libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions
26633 commits 4 branches 9 tags 483 MiB
Commit graph

1132 commits

Author SHA1 Message Date
Vlasta Ramik
3b2dea64ac
Remove duplicated and unused PersistenceExceptionConverter (#20844) 
Closes #20842
 2023-06-07 14:46:36 +02:00
Stefan Guilhen
2252b09949 Remove deprecated default roles methods 
Closes #15046
 2023-05-23 22:32:52 +02:00
Alexander Schwartz
d7a408d081 Remove log4j dependency from model/jpa which is EOL 
Closes #20421
 2023-05-19 17:43:51 -03:00
Stefan Guilhen
053f774f13 Fix broker link query param order to match the columns order in the primary key index 
Closes #19193
 2023-05-17 10:22:59 +02:00
vramik
d1ab921c50 JpaUserProvider count methods are inconsistent with searchForUser's param filter handling 
Closes #17581
 2023-05-05 08:22:05 +02:00
rmartinc
d9025db536 Migrate realms if configured to use RH-SSO themes 
Closes https://github.com/keycloak/keycloak/issues/17484
 2023-05-02 15:38:33 +02:00
Alexander Schwartz
a10d511b12 Remove workaround for fix available in Hibernate 6.2.1 
Closes #19323
 2023-05-02 13:43:49 +02:00
Alexander Schwartz
f345c8b931 Revert "Fix problem when Hibernate on MySQL is confused to read back Enums from VARCHARs" 
This doesn't work with Hibernate 6.2.0.Final any more, and it is no longer needed after changing the VARCHAR to TINYINT for the enums

This reverts commit 0d96b8db6b9f8cefc2997d350cc6359c01cd61be.
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
02b0683053 Revert "Workaround to avoid replacing element collections" 
With the update Hibernate 6.2.0.Final this is no longer needed.

Closes #19162

This reverts commit 93e32f3191a1ddc3498000244b35b3c14fe6880e and e369f7c212b3d9ee4810518f5a2bfe9b846ba15d.
 2023-04-27 13:36:54 +02:00
vramik
d962dec954 Remove workaround for Lazy initialization of Realm's collections 
Closes #19069
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
b508b18391 Removing workaround for H6 as this is now fixed 
This reverts commit c74b832995759d4c9f330a4ba1767d01f9e3c174.

Closes #16551
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
e00af7e172 Fix problem when Hibernate on MySQL is confused to read back Enums from VARCHARs 
It treated the single byte String with its ASCII values, which then didn't find a representation in the enum's values, which lead to a "ArrayIndexOutOfBoundsException: Index 48" for a value "0" (ASCII 48).
This behavior changed when migrating from Hibernate 5 to Hibernate 6.
Hibernate expects a TinyInt value for all Enums by default, and this annotation overrides it.
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
16d4c732e0 Fix problem with "InterpretationException: Error interpreting query / this may indicate a semantic (user query) problem or a bug in the parser" 
This behavior changed when upgrading from Hibernate 6.2.0.CR3 to 6.2.0.CR4
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
b68a5be38d Workaround to avoid replacing element collections 
Relates to #19162
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
2762e17dc0 Create proper one-to-many in RealmLocalizationTextsEntity 
This avoids Hibernate 6.2.0.CR4 to fail with 'BasicValue cannot be cast to class ToOne'.
It used to work on Hibernate 6.2.0.CR3.
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
ad82252a44 Create workaround for "identifier of an instance altered" 
Related to: #19323
 2023-04-27 13:36:54 +02:00
Martin Bartoš
9719e1d210 Handle DB exceptions for JTA TX 2023-04-27 13:36:54 +02:00
Alexander Schwartz
5252992384 Workaround to avoid replacing element collections 
Relates to #19162
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
28975b950d Workaround for lazy loaded collections for RealmEntity 
---
Quarkus3 branch sync no. 13 (11.4.2023)
Resolved conflicts:
keycloak/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java - Modified
 2023-04-27 13:36:54 +02:00
Martin Bartoš
8584174099 Change default DB dialects 2023-04-27 13:36:54 +02:00
vramik
7b51d8617d Remove one side of association which is not used. 
Closes #16693
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
434cc7c711 Fix errors pointed out by Hibernate 6 in the queries 
Closes #16337
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
4bdf2fe21d Fixing parameter which should be a string plus dependencies 
Closes #16649
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
80f7452950 Results of AttributeConverters are mutable; workaround a regression in H6 
Relates to #16551
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
33e2bcd94f Avoid warnings on bean validation as we don't use it in JPA 
Closes #16502

---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 3 (27.1.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
137a2bf0e9 Remove functionality not supported in Hibernate 6 
Closes #16330
 2023-04-27 13:36:54 +02:00
Stefan Guilhen
384d7c17f7 - Fix issues in legacy store 
- Testsuite (switch undertow-embedded.version)
 2023-04-27 13:36:54 +02:00
Stefan Guilhen
e505021681 Model upgrade Hibernate/JPA 
---
Quarkus3 branch sync no. 14 (24.4.2023)
Resolved conflicts:
keycloak/pom.xml - Modified
---
Quarkus3 branch sync no. 13 (11.4.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 11 (24.3.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 7 (27.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/client/entity/JpaClientEntity.java - Modified
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/clientScope/entity/JpaClientScopeEntity.java - Modified
keycloak/pom.xml - Modified
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 1 (18.1.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/hibernate/dialect/JsonbPostgreSQL95Dialect.java - Modified
 2023-04-27 13:36:54 +02:00
Martin Bartoš
7cff857238 Migrate packages from javax.* to jakarta.* 
---
Quarkus3 branch sync no. 14 (24.4.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ComponentExportImportTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/DeclarativeUserTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/FlowTest.java - Modified
keycloak/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java	- Modified
---
Quarkus3 branch sync no. 13 (11.4.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AccountTotpPage.java - Deleted
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BackwardsCompatibilityUserStorageTest.java - Modified
---
Quarkus3 branch sync no. 12 (31.3.2023)
Resolved conflicts:
keycloak/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/QuarkusWelcomeResource.java - Modified
keycloak/services/src/main/java/org/keycloak/protocol/saml/profile/util/Soap.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UserInfoClientUtil.java - Modified
keycloak/services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsTest.java - Modified
---
Quarkus3 branch sync no. 10 (17.3.2023)
Resolved conflicts:
keycloak/services/src/main/java/org/keycloak/protocol/saml/SamlProtocolUtils.java -	Modified
---
Quarkus3 branch sync no. 9 (10.3.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java - Modified
---
Quarkus3 branch sync no. 8 (3.3.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SamlClient.java	Modified - Modified
keycloak/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java - Modified
keycloak/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticator.java - Modified
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ComponentsResource.java - Modified
keycloak/testsuite/utils/src/main/java/org/keycloak/testsuite/KeycloakServer.java - Modified
keycloak/services/src/main/java/org/keycloak/protocol/saml/installation/SamlSPDescriptorClientInstallation.java - Modified
---
Quarkus3 branch sync no. 5 (10.2.2023)
Resolved conflicts:
/keycloak/services/src/main/java/org/keycloak/social/google/GoogleIdentityProvider.java	Modified - Modified
keycloak/services/src/main/java/org/keycloak/social/twitter/TwitterIdentityProvider.java - Modified
---
Quarkus3 branch sync no. 4 (3.2.2023)
Resolved conflicts:
keycloak/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java - Modified
---
Quarkus3 branch sync no. 1 (18.1.2023)
Resolved conflicts:
keycloak/testsuite/client/ClientPoliciesTest.java - Deleted
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java - Modified
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaModelCriteriaBuilder.java - Modified
 2023-04-27 13:36:54 +02:00
Alexander Schwartz
7562f8ec6e Rewrite changelog SQL to make it work on Oracle 
Closes #19841
 2023-04-24 13:30:16 +02:00
rmartinc
5a3b8ee577 Avoid adding post.logout.redirect.uris if already defined as client attributes 
Closes https://github.com/keycloak/keycloak/issues/16992
 2023-04-19 10:48:17 +02:00
mposolda
554818f422 Rename jpa-changelog-22.0.0.xml 
closes #19527
 2023-04-04 19:21:14 +02:00
vramik
5aafc99673 Remove em.refresh(realm) call during realm removal in JpaRealmProvider 
Closes #19430
 2023-04-03 09:27:13 +02:00
Alexander Schwartz
9affc262bd Consistent handling of enums in the database schema 
Closes #19404
 2023-03-30 12:14:43 +02:00
Michal Hajas
e49dfe534e Fix missing migration when reading TERMS_AND_CONDITIONS required action in legacy store 
Closes #17277
 2023-03-29 16:43:01 +02:00
Pedro Hos
bd0a23a865 /users/count endpoint with search field has different behavior than /users query endpoint #17620 
closes #17620
 2023-03-24 13:43:47 +01:00
Martin Kanis
5e7793b64d Unexpected invalid_grant error on offline session refresh when client session is not in the cache 
Closes #9959

Co-authored-by: Martin Kanis <mkanis@redhat.com>
Co-authored-by: Lex Cao <lexcao@foxmail.com>
 2023-03-15 12:39:43 +01:00
Klaus Betz
20a7a5acdb fix: consider identity provider models from third-party packages 2023-01-31 06:05:02 -08:00
Alexander Schwartz
7933f0489d Align startup of Quarkus with the regular startup to ensure boostrap locks are created. 
Also fixing an issue where DBLockGlobalLockProviderFactory held on to an old session, which lead to a closed DB connection on Quarkus.

Closes #16642
 2023-01-30 12:59:40 +01:00
Alexander Schwartz
6d0e112bf1 Ensure lock table has its primary key created, and re-enable the DBLockTest 
Closes #15487
 2022-12-20 08:50:14 +01:00
Alexander Schwartz
e4804de9e3 Changing Quarkus transaction handling for JPA map storage to JTA 
This has been recommended as the supported way of transaction handling by the Quarkus team.
Adding handling of exceptions thrown when committing JTA.
Re-adding handling of exceptions when interacting with the entity manager, plus wrapping access to queries to map exceptions during auto-flushing.

Closes #13222
 2022-12-09 10:07:05 -03:00
Pedro Igor
168734b817 Removing references to request and response from Resteasy 
Closes #15374
 2022-12-01 08:38:24 -03:00
Alexander Schwartz
4a91c07488 Use LOB handling query to select clients on Oracle 
Closes #15639
 2022-11-24 11:47:51 +01:00
Alexander Schwartz
b019172813 Fix query to work on OracleDB CLOB 
Closes #15528
 2022-11-23 13:49:01 +01:00
danielFesenmeyer
18381ecd2e Fix update of group mappers on certain changes of the group path 
The group reference in the mapper was not updated in the following cases:
- group rename: when an ancestor group was renamed
- (only for JpaRealmProvider, NOT for MapRealmProvider/MapGroupProvider) group move: when a group was converted from subgroup to top-level or when a subgroup's parent was changed

Closes #15614
 2022-11-23 10:12:34 +01:00
Stefan Guilhen
bc014d3e69 Upgrade Liquibase to version 4.16.1 
* aligns with version used in quarkus

Closes #15089
 2022-11-16 13:14:23 +01:00
Hynek Mlnarik
556146f961 Fix performance issues with many offline sessions 
Fixes: #13340
 2022-11-15 13:05:45 +01:00
Jia Chen
c3d53ae6e0 Returns an empty groups stream without querying the database if a user doesn't belong to any groups 
Closes #12567
 2022-11-09 13:07:42 +01:00
danielFesenmeyer
ec30c52a00 Fix paging on the "Users in role" endpoint, when JPA persistence is used 
- add order-by-clause to the corresponding JPA query (ordering by username ASC)
- adjust admin-client RoleResource to return a List instead of a Set, by introducing new methods #getUserMembers (instead of #getRoleUserMembers - the "Role" prefix is not needed, because it is clear from the resource name that it's about roles)
- adjust tests to use the new method and check that the expected order is returned

Closes #14772
 2022-11-07 20:44:06 +01:00
Lex Cao
43a3677cc7 Fix slow deletion on deleteClientSessionsByRealm and deleteClientSessionsByUser when using mysql and mariadb by converting sub-query to join 2022-10-27 10:37:15 +02:00
Michal Hajas
883e83e625 Remove deprecated methods from data providers and models 
Closes #14720
 2022-10-25 09:01:33 +02:00
vramik
791c457c32 Add possibility to limit field length in legacy event store 
Closes #14888
 2022-10-21 15:16:26 +02:00
Alexander Schwartz
97c4495c4f Updating H2 database to 2.x 
Closes #12607

Co-authored-by: Stian Thorgersen <stian@redhat.com>
 2022-10-14 11:52:34 +02:00
danielFesenmeyer
f80a8fbed0 Avoid login failures in case of non-existing group or role references and update references in case of renaming or moving 
- no longer throw an exception, when a role or group cannot be found, log a warning instead
- update mapper references in case of the following events:
   - moving a group
   - renaming a group
   - renaming a role
   - renaming a client's Client ID (may affect role qualifiers)
- in case a role or group is removed, the reference still will not be changed
- extend and refactor integration tests in order to check the new behavior

Closes #11236
 2022-10-13 13:23:29 +02:00
Takashi Norimatsu
c60a34ac06 Keycloak 19 cannot register post logout redirect URIs whose length in total is over 4000 
Closes #14013
 2022-10-06 20:05:03 +02:00
Marek Posolda
fb24c86a3b
offline token issuance can cause violation of PRIMARY KEY constraint CONSTRAINT_OFFL_CL_SES_PK3 (#14658) 
closes #13706
 2022-10-03 12:54:12 +02:00
Alice Wood
1eb7e95b97 enhance existing group search functionality allow exact name search keycloak/keycloak#13973 
Co-authored-by: Abhijeet Gandhewar <agandhew@redhat.com>
 2022-09-30 10:37:52 +02:00
Alice Wood
55a660f50b enhance group search to allow searching for groups via attribute keycloak/keycloak#12964 
Co-authored-by: Abhijeet Gandhewar <agandhew@redhat.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2022-09-19 15:19:36 +02:00
danielFesenmeyer
3af1134975 Update IDP link username when sync mode is "force" 
Closes #13049
 2022-09-14 08:02:17 -03:00
Sebastian Schuster
cc8567e9f4 14294 fixed admin event expiration sql error 2022-09-12 09:15:47 +02:00
Christoph Leistert
7e5b45f999 Issue #8749: Add an option to control the order of the event query and admin event query 2022-09-11 21:30:12 +02:00
Martin Bartoš
0fcf5d3936 Reuse of token in TOTP is possible 
Fixes #13607
 2022-09-09 08:56:02 -03:00
Christoph Leistert
cc2bb96abc Fixes #9482: A user could be assigned to a parent group if he is already assigned to a subgroup. 2022-09-06 21:31:31 +02:00
Thomas Peter
19d69169b1 introduce expiration option for admin events 2022-09-06 16:05:53 +02:00
Michal Hajas
f69497eb28 KEYCLOAK-12988 Deprecate getUsers* methods in favor of searchUsers* variants 
Closes #14018
 2022-09-06 10:38:28 +02:00
Pedro Igor
2cc4b54404
Do not cache policies if they no longer exist (#12797) 
Closes #12657

Co-authored-by: Michal Hajas <mhajas@redhat.com>

Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2022-08-25 13:52:30 +02:00
Arnaud Martin
af0d97e534 Delete broker links for federated users when an identity provider is deleted 
Closes #13731
 2022-08-25 08:24:09 +02:00
Douglas Palmer
c00514d659
Support for post_logout_redirect_uris in OIDC client registration (#12282) 
Closes #10135
 2022-07-25 10:57:52 +02:00
Alexander Schwartz
a14501dd77 Remove concurrently removed elements from the result 
Closes #13245
 2022-07-22 08:25:15 +02:00
Alexander Schwartz
f490638971 Fall back to standard Liquibase locking 
As DBLockProvider is "none" for the Map storage providers, there is no locking provided by DB Lock
provider.

Liquibase's classic lock provider has issues that need to be tackled in a follow-up issue, see https://github.com/liquibase/liquibase/issues/1311

Closes #13130
 2022-07-19 10:45:31 +02:00
Alexander Schwartz
29a501552e Disable the JpaUserFederatedStorageProvider when map storage is enabled 
Closes #12895
 2022-07-07 10:47:42 -03:00
Alexander Schwartz
4b20e90292 Move session persistence package to legacy-private module 
Also, disabling the jpa session persister when map storage is enabled.

Closes #12712
 2022-07-04 10:05:26 -03:00
Jon Koops
06d1b4faab Restore enum variant of ResourceType 
This reverts commit 3b5a578934.
 2022-06-30 12:20:51 -03:00
Alexander Schwartz
692ce0cd91 Moving ClientStorageProvider to the legacy modules 
This prepares the move of CachedObject and CacheableStorageProviderModel

Closes #12531

fixup! Moving ClientStorageProvider to the legacy modules
 2022-06-29 20:04:32 +02:00
vramik
3b5a578934 Change enum ResourceType to interface with String constants 
Closes #12485
 2022-06-29 13:35:11 +02:00
Pedro Igor
c972ec4383 Allow to conditionally bootstrap the default persistence unit 
Closes #12662
 2022-06-27 08:26:37 -03:00
Alexander Schwartz
cb0c881821 rename SingleEntityCredentialManager to SubjectCredentialManager 2022-06-21 08:53:06 +02:00
Hynek Mlnarik
e396d0daa1 Renaming SingleUserCredentialManager and UserModel.getUserCredentialManager(): 
- class SingleUserCredentialManager to SingleEntityCredentialManager
- method UserModel.getUserCredentialManager() to credentialManager()

Renaming of API without "get" prefix to make it consistent with other APIs like for example with KeycloakSession
 2022-06-21 08:53:06 +02:00
Alexander Schwartz
bc8fd21dc6 SingleUserCredentialManager moving in 
- UserStorageManager now handles authentication for old Kerberos+LDAP style
- new getUserByCredential method in MapUserProvider would eventually do the same.
 2022-06-21 08:53:06 +02:00
Marek Posolda
eed944292b
Make script providers working on JDK 17 (#11322) 
Closes #9945
 2022-05-27 12:28:50 +02:00
Michal Hajas
0bda7e6038 Introduce map event store with CHM implementation 
Closes #11189
 2022-05-17 12:57:35 +02:00
Michal Hajas
d3b43a9f59 Make sure there is always Realm or ResourceServer when searching for authz entities 
Closes #11817
 2022-05-11 07:20:01 -03:00
vramik
0d83b51b20 Enhance Map authz entities with REALM_ID (ResourceServer with CLIENT_ID) searchable field 
Co-authored-by Michal Hajas <mhajas@redhat.com>

Closes #10883
 2022-05-03 12:56:27 +02:00
Sven-Torben Janus
0efa4afd49 Evaluate composite roles for hardcoded LDAP roles/groups 
Closes: 11771

see also KEYCLOAK-18308
 2022-05-02 14:13:37 +02:00
vramik
5248815091 Disable infinispan realm and user cache for map storage tests 
Closes #11213
 2022-04-25 09:38:49 +02:00
Stefan Guilhen
b29b27d731 Ensure code does not rely on a particular format for the realm id or component id 2022-04-20 14:40:38 +02:00
Pedro Igor
52d205ca91
Allow exposing some initial provider config options via web site (#10572) 
* Allow exposing some initial provider config options via web site

Co-authored-by: Stian Thorgersen <stian@redhat.com>

Closes #10571

* Include type to provider options, and hide build-icon column as it's not relevant

Co-authored-by: stianst <stianst@gmail.com>
 2022-04-19 08:01:42 +02:00
msvechla
820ab52dce
Add support for filtering by enabled attribute on users count endpoint (#9842) 
Resolves #10896
 2022-04-13 13:57:22 -03:00
Joerg Matysiak
235f0f3963 Add index to admin events table to improve performance of admin event view 
Closes #10625
 2022-04-06 09:12:35 +02:00
Michal Hajas
99c06d1102
Authorization services refactoring 
Closes: #10447 

* Prepare logical layer to distinguish between ResourceServer id and client.id
* Reorder Authz methods: For entities outside of Authz we use RealmModel as first parameter for each method, to be consistent with this we move ResourceServer to the first place for each method in authz
* Prepare Logical (Models/Adapters) layer for returning other models instead of ids
* Replace resourceServerId with resourceServer model in PermissionTicketStore
* Replace resourceServerId with resourceServer model in PolicyStore
* Replace resourceServerId with resourceServer model in ScopeStore
* Replace resourceServerId with resourceServer model in ResourceStore
* Fix PermissionTicketStore bug
* Fix NPEs in caching layer
* Replace primitive int with Integer for pagination parameters
 2022-03-22 20:49:40 +01:00
Bruno Oliveira da Silva
8aa394ca6b Update to Liquibase 4.8.0 
Closes #10678

Co-authored-by: Stefan Guilhen <sguilhen@redhat.com>
Co-authored-by: Martin Kanis <mkanis@redhat.com>
 2022-03-16 13:46:31 -03:00
Alexander Schwartz
8d1a47f768 adding missing log4j configuration to prevent errors in the log 
Closes #10613
 2022-03-14 10:12:49 -03:00
Pedro Igor
ad865e75c1 Change the flush mode to auto and fixing how entities are checked if they are loaded in the EM 
Closes #10411
 2022-03-11 12:21:52 -03:00
Michael Parlee
722ce950bf Improve user search performance 
Removes bulder.lower() from user search queries on email and username.

Closes #8893
 2022-03-04 14:15:14 +01:00
Vlasta Ramik
aa6a131b73
Change String client.id to ClientModel client in ResourceServerStore 
Closes #10442
 2022-02-24 12:46:26 +01:00
Luca Graf
febb447919 KEYCLOAK-19297 Use real 'external' client object id to store AuthenticatedClientSession in UserSession object, so that the client session can be looked by the client object id in further requests. 2022-02-18 12:42:59 +01:00
Stefan Guilhen
7c1d6eae43
Upgrade to Liquibase 4.6.2 
* Upgrade to Liquibase 4.6.2
* Add valid checksums to changesets to allow migration to newest liquibase
* Update liquibase licenses

Co-authored-by: Martin Kanis <mkanis@redhat.com>
 2022-02-09 12:56:46 +01:00
Martin Kanis
0471ec4941 Cross-site validation for lazy loading of offline sessions & Switch default offline sessions to lazy loaded 2022-02-03 21:43:47 +01:00
bal1imb
9621d513b5 KEYCLOAK-18727 Improve user search query 2022-01-26 17:03:05 +01:00
Guus der Kinderen
213b1f5042 Closes #9562: Add DB index for UserEntity getRealmUserByServiceAccount 2022-01-20 09:52:54 +01:00
Stefan Guilhen
2fd1593abf Set order of LiquibaseDBLockProviderFactory to 1 
- makes it the default provider when no provider is explicitly configured
- avoid NPE at server startup when other providers are present and none is set as default
 2022-01-13 08:30:25 +01:00
Dominik DS
93419a1797
KEYCLOAK-19289 check if values to set is not null (#8426) 
Closes #9529
 2022-01-12 09:22:01 +01:00
vramik
b4d720d615 Fix DB Migration Script to 13.0.0 
Closes #9138
 2021-12-15 14:00:29 +01:00
vramik
c6312e3308 KEYCLOAK-18717 KEYCLOAK-18716 KEYCLOAK-18715 KEYCLOAK-18713 KEYCLOAK-18712 KEYCLOAK-18711 JPA clients no-downtime store 2021-12-15 13:32:49 +01:00
Kashif Saadat
d9bf511406 KEYCLOAK-19052: Optimised (split) the clearExpiredEvents query to reduce execution time 2021-11-30 22:25:55 +01:00
vramik
6b8890f5dd KEYCLOAK-19525 Inconsistent creation of default-roles-<realm> 2021-11-23 21:30:12 +01:00
vramik
dacf28af84 KEYCLOAK-19536 Removal of client creates new instance of provider for each client role 2021-10-13 13:05:18 +02:00
Bart Monhemius
5b0986e490 [KEYCLOAK-18891] Add support for searching users by custom user attributes 
Users can now be searched by custom attributes using 'q' in the query parameters. The implementation is roughly the same as search clients by custom attributes.
 2021-10-12 13:08:47 +02:00
Michal Hajas
da0c945475 KEYCLOAK-18940 Add support for searching composite roles 2021-10-01 12:41:19 +02:00
Daniel Fesenmeyer
0a2f8f5b63 KEYCLOAK-17887 fix endpoint for creating or updating realm localization texts for a given locale (UnsupportedOperation was thrown because RealmAdapter tried to change unmodifiable map): 
- fix RealmAdapter to create a new map instead of trying to change unmodifiable map
- only provide POST endpoints for creating or updating the texts (to have the endpoints consistent with other Admin API endpoints)
- add tests
 2021-09-30 15:07:56 +02:00
Pedro Igor
10e425315f [KEYCLOAK-19274] - Avoid loading queries from properties at runtime for Dist.X 2021-09-24 09:26:43 +02:00
Daniel Fesenmeyer
339224578e KEYCLOAK-10603 adjust assignments to roles (user-role and group-role assignments, client-scope and client "scope mappings"): allow assignments of roles which are already indirectly assigned (e.g. by composite role) 
- extend RoleMapperModel with method hasDirectRole(RoleModel), which only checks for direct assignment in contrast to the existing method hasRole(RoleModel)
- extend ScopeContainerModel with method hasDirectScope(RoleModel), which only checks for direct scope mapping in contrast to the existing method hasScope(RoleModel)
- use the new hasDirectRole and hasDirectScope methods to check whether a role is in the "available" list and whether it can be assigned (previously, the hasRole method was used for this purpose)
- add hint to UI that available roles contain effectively assigned roles which are not directly assigned
- adjust and extend tests
 2021-09-22 13:56:29 +02:00
Luca Graf
2c22ccbf97 KEYCLOAK-19286 Use client storage provider id to construct client StorageId, so that a valid 'external' client id will be generated. 2021-09-20 19:43:20 +02:00
Dominik
4090114398 KEYCLOAK-16246 Revert changes from workaround made in KEYCLOAK-16244 after upgrading to quarkus 2 
Also fixed a small type in testclass.
This reverts commit 9b2f2015f7.
 2021-09-16 15:42:48 -03:00
rmartinc
47484c1aed KEYCLOAK-18842: deleteExpiredClientSessions very slow on MariaDB 2021-09-10 08:25:33 +02:00
vramik
d216f8f748 KEYCLOAK-19104 Add custom ForeignKeySnapshotGenerator 2021-09-02 09:59:26 +02:00
Martin Kanis
6886bd6651 KEYCLOAK-18941 ExecutionException when computed future - InfinispanCacheInitializer 2021-08-05 18:28:27 +02:00
Hynek Mlnarik
2acb43a627 KEYCLOAK-18617 Fix index on client attributes 2021-08-05 15:35:55 +02:00
Hynek Mlnarik
0cdce1340d KEYCLOAK-18680 Always close result stream 2021-07-30 09:40:39 +02:00
bal1imb
fbaeb18a5f KEYCLOAK-18471 Added ID to admin event object. 2021-07-16 12:46:07 +02:00
Daniel Fesenmeyer
a25c70784c KEYCLOAK-18467 support unicode for realm localization texts 2021-07-15 10:30:42 +02:00
Hryhorii Hevorkian
2803685cd7 KEYCLOAK-18353 Implement Pushed Authorization Request inside the Keycloak 
Co-authored-by: Takashi Norimatsu <takashi.norimatsu.ws@hitachi.com>
Co-authored-by: mposolda <mposolda@gmail.com>
 2021-07-03 08:47:42 +02:00
vramik
2b9b50d50a KEYCLOAK-18194 fix migration of default role when realm id contains apostrophe 2021-07-01 11:22:11 +02:00
Hynek Mlnarik
8a83ec83ac KEYCLOAK-18589 map-storage profile for KeycloakServer 2021-06-30 20:47:17 +02:00
vramik
e3c76035b2 KEYCLOAK-18359 Default role migration is not performed correctly when empty realm id 2021-06-14 20:54:37 +02:00
Václav Muzikář
9854f21ace KEYCLOAK-18332 Client Scopes are reset to realm's default when Client is updated 2021-06-11 07:41:18 +02:00
vramik
95bf912dc9 KEYCLOAK-18035 Fix update client with default default scope assigned as optional 2021-06-07 16:22:55 +02:00
vramik
2bf727d408 KEYCLOAK-17753 remove KeycloakModelUtils.isClientScopeUsed method 2021-05-28 21:07:14 +02:00
Michal Hajas
4dcb69596b KEYCLOAK-18146 Search for clients by client attribute when doing saml artifact resolution 2021-05-27 23:02:22 +02:00
Hynek Mlnarik
3d8f152787 KEYCLOAK-17747 KEYCLOAK-17754 Optimize getClients() calls 2021-05-27 22:12:56 +02:00
Hynek Mlnarik
94f676cb95 KEYCLOAK-18286 Add index to client_attributes 2021-05-27 13:31:33 +02:00
Martin Kanis
1ab0d585a9
KEYCLOAK-11019 Initial support for lazy offline user-session loading 
Co-authored-by: Thomas Darimont <thomas.darimont@googlemail.com>
Co-authored-by: Thomas Darimont <thomas.darimont@gmail.com>
 2021-05-26 09:54:28 +02:00
Hynek Mlnarik
860fc4c06c KEYCLOAK-17756 KEYCLOAK-17757 Optimize IdP-first lookup 2021-05-20 14:44:55 +02:00
Pedro Igor
a0f8d2bc0e [KEYCLOAK-17399] - Review User Profile SPI 
Co-Authored-By: Vlastimil Elias <vlastimil.elias@worldonline.cz>
 2021-05-20 08:44:24 -03:00
vramik
1c283cdebc KEYCLOAK-14301 OTP secrets migrated incorrectly 2021-05-20 13:19:27 +02:00
vramik
3913526934 KEYCLOAK-18031 Update to 13.0.0 fails due to liquibase error 2021-05-20 11:29:02 +02:00
mhajas
e609949264 KEYCLOAK-17267 Add index to user attribute name and value to support user sync from ldap 2021-05-19 13:38:11 +02:00
Hynek Mlnarik
c02a706a86 KEYCLOAK-17748 Optimize validation of redirect URIs in logout endpoint 
Reimplementation of KEYCLOAK-17718
 2021-05-18 20:31:21 +02:00
vramik
4d776cd780 KEYCLOAK-18137 Fix introduced SPI name 2021-05-18 20:30:21 +02:00
Václav Muzikář
62e6883524 KEYCLOAK-17084 KEYCLOAK-17434 Support querying clients by client attributes 2021-05-14 13:58:53 +02:00
Peter Flintholm
919899b994 KEYCLOAK-18039: Optimise offline session load on startup 
Co-authored-by: Hynek Mlnarik <hmlnarik@redhat.com>
 2021-05-13 16:26:26 +02:00
Hynek Mlnarik
8feefe94ac KEYCLOAK-18074 Ignore server version for MySQL in ChangeLogHistoryService 2021-05-12 15:01:30 +02:00
Pedro Igor
6397671c88 [KEYCLOAK-17885] - Delete user-managed policies when removing groups 2021-05-10 16:33:23 -03:00
vramik
020dd530b9 KEYCLOAK-18009 Invalid role creation with oracle database 2021-05-06 09:01:42 +02:00
mposolda
20fc430be0 KEYCLOAK-17874 Server cannot be started with oracle19cRAC 2021-05-05 13:12:07 +02:00
vramik
0cecd0f33f KEYCLOAK-17992 MSSQL not updatable 2021-05-05 13:12:07 +02:00
Hynek Mlnarik
96501760e0 KEYCLOAK-17501 Add support for map storage in WildFly 2021-05-03 16:00:30 +02:00
Hynek Mlnarik
7d4255b2a1 KEYCLOAK-17871 Add support for running parallel model tests 2021-04-30 16:13:57 +02:00
Hynek Mlnarik
3e91e6f966 KEYCLOAK-17870 Fix ConcurrentModificationException upon liquibase initialization 2021-04-30 16:13:57 +02:00
Takashi Norimatsu
65c48a4183
KEYCLOAK-12137 OpenID Connect Client Initiated Backchannel Authentication (CIBA) (#7679) 
* KEYCLOAK-12137 OpenID Connect Client Initiated Backchannel Authentication (CIBA)

Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
Co-authored-by: Christophe Lannoy <c4r1570p4e@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: mposolda <mposolda@gmail.com>
 2021-04-29 15:56:39 +02:00
vramik
162043beec KEYCLOAK-17615 Move database initialization from KeycloakApplication to JpaConnectionProviderFactory 2021-04-28 13:43:48 +02:00
Yoshiyuki Tabata
45202bd49a KEYCLOAK-17637 Client Scope Policy for authorization service 2021-04-26 08:58:33 -03:00
Hynek Mlnarik
ff4c0e4412 KEYCLOAK-16935 Fix liquibase to work with MySQL 8.0.23+ 2021-04-21 20:20:33 +02:00
Michal Hajas
1e2db74d86 KEYCLOAK-16932 Authorization map storage 2021-04-16 17:26:16 +02:00
Takashi Norimatsu
42dec08f3c
KEYCLOAK-16805 Client Policy : Support New Admin REST API (Implementation) (#7780) 
* KEYCLOAK-16805 Client Policy : Support New Admin REST API (Implementation)

* support tests using auth-server-quarkus

* Configuration changes for ClientPolicyExecutorProvider

* Change VALUE of table REALM_ATTRIBUTES to NCLOB

* add author tag

* incorporate all review comments

Co-authored-by: mposolda <mposolda@gmail.com>
 2021-04-06 16:31:10 +02:00
vramik
185075d373 KEYCLOAK-14552 Realm Map Store 2021-03-31 15:49:03 +02:00
rmartinc
0a0caa07d6 KEYCLOAK-17215 Slowness issue while hitting /auth/admin/realms/$REALM/clients?viewableOnly=true after DELETE a role 2021-03-31 12:57:17 +02:00
vramik
c3b9c66941 KEYCLOAK-17460 invalidate client when assigning scope 2021-03-30 10:58:16 +02:00
Michito Okai
298ab0bc3e KEYCLOAK-7675 Support for Device Authorization Grant 2021-03-15 10:09:20 -03:00
Hiroyuki Wada
9d57b88dba KEYCLOAK-7675 Prototype Implementation of Device Authorization Grant. 
Author:    Hiroyuki Wada <h2-wada@nri.co.jp>
Date:      Thu May 2 00:22:24 2019 +0900

Signed-off-by: Łukasz Dywicki <luke@code-house.org>
 2021-03-15 10:09:20 -03:00
vramik
6e501946b1 KEYCLOAK-17021 Client Scope map store 2021-03-08 21:59:28 +01:00
Pedro Igor
0f30b3118a [KEYCLOAK-16676] - Client attributes should not be stored if null or empty 2021-03-03 15:37:05 +01:00
stefvdwel
11b0c23937 Reduced code duplication 2021-02-17 09:40:19 -03:00
stefvdwel
5a500055f6 Added permission ticket /count endpoint. Todo: testing 2021-02-17 09:40:19 -03:00
Pedro Igor
cdf0ead957
[KEYCLOAK-16780] - Allow batching writes to storage when running migration (#7717) 
Co-authored-by: Hynek Mlnařík <hmlnarik@users.noreply.github.com>

Co-authored-by: Hynek Mlnařík <hmlnarik@users.noreply.github.com>
 2021-01-29 09:35:19 -03:00
Martin Kanis
8432513daa KEYCLOAK-16908 Refactor UserSessionPersisterProvider 2021-01-29 09:29:00 +01:00
mposolda
99a70267d9 KEYCLOAK-16801 Improve performance of ClearExpiredEvents background task 2021-01-27 09:57:46 +01:00
Michito Okai
7f421fb20a KEYCLOAK-16844 Create an index to support offline sessions loading 2021-01-21 22:48:54 +01:00
Hynek Mlnarik
78c05d2da2 KEYCLOAK-16118 Replace MapStorage.entrySet() with search by criteria 
* Add model class parameter to MapStorage
* Add shortcut read(id) method to MapKeycloakTransaction
 2021-01-20 16:20:56 +01:00
Martin Kanis
9f580e3ed8 KEYCLOAK-15695 Streamification cleanup 2021-01-20 14:39:53 +01:00
Michal Hajas
ba8e2fef6b KEYCLOAK-15524 Cleanup user related interfaces 2021-01-18 16:56:10 +01:00
Yoshiyuki Tabata
ab1dba5fa6 KEYCLOAK-11908 Support for conditional creating indices based on number 
of records
 2021-01-12 09:06:27 +01:00
vramik
1402d021de KEYCLOAK-14846 Default roles processing 2021-01-08 13:55:48 +01:00
Michal Hajas
8e376aef51
KEYCLOAK-15847 Add MapUserProvider 2020-12-10 08:57:53 +01:00
Stefan Guilhen
edef93cd49 [KEYCLOAK-16232] Streamify the UserCredentialStore and UserCredentialManager interfaces 2020-12-07 19:48:35 +01:00
Stefan Guilhen
73d0bb34c4 [KEYCLOAK-16232] Replace usages of deprecated collection-based methods with the respective stream variants 2020-12-07 19:48:35 +01:00
Hynek Mlnarik
363df6cab4 KEYCLOAK-16405 Tests for storage logical layer 2020-11-25 12:16:48 +01:00
Stefan Guilhen
84df008bc2 [KEYCLOAK-16341] Make the new stream-based methods in server-spi user interfaces default instead of the collection-based versions. 
- this ensures that providing implementation for the collection-based methods is enough, which preserves
   backwards compatibility with older custom implementations.
 - alternative interfaces now allow new implementations to focus on the stream variants of the query methods.
 2020-11-18 21:07:51 +01:00
mposolda
9b2f2015f7 KEYCLOAK-16244 RealmRealmLocalizationResourceTest fails on auth-server-quarkus 2020-11-11 14:56:31 +01:00
Pedro Igor
852c4a57ff [KEYCLOAK-14468] - Scope permission sometimes not removed when removing scopes 2020-11-11 08:44:28 +01:00
Martin Kanis
d9029b06b9 KEYCLOAK-15889 Streamification of ProtocolMappers 2020-11-10 16:40:34 +01:00
Stefan Guilhen
aa46735173 [KEYCLOAK-15200] Complement methods for accessing users with Stream variants 2020-11-10 15:13:11 +01:00
Hynek Mlnarik
f0bdcdd204 KEYCLOAK-16113 Add JPA event test 2020-10-30 21:08:27 +01:00
Christoph Leistert
e131de9574 KEYCLOAK-14855 Added realm-specific localization texts which affect texts in every part of the UI (admin console / login page / personal info page / email templates). Also new API endpoints and a new UI screen to manage the realm-specific localization texts were introduced. 
Co-authored-by: Daniel Fesenmeyer <daniel.fesenmeyer@bosch.io>
 2020-10-30 08:02:43 -03:00
vramik
785f2e78bc KEYCLOAK-14977 create MapRoleProvider 2020-10-30 08:15:22 +01:00
Martin Kanis
b494b8bb44 KEYCLOAK-16034 Not scroll-able event queries for postgres and mssql 2020-10-30 08:10:00 +01:00
Hynek Mlnarik
925f089d62 KEYCLOAK-16077 Remove need for MapStorage.replace 2020-10-29 15:40:47 +01:00
mposolda
4f93dc8376 KEYCLOAK-11693 Clean startup log output in Keycloak.X 2020-10-23 09:33:54 -03:00
Martin Kanis
f5c52345fc KEYCLOAK-16033 Revert Jpa*EventQuery to getResultList 2020-10-22 13:33:30 +02:00
Daniel Fesenmeyer
de8d2eafa3 KEYCLOAK-14781 Extend Admin REST API with search by federated identity 
- Add parameters idpAlias and idpUserId to the resource /{realm}/users and allow it to be combined with the other search parameters like username, email and so on
- Add attribute "federatedIdentities" to UserEntity to allow joining on this field
- extend integration test "UserTest"
 2020-10-22 08:51:26 +02:00
mhajas
4556e858ad KEYCLOAK-15522 Use AbstractStorageManager in UserStorageManager 2020-10-15 20:41:13 +02:00
Martin Kanis
086f7b4696 KEYCLOAK-15450 Complement methods for accessing realms with Stream variants 2020-10-14 08:16:49 +02:00
Thomas Darimont
12576e339d KEYCLOAK-15146 Add support for searching users by emailVerified status 
We now allow to search for users by their emailVerified status.
This enables users to easily find users and deal with incomplete user accounts.
 2020-09-29 08:28:59 -03:00
mhajas
12bc84322a KEYCLOAK-14974 Map group storage provider 2020-09-21 15:56:32 +02:00
Martin Kanis
f037dabdc1 KEYCLOAK-15199 Use stream variant method in jpa/RoleAdapter.getFirstAttribute 2020-09-17 13:18:21 +02:00
Martin Kanis
5d5e56dde3 KEYCLOAK-15199 Complement methods for accessing roles with Stream variants 2020-09-16 16:29:51 +02:00
testn
706299557e KEYCLOAK-15174: ResourceServerAdapter.toEntity checks the wrong type 2020-09-10 12:19:25 -03:00
testn
c288175c03 KEYCLOAK-15208: PermissionTicketAdapter checks for the wrong type 2020-09-10 12:16:48 -03:00
Martin Kanis
4e9bdd44f3 KEYCLOAK-14901 Replace deprecated ClientProvider related methods across Keycloak 2020-09-07 13:11:55 +02:00
Martin Kanis
d59a74c364 KEYCLOAK-15102 Complement methods for accessing groups with Stream variants 2020-08-28 20:56:10 +02:00