09:00
mhajas
36fc643bfb KEYCLOAK-4366 2017-03-27 11:22:01 +02:00
Pavel Drozd
4aa996c2db Merge pull request #3959 from mhajas/KEYCLOAK-4141
KEYCLOAK-4141 Added saml tests
2017-03-27 09:36:41 +02:00
mhajas
7c1eb5582a KEYCLOAK-4141 Added saml tests 2017-03-21 10:41:06 +01:00
Peter Nalyvayko
b2f10359c8 KEYCLOAK-4335: x509 client certificate authentication
Started on implementing cert thumbprint validation as a part of x509 auth flow. Added a prompt screen to give users a choice to either log in based on the identity extracted from X509 cert or to continue with normal browser login flow authentication; clean up some of the comments

x509 authentication for browser and direct grant flows. Implemented certificate to user mapping based on user attribute

Implemented CRL and OCSP certificate revocation checking and added corresponding configuration settings to set up responderURI (OCSP), a location of a file containing X509CRL entries and switiches to enable/disable revocation checking; reworked the certificate validation; removed superflous logging; changed the certificate authentication prompt page to automatically log in the user after 10 seconds if no response from user is received

Support for loading CRL from LDAP directory; finished the CRL checking using the distribution points in the certificate; updated the instructions how to add X509 authentication to keycloak authentication flows; minor styling changes

Stashing x509 unit test related changes; added the steps to configure mutual SSL in WildFly to the summary document

A minor fix to throw a security exception when unable to check cert revocation status using OCSP; continue working on README

Changes to the formating of the readme

Added a list of features to readme

Fixed a potential bug in X509 cert user authenticator that may cause NPE if the client certificate does not define keyusage or extended key usage extensions

Fixed compile time errors in X509 validators caused by the changes to the user credentials model in upstream master

Removed a superfluous file created when merging x509 and main branches

X509 authentication: removed the PKIX path validation as superflous

Reverted changes to the AbstractAttributeMapper introduced during merging of x509 branch into main

Merge the unit tests from x509 branch

added mockito dependency to services project; changes to the x509 authenticators to expose methods in order to support unit tests; added a default ctor to CertificateValidator class to support unit testing; updated the direct grant and browser x509 authenticators to report consistent status messages; unit tests to validate X509 direct grant and browser authenticators; fixed OCSP validation to throw an exception if the certificate chain contains a single certificate; fixed the CRL revocation validation to only use CRL distribution point validation only if configured

CRL and OSCP mock tests using mock netty server. Changed the certificate validator to better support unit testing.

changes to the mockserver dependency to explicitly exclude xercesImpl that was causing SAMLParsingTest to fail

Added a utility class to build v3 certificates with optional extensions to facilitate X509 unit testing; removed supoerfluous certificate date validity check (undertow should be checking the certificate dates during PKIX path validation anyway)

X509: changes to make configuring the user identity extraction simplier for users - new identity sources to map certificate CN and email (E) attributes from X500 subject and issuer names directly rather than using regular expressions to parse them

X509 fixed a compile error caused by the changes to the user model in master

Integration tests to validate X509 client certificate authentication

Minor tweaks to X509 client auth related integration tests

CRLs to support x509 client cert auth integration tests

X509: reverted the changes to testrealm.json and updated the test to configure the realm at runtime

X509 - changes to the testsuite project configuration to specify a path to a trust store used to test x509 direct grant flow; integration tests to validate x509 authentication in browser and direct grant flows; updated the client certificate to extend its validatity dates; x509 integration tests and authenticators have been refactored to use a common configuration class

X509 separated the browser and direct grant x509 authenction integration tests

x509 updated the authenticator provider test to remove no longer supported cert thumbprint authenticator

x509 removed the dependency on mockito

x509 re-implemented OCSP certificate revocation client used to check revocation status when logging in with x509 certificate to work around the dependency on Sun OCSP implementation; integration tests to verify OCSP revocation requests

index.txt.attr is needed by openssl to run a simple OCSP server

x509: minor grammar fixes

Add OCSP stub responder to integration tests

This commit adds OCSP stub responder needed for the integration tests,
and eliminates the need to run external OCSP responder in order to run
the OCSP in X509OCSPResponderTest.

Replace printStackTrece with logging

This commit replaces call to printStackTrace that will end up going to
the stderr with logging statement of WARN severity.

Remove unused imports

Removed unused imports in
org.keycloak.authentication.authenticators.x509 package.

Parameterized Hashtable variable

Removed unused CertificateFactory variable

Declared serialVersionUID for Serializable class

Removed unused CertificateBuilder class

The CertificateBuilder was not used anywhere in the code, removing it to
prevent technical debt.

Removing unused variable declaration

`response` variable is not used in the test, removed it.

Made sure InputStreams are closed

Even though the InputStreams are memory based, added try-with-resources
to make sure that they are closed.

Removed deprecated usage of URLEncoder

Replaced invocation of deprecated method from URLEncoder with Encode
from Keycloak util package.

Made it more clear how to control OCSP stub responder in the tests

X509 Certificate user authentication: moved the integration unit tests into their own directory to fix a failing travis test job

KEYCLOAK-4335: reduced the logging level; added the instructions how to run X.509 related tests to HOW-TO-RUN.md doc; removed README.md from x509 folder; removed no longer used ocsp profile and fixed the exclusion filter; refactored the x509 base test class that was broken by the recent changes to the integration tests

KEYCLOAK-4335: fixed a few issues after rebasing
2017-03-17 05:24:57 -04:00
Pavel Drozd
b2d677256d Merge pull request #3877 from mhajas/KEYCLOAK-3955
KEYCLOAK-3955 Add CORS tests to integration arquillian testsuite
2017-03-15 23:52:03 +01:00
Pedro Igor
9d1d22565c Merge pull request #3938 from pedroigor/authz-fixes
AuthZ Services Fixes
2017-03-13 15:20:41 -03:00
Pedro Igor
e7e6314146 [KEYCLOAK-4555] - Fixes and improvements to evaluation code 2017-03-13 14:08:54 -03:00
Pavel Drozd
b5433720c1 KEYCLOAK-4304 Updated Kerberos tests to be able to run them on different environment 2017-03-13 08:00:41 +01:00
Bill Burke
0ff4223184 Merge pull request #3922 from hmlnarik/KEYCLOAK-4288-SAML-logouts-are-not-invalidating-the-sessions-for-all-the-logged-in-applications
KEYCLOAK-4288 Invalidate sessions in cluster for SAML logouts
2017-03-09 19:13:37 -05:00
mhajas
213ed6fa4b KEYCLOAK-3955 2017-03-06 10:22:06 +01:00
mhajas
280689055f KEYCLOAK-3961 2017-03-06 10:17:59 +01:00
Bill Burke
c6dc59f63e Merge remote-tracking branch 'upstream/master' 2017-03-03 11:00:32 -05:00
Hynek Mlnarik
27ba4eb978 KEYCLOAK-4288 Tests for EAP6 and Wildfly 2017-03-01 15:17:39 +01:00
mposolda
091b376624 KEYCLOAK-1590 Realm import per test class 2017-03-01 09:38:44 +01:00
Bill Burke
b4f625e1ce KEYCLOAK-4501 2017-02-27 18:46:00 -05:00
mposolda
f6bc0806d5 KEYCLOAK-4368 Switch default WebDriver impl to htmlUnit 2017-02-20 21:52:15 +01:00
Pavel Drozd
152b4f13e7 Merge pull request #3871 from mhajas/KEYCLOAK-4626
KEYCLOAK-4626 KEYCLOAK-4261 KEYCLOAK-4181 KEYCLOAK-4160 Add tests for SAML issues
2017-02-20 15:43:38 +01:00
Stian Thorgersen
3653d7ed9a Merge pull request #3762 from sldab/hide-providers
KEYCLOAK-4224 Allow hiding identity providers on login page
2017-02-17 12:04:35 +01:00
mhajas
b1510c43ff KEYCLOAK-4160 2017-02-16 08:09:11 +01:00
mhajas
119435ac76 KEYCLOAK-4262 Test for rejected consent 2017-02-16 08:04:06 +01:00
mhajas
91bcc24977 KEYCLOAK-4329 Add test for empty KeyInfo 2017-02-14 12:36:17 +01:00
Pavel Drozd
6602123b55 Merge pull request #3824 from mhajas/KEYCLOAK-4020
KEYCLOAK-4020 add test for boolean attribute
2017-02-13 10:41:04 +01:00
Stian Thorgersen
5b5dc3e442 KEYCLOAK-4265 Social login tests 2017-02-06 13:50:10 +01:00
Takashi Norimatsu
6bab704bba KEYCLOAK-2604 Proof Key for Code Exchange by OAuth Public Clients - RFC
7636 - Arquillian Test Cases
2017-02-03 14:41:36 +09:00
mhajas
ddf9301ceb KEYCLOAK-4020 add test for boolean attribute 2017-02-02 09:47:52 +01:00
mposolda
f92dd6bd16 KEYCLOAK-4339 MigrationTest fails to run 2017-01-31 16:00:16 +01:00
mposolda
265522a2e3 KEYCLOAK-4285 Adapter tests for examples fail in Wildfly/EAP6 2017-01-27 14:26:21 +01:00
Stian Thorgersen
5fd3eb2990 KEYCLOAK-3729 Ability to run tests within Keycloak server 2017-01-27 12:14:19 +01:00
mposolda
42ad8aec64 KEYCLOAK-4271 Migration test for offline tokens 2017-01-26 17:19:03 +01:00
Stian Thorgersen
94ffeda62a Merge pull request #3773 from hmlnarik/KEYCLOAK-4181-SAML-Response-without-any-assertion-leads-to-an-exception
KEYCLOAK-4181 Fix handling of SAML error code in broker
2017-01-24 10:33:05 +01:00
Hynek Mlnarik
5da491c270 KEYCLOAK-4181 Fix handling of SAML error code in broker 2017-01-19 16:30:06 +01:00
Stian Thorgersen
212182ee34 Merge pull request #3765 from zschwarz/community
KEYCLOAK-4233 Run failing i18n tests with community profile
2017-01-18 08:52:17 +01:00
Stian Thorgersen
e364680792 Merge pull request #3721 from hmlnarik/KEYCLOAK-3399-End-session-endpoint-returns-error-when-keycloak-session-is-expired
KEYCLOAK-3399 Ignore user session expiration on OIDC logout
2017-01-18 08:38:53 +01:00
Slawomir Dabek
9bb65ba9b7 KEYCLOAK-4224 Allow hiding identity providers on login page 2017-01-17 14:32:59 +01:00
zschwarz
ae40bfb96e KEYCLOAK-4233 Run failing i18n tests with community profile 2017-01-16 15:27:39 +01:00
Pavel Drozd
3d9f11168e KEYCLOAK-4210: Added Fuse admin tests 2017-01-13 01:05:37 +01:00
Hynek Mlnarik
4df70c517d KEYCLOAK-4141 2017-01-10 09:02:36 +01:00
Pavel Drozd
cbd6f7e1d0 Merge pull request #3723 from mhajas/KEYCLOAK-3841
KEYCLOAK-3841 Unignore and fix fuse on eap test
2017-01-10 08:10:22 +01:00
mposolda
a09bc6520f KEYCLOAK-2888 KEYCLOAK-3927 Fully migrate kerberos tests to the new testsuite 2017-01-09 13:50:41 +01:00
Hynek Mlnarik
9fb3201c8b KEYCLOAK-3399 Ignore user session expiration on OIDC logout 2017-01-06 15:15:46 +01:00
mhajas
86c49f5e89 KEYCLOAK-3841 Unignore and fix fuse on eap test 2017-01-06 14:39:24 +01:00
mhajas
61e7936d79 KEYCLOAK-3704 Add missing test 2017-01-05 16:55:40 +01:00
Stian Thorgersen
04179c5681 Merge branch 'KEYCLOAK-4004' of https://github.com/l-robinson/keycloak into l-robinson-KEYCLOAK-4004 2016-12-22 06:13:41 +01:00
Vlasta Ramik
55d53214a1 KEYCLOAK-3777 added missing test 2016-12-20 11:50:37 +01:00
Stian Thorgersen
eb7ad07e31 KEYCLOAK-4109 Ability to disable impersonation 2016-12-20 08:46:21 +01:00
Stian Thorgersen
faeff029fa Merge pull request #3664 from mstruk/admin-cli
KEYCLOAK-912 Admin CLI
2016-12-19 15:46:17 +01:00
Stian Thorgersen
f29bb7d501 KEYCLOAK-4092 key provider for HMAC signatures 2016-12-19 10:50:43 +01:00
Marko Strukelj
c3d9859c6e KEYCLOAK-912 Admin CLI 2016-12-19 01:05:03 +01:00
Tomas Kyjovsky
cf62715499 KEYCLOAK-4061 fixed testsuite URLProvider for AS7/EAP6 app server (managed and remote mode) 2016-12-09 17:41:07 +01:00
l-robinson
1c66ce7dd7 Additional test case added to check the text in the 'Back to application' link 2016-12-05 12:13:30 +10:30
mhajas
a347cb591d KEYCLOAK-3017 Location header not present in responses from admin endpoints 2016-12-01 15:33:53 +01:00
mposolda
a38544796f KEYCLOAK-3823 KEYCLOAK-3824 Added public-key-cache-ttl for OIDC adapters. Invalidate cache when notBefore sent 2016-12-01 12:25:07 +01:00
mposolda
803fde6c1d KEYCLOAK-3124 Possibility test adapter on embedded undertow 2016-11-29 22:08:23 +01:00
Pavel Drozd
8f3256675a Merge pull request #3534 from tkyjovsk/KEYCLOAK-3683
KEYCLOAK-3683 Updated OIDC adapter test for secure-deployments
2016-11-29 16:40:24 +01:00
Pavel Drozd
833c56e17b Merge pull request #3508 from mhajas/KEYCLOAK-3653
KEYCLOAK-3653 Tests for cert endpoint
2016-11-29 16:37:44 +01:00
Pavel Drozd
9bb59c0f94 Merge pull request #3496 from tkyjovsk/performance-tests
Updated performance tests. Added app-profile-jee test application from qs.
2016-11-29 16:37:17 +01:00
mposolda
69ce1e05f0 KEYCLOAK-3822 Changing signature validation settings of an external IdP is not sometimes reflected 2016-11-28 15:27:25 +01:00
mposolda
7c6032cc84 KEYCLOAK-3825 Ability to expire publicKeys cache. Migrated OIDCBrokerWithSignatureTest to new testsuite 2016-11-25 17:45:37 +01:00
Bill Burke
ccbd8e8c70 remove User Fed SPI 2016-11-23 16:06:44 -05:00
Tomas Kyjovsky
aae368f1e7 Added parameter check to WaitUtils.pause() 2016-11-23 15:52:41 +01:00
Tomas Kyjovsky
d44f347b08 Added 2nd secure-deployment, added option to test with separate realm configuration in keycloak subsystem. Moved jboss-specific test to a separate class. 2016-11-22 11:43:26 +01:00
Marek Posolda
a2e00e4c3b Merge pull request #3497 from vramik/KEYCLOAK-3899
KEYCLOAK-3899 Make migration properties available in tests
2016-11-18 09:12:10 +01:00
mhajas
8fc5b00d91 KEYCLOAK-3653 Tests for cert endpoint 2016-11-16 15:31:48 +01:00
Vlasta Ramik
50339f6f0e Test backwards compatibility of realm import 2016-11-16 13:17:04 +01:00
Vlasta Ramik
ab0514041e Make migration properties available in tests 2016-11-14 13:09:03 +01:00
Stian Thorgersen
292777259e Merge pull request #3472 from hmlnarik/KEYCLOAK-1881-saml-key-rotation
Keycloak 1881 - SAML key/cert rotation for IdP
2016-11-08 07:56:25 +01:00
Stian Thorgersen
ef48594d85 Merge pull request #3470 from sebastienblanc/KEYCLOAK-3548
KEYCLOAK-3548 : Send 401 when no keycloak.json for EAP6/AS7 Adapter
2016-11-08 07:37:00 +01:00
Stian Thorgersen
c9a58fad15 Merge pull request #3464 from stianst/KEYCLOAK-3692
KEYCLOAK-3692
2016-11-08 07:36:39 +01:00
Hynek Mlnarik
36257863db KEYCLOAK-1881 Integration tests for key rotation in SAML IdP 2016-11-04 21:53:43 +01:00
sebastien blanc
6c18b300a4 add integration test 2016-11-04 07:39:22 +01:00
Stian Thorgersen
ac18b6c71e KEYCLOAK-3692 2016-11-03 08:33:56 +01:00
Pavel Drozd
da516a78b3 Merge pull request #3450 from mhajas/KEYCLOAK-3841
KEYCLOAK-3841 Testing of Hawtio console on EAP6 + Fuse integration
2016-11-02 10:54:52 +01:00
mhajas
446b57b827 KEYCLOAK-3841 Testing of Hawtio console on EAP6 + fuse integration 2016-10-31 14:35:13 +01:00
Pavel Drozd
04f2b9ac01 Merge pull request #3368 from zschwarz/oidc-filter
KEYCLOAK-3747 Servlet filter dependencies
2016-10-25 11:44:47 +02:00
zschwarz
bc718471da KEYCLOAK-3747 Servlet filter dependencies 2016-10-24 15:01:16 +02:00
Stian Thorgersen
5a00aaefa8 KEYCLOAK-2594
bind credential being leaked in admin tool JSON response

KEYCLOAK-2972
Keycloak leaks configuration passwords in Admin Event logs
2016-10-20 19:30:59 +02:00
Stian Thorgersen
14a51e589d Merge pull request #3325 from mstruk/cli-reg
KEYCLOAK-2084 Client Registration CLI
2016-10-19 06:33:45 +02:00
mposolda
a7287aad36 KEYCLOAK-3499 More fixes for IncludeInUserInfo. Fixing tests and migration 2016-10-18 13:09:30 +02:00
Marko Strukelj
c912f941e7 KEYCLOAK-2084 Client Registration CLI 2016-10-18 12:33:02 +02:00
Pavel Drozd
4cbc665592 Merge pull request #3340 from vramik/migration
KEYCLOAK-3589 Add support for manual upgrade of database schema to te…
2016-10-18 07:39:42 +02:00
Pavel Drozd
d295ec709b Merge pull request #3293 from zschwarz/oidc-filter
KEYLOAK-3663 OIDC servlet filter
2016-10-18 07:35:17 +02:00
Vlasta Ramik
b0448d1b6f KEYCLOAK-3589 Add support for manual upgrade of database schema to testsuite 2016-10-17 11:32:43 +02:00
Stian Thorgersen
d2cae0f8c3 KEYCLOAK-905
Realm key rotation for OIDC
2016-10-13 11:19:52 +02:00
Vlasta Ramik
bc2eb2b9ea KEYCLOAK-3489 KEYCLOAK-3609 2016-10-12 12:28:56 +02:00
zschwarz
4bd38bb9c1 KEYLOAK-3663 OIDC servlet filter 2016-10-10 10:44:07 +02:00
Bill Burke
d4c3fae546 merge conflicts 2016-09-30 19:19:12 -04:00
Pavel Drozd
6e00587468 Merge pull request #3264 from vmuzikar/KEYCLOAK-3616
KEYCLOAK-3616 Add integration tests for Node.js adapter
2016-09-30 14:33:07 +02:00
Pavel Drozd
bcf5ac56cd Merge pull request #3266 from mhajas/KEYCLOAK-3586
KEYCLOAK-3586 Adding tests for updateToken and timeSkew
2016-09-29 11:13:26 +02:00
mhajas
69f66edb5f KEYCLOAK-3604 Compile servlets and filters under JDK7 2016-09-29 09:51:12 +02:00
Bill Burke
8967ca4066 refactor mongo entities, optimize imports 2016-09-28 15:25:39 -04:00
mhajas
6c3479665c KEYCLOAK-3586 2016-09-27 14:00:52 +02:00
Vaclav Muzikar
ee2daeb364 KEYCLOAK-3616 Add integration tests for Node.js adapter 2016-09-27 10:32:35 +02:00
Vlasta Ramik
f91c517a9c Export/Import migration testing 2016-09-22 15:16:20 +02:00
Stian Thorgersen
4977527f60 Merge pull request #3239 from stianst/SERVER-PROFILE
KEYCLOAK-3579 Add ability to define profiles
2016-09-20 10:39:05 +02:00
Stian Thorgersen
9d0c9046ad Merge pull request #3227 from mhajas/KEYCLOAK-3553
KEYCLOAK-3553 Move all functionality tests to servlets
2016-09-20 08:51:59 +02:00
Stian Thorgersen
992268a8e6 KEYCLOAK-3579 Add ability to define profiles 2016-09-20 08:41:23 +02:00