libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions
10225 commits 4 branches 5 tags 483 MiB
Commit graph

1505 commits

Author SHA1 Message Date
Pavel Drozd
af97a84108
Merge pull request #4635 from vmuzikar/fix-x509 
KEYCLOAK-5720 Fix X.509 tests
 2017-11-13 11:56:16 +01:00
Stian Thorgersen
4295f4ec31 KEYCLOAK-1886 Added cors headers to errors in token endpoint 2017-11-10 12:01:21 +01:00
mposolda
b033ce0669 KEYCLOAK-5371 SessionExpirationCrossDCTest - improve stability. Remove checks for counts of sent messages 2017-11-09 22:18:47 +01:00
mposolda
a98f085be6 KEYCLOAK-5618 Fix SessionsPreloadCrossDCTest. Update HOW-TO-RUN docs. Ensure it's executed in travis. 2017-11-09 17:39:04 +01:00
Stian Thorgersen
128ff12f8f Bump versions 2017-11-09 15:37:21 +01:00
Marko Strukelj
dae0fafc8a KEYCLOAK-5040 ProfileAssume needs to use server info endpoint 2017-11-09 14:19:06 +01:00
Bruno Oliveira
26e253f4a5 [KEYCLOAK-5284] 2017-11-09 13:45:06 +01:00
Marko Strukelj
2854a2006e KEYCLOAK-5810 ClientTokenExchangeTest failures with -Pproduct profile 2017-11-09 13:44:10 +01:00
vmuzikar
2c2a332f80 KEYCLOAK-5332 Fix GitLab social test 2017-11-09 07:19:01 +01:00
vmuzikar
b21d5bbf04 KEYCLOAK-5805 Fix tests in the 'other' module 2017-11-09 07:01:27 +01:00
mposolda
62a1c187a2 KEYCLOAK-5716 KEYCLOAK-5738 Avoid infinispan deadlock. Ensure code-to-token works correctly in cross-dc 2017-11-07 09:01:59 +01:00
Hynek Mlnarik
fe2f65daac KEYCLOAK-5581 Fix SAML identity broker context serialization 2017-11-03 21:09:18 +01:00
vmuzikar
ef8adc15f4 KEYCLOAK-5720 Fix X.509 tests 2017-11-03 17:09:46 +01:00
Pedro Igor
3716fa44ac [KEYCLOAK-5728] - Permission Claims support 2017-10-27 12:40:30 -02:00
Hynek Mlnařík
248da4687a Merge pull request #4610 from hmlnarik/KEYCLOAK-5745-Extract-client-sessions-from-user-sessions 
KEYCLOAK-5745 Separate user and client sessions in infinispan
 2017-10-26 13:09:06 +02:00
Hynek Mlnarik
75c354fd94 KEYCLOAK-5745 Separate user and client sessions in infinispan 2017-10-26 10:39:41 +02:00
Bill Burke
903a4dd849 Merge pull request #4612 from patriot1burke/master 
KEYCLOAK-5273
 2017-10-25 13:54:32 -04:00
Bill Burke
de6eab6d5d fix 2017-10-25 13:00:58 -04:00
Bill Burke
8c1a3253fb KEYCLOAK-5273 2017-10-25 10:31:11 -04:00
Bruno Oliveira da Silva
375e01a074 KEYCLOAK-5278 (#4606) 2017-10-25 15:27:24 +02:00
Bill Burke
50ccb5e5f6 Merge pull request #4591 from abstractj/KEYCLOAK-5717 
KEYCLOAK-5717
 2017-10-24 17:38:28 -04:00
Pedro Igor
1840cc54e4 Merge pull request #4601 from pedroigor/KEYCLOAK-5726 
[KEYCLOAK-5726] - Support define enforcement mode for scopes on the adapter config
 2017-10-24 12:51:52 -02:00
Pedro Igor
80e9b08bb6 [KEYCLOAK-5726] - Tests for scopes-enforcement-mode ALL and ANY 2017-10-24 11:37:41 -02:00
Bruno Oliveira
4d762159ef KEYCLOAK-5717 2017-10-24 10:55:02 -02:00
Hynek Mlnařík
8e0cc2a5ea Merge pull request #4605 from mposolda/master 
KEYCLOAK-5710 Change cache-server to use backups based caches
 2017-10-24 14:40:01 +02:00
Pedro Igor
a6e1413d58 [KEYCLOAK-5726] - Support define enforcement mode for scopes on the adapter configuration 2017-10-24 10:39:54 -02:00
Pavel Drozd
a4ec32ba66 Merge pull request #4602 from vramik/KEYCLOAK-5244 
KEYCLOAK-5244 fix PasswordPolicyTest.testBlacklistPasswordPolicyWithT…
 2017-10-24 14:17:35 +02:00
mposolda
9a19e95b60 KEYCLOAK-5710 Change cache-server to use backups based caches 2017-10-24 11:52:08 +02:00
Stan Silvert
9083e5fe5c KEYCLOAK-5298: Enable autoescaping in Freemarker (#4561) 
* KEYCLOAK-5298: Enable autoescaping in Freemarker

* Fix several of the failing tests.

* Fix broken tests in integration-deprecated

* Fix last failing test.
 2017-10-23 12:03:00 -04:00
Stian Thorgersen
9b75b603e3 KEYCLOAK-5234 (#4585) 2017-10-23 16:13:22 +02:00
vramik
a3a1761eb7 KEYCLOAK-5244 fix PasswordPolicyTest.testBlacklistPasswordPolicyWithTestBlacklist on Wildfly 2017-10-23 12:11:36 +02:00
Bill Burke
73ba06b26b Merge pull request #4590 from patriot1burke/master 
KEYCLOAK-5698
 2017-10-20 14:58:07 -04:00
Bill Burke
92245e3fc8 fixes 2017-10-20 09:55:37 -04:00
Hynek Mlnarik
3248557897 KEYCLOAK-5707 Have travis run cross-dc tests when appropriate 2017-10-19 13:29:26 +02:00
Stian Thorgersen
d9ffc4fa21 KEYCLOAK-5225 (#4577) 
KEYCLOAK-5225 fix test

Fix
 2017-10-19 08:23:16 +02:00
Stian Thorgersen
fea4c54adc KEYCLOAK-5280 (#4576) 2017-10-19 08:02:23 +02:00
Pedro Igor
cedc095a9c [KEYCLOAK-4550] - Test invalid configuration for user policy 2017-10-18 18:42:55 -02:00
Thomas Darimont
3103e0fd0a KEYCLOAK-5244 Add BlacklistPasswordPolicyProvider (#4370) 
* KEYCLOAK-5244 Add BlacklistPasswordPolicyProvider

This introduces a new PasswordPolicy which can refer to
a named predefined password-blacklist to avoid users
choosing too easy to guess passwords.

The BlacklistPasswordPolicyProvider supports built-in as
well as custom blacklists.
built-in blacklists use the form `default/filename`
and custom ones `custom/filename`, where filename
is the name of the found blacklist-filename.

I'd propose to use some of the freely available password blacklists
from the [SecLists](https://github.com/danielmiessler/SecLists/tree/master/Passwords) project.

For testing purposes one can download the password blacklist
```
wget -O 10_million_password_list_top_1000000.txt https://github.com/danielmiessler/SecLists/blob/master/Passwords/10_million_password_list_top_1000000.txt?raw=true
```
to /data/keycloak/blacklists/

Custom password policies can be configured with the SPI
configuration mechanism via jboss-cli:
```
/subsystem=keycloak-server/spi=password-policy:add()
/subsystem=keycloak-server/spi=password-policy/provider=passwordBlacklist:add(enabled=true)
/subsystem=keycloak-server/spi=password-policy/provider=passwordBlacklist:write-attribute(name=properties.blacklistsFolderUri, value=file:///data/keycloak/blacklists/)
```

Password blacklist is stored in a TreeSet.

* KEYCLOAK-5244 Encode PasswordBlacklist as a BloomFilter

We now use a dynamically sized BloomFilter with a
false positive probability of 1% as a backing store
for PasswordBlacklists.

BloomFilter implementation is provided by google-guava
which is available in wildfly.

Password blacklist files are now resolved against
the ${jboss.server.data.dir}/password-blacklists.

This can be overridden via system property, or SPI config.
See JavaDoc of BlacklistPasswordPolicyProviderFactory for details.

Revised implementation to be more extensible, e.g. it could be
possible to use other stores like databases etc.

Moved FileSystem specific methods to FileBasesPasswordBlacklistPolicy.

The PasswordBlacklistProvider uses the guava version 20.0
shipped with wildfly. Unfortunately the arquillian testsuite
transitively depends on guava 23.0 via the selenium-3.5.1
dependency. Hence we need to use version 23.0 for tests but 20.0
for the policy provider to avoid NoClassDefFoundErrors in the
server-dist.

Configure password blacklist folder for tests

* KEYCLOAK-5244 Configure jboss.server.data.dir for test servers

* KEYCLOAK-5244 Translate blacklisted message in base/login
 2017-10-17 20:41:44 +02:00
Hynek Mlnařík
fe76b2428b Merge pull request #4563 from hmlnarik/KEYCLOAK-5656-Transport-factory-should-not-limit-to-a-single-DC-3 
KEYCLOAK-5656 Use standard infinispan remote-store
 2017-10-17 09:39:01 +02:00
Pavel Drozd
9c16a58d52 Merge pull request #4554 from vramik/KEYCLOAK-5672 
KEYCLOAK-5672 rewrite server-config-migration module to use offline mode
 2017-10-17 07:42:29 +02:00
vramik
cb2bd0fe1a KEYCLOAK-5672 rewrite server-config-migration module to use offline mode 2017-10-16 22:51:59 +02:00
Hynek Mlnarik
056ba75a72 KEYCLOAK-5656 Use standard infinispan remote-store 2017-10-16 21:49:42 +02:00
Bill Burke
31dccc9a5e Merge pull request #4509 from TeliaSoneraNorge/KEYCLOAK-5032 
KEYCLOAK-5032 Forward request parameters to another IdP
 2017-10-13 18:47:05 -04:00
Bill Burke
c66ce3a209 Merge pull request #4559 from micedre/KEYCLOAK-4052bis 
KEYCLOAK-4052 - add an option to validate Password Policy for ldap user storage
 2017-10-13 18:44:57 -04:00
Bill Burke
46d3ed7832 Merge remote-tracking branch 'upstream/master' 2017-10-13 17:00:57 -04:00
Bill Burke
d9af93850c KEYCLOAK-5683, KEYCLOAK-5684, KEYCLOAK-5682, KEYCLOAK-5612, KEYCLOAK-5611 2017-10-13 16:51:56 -04:00
Cédric Couralet
656fc5d7c0 KEYCLOAK-4052 - add an option to validate Password Policy for ldap user storage 2017-10-13 13:54:50 +02:00
mposolda
1874820008 KEYCLOAK-5371 Fix ConcurrentLoginCrossDCTest.concurrentLoginWithRandomDcFailures 2017-10-11 13:02:55 +02:00
mposolda
f5ff24ccdb KEYCLOAK-5371 Fix SessionExpirationCrossDCTest, Added ExecutorsProvider. Debug support for cache-servers in tests 2017-10-10 22:30:44 +02:00
Bill Burke
b0464f1751 Merge remote-tracking branch 'upstream/master' 2017-10-10 09:10:04 -04:00
Bill Burke
5bd4ea30ad rev 2017-10-10 09:09:51 -04:00
Marek Posolda
d336667972 Merge pull request #4527 from Hitachi/master 
OIDC Financial API Read Only Profile : scope MUST be returned in the response from Token Endpoint
 2017-10-10 11:37:45 +02:00
Carl Kristian Eriksen
50dd07217d KEYCLOAK-5032 Forward request parameters to another IdP 
Forwarding of prompt and acr_values, if provided in the authorization request.
If prompt is set in the configuration for the identity provider, the configuration overrules the request parameter.
 2017-10-09 16:15:27 +02:00
Marek Posolda
c6483f8b1e Merge pull request #4523 from abustya/master 
KEYCLOAK-5616 Processing of claims parameter
 2017-10-09 11:14:23 +02:00
Bill Burke
c8516c2349 support social external exchange 2017-10-06 16:44:26 -04:00
Hynek Mlnařík
00ddf03ad3 Merge pull request #4538 from vramik/KEYCLOAK-5586 
KEYCLOAK-5586 increase startup timeout for jboss containers
 2017-10-06 10:46:49 +02:00
vramik
940715a975 KEYCLOAK-5586 increase startup timeout for jboss containers 2017-10-06 10:06:26 +02:00
Pavel Drozd
945404be24 Merge pull request #4532 from vmuzikar/fix-twitter-test 
KEYCLOAK-5632 Fix Twitter social test
 2017-10-05 13:30:02 +02:00
Stian Thorgersen
698483ee17 Missing test (#4537) 2017-10-05 13:27:15 +02:00
Vaclav Muzikar
eab047c130 KEYCLOAK-5632 Fix Twitter social test 2017-10-04 15:29:28 +02:00
mposolda
bca4c35708 KEYCLOAK-5371 Fix ActionTokenCrossDCTest and BruteForceCrossDCTest 2017-10-04 13:25:45 +02:00
Hynek Mlnařík
9aa4c3cf22 Merge pull request #4530 from vramik/KEYCLOAK-5586 
KEYCLOAK-5586 crossdc tests on Wildfly using real database
 2017-10-04 13:10:08 +02:00
vramik
b0a1550df5 KEYCLOAK-5586 crossdc tests on Wildfly using real database 2017-10-04 12:00:18 +02:00
Pavel Drozd
98c63bc195 Merge pull request #4502 from mhajas/KEYCLOAK-5555 
KEYCLOAK-5555 Use driver from function argument for URL Asserts
 2017-10-04 08:00:45 +02:00
Takashi Norimatsu
6f6a467c7b OIDC Financial API Read Only Profile : scope MUST be returned in the 
response from Token Endpoint
 2017-10-04 12:59:49 +09:00
Áron Bustya
c2ffaa0777 Merge remote-tracking branch 'keycloak/master' 2017-10-03 14:53:40 +02:00
Áron Bustya
632414cc92 process claims parameter 
also support parsing from request object
 2017-10-03 14:51:46 +02:00
vramik
f806d4a5d6 KEYCLOAK-5586 Add support for testing cross dc tests on jboss-based containers 2017-10-03 14:01:45 +02:00
Bruno Oliveira da Silva
da72968085 KEYCLOAK-4401: Wrong message when a temporarily disabled user requests password reset (#4506) 2017-10-03 06:28:34 +02:00
Marek Posolda
faa5ec5125 Merge pull request #4520 from mposolda/master 
KEYCLOAK-5440 RestartLoginCookie field 'cs' not marked ignorable
 2017-10-02 20:03:34 +02:00
filipelautert
c4cc752e18 Fixing tests for Oracle (#4481) 2017-10-02 14:59:33 +02:00
mposolda
4a7013d550 KEYCLOAK-5440 RestartLoginCookie field 'cs' not marked ignorable 2017-10-02 14:19:27 +02:00
Bruno Oliveira da Silva
bb0bccc3c0 [KEYCLOAK-5486] Test email connection feature does not work the second time (#4517) 2017-10-02 13:14:50 +02:00
mposolda
7d641baf4e KEYCLOAK-5570 Added InvalidationCrossDCTest 2017-09-29 19:36:40 +02:00
Marek Posolda
13fe9e7cf8 Merge pull request #4510 from glavoie/KEYCLOAK-3303 
KEYCLOAK-3303: Allow reuse of refresh tokens.
 2017-09-29 17:07:45 +02:00
mposolda
3b6e1f4e93 KEYCLOAK-5007 Used single-use cache for tracke OAuth code. OAuth code changed to be encrypted and signed JWT 2017-09-29 13:20:22 +02:00
Gabriel Lavoie
134daeac7f KEYCLOAK-3303: Allow reuse of refresh tokens. 
- Configurable max reuse count.
 2017-09-28 15:30:40 -04:00
mhajas
01187901ea KEYCLOAK-5555 Use driver from function argument for URL Asserts 2017-09-27 10:09:46 +02:00
Bill Burke
fd025ae76b Merge pull request #4209 from guitaro/feature/group-search-and-pagination 
[KEYCLOAK-2538] - groups pagination and group search
 2017-09-23 20:52:19 -04:00
Bill Burke
9034708c99 Merge pull request #4474 from hmlnarik/KEYCLOAK-5254-NPE-in-SAMLIdentityProvider 
KEYCLOAK-5254 Fix NPE - NameID format is optional
 2017-09-23 20:39:50 -04:00
Bill Burke
537081ec9d Merge pull request #4494 from patriot1burke/master 
KEYCLOAK-5516
 2017-09-22 16:38:13 -04:00
Bill Burke
3020a04a8b Merge pull request #4490 from Fiercely/master 
Keycloak 2035
 2017-09-22 16:13:22 -04:00
Thomas Darimont
236b2b9273 KEYCLOAK-3599 Add Script based OIDC ProtocolMapper 2017-09-22 21:24:20 +02:00
Bill Burke
9d452b4bc3 Merge remote-tracking branch 'upstream/master' 2017-09-22 11:48:41 -04:00
Bill Burke
eb4f7f3b21 KEYCLOAK-5516 2017-09-22 11:48:30 -04:00
howcroft
e78bf5f876 Keycloak 2035 
This PR adds:
* an endpoint to Role that lists users with the Role
* a tab "Users in Role" in Admin console Role page
* it is applicable to Realm and Client Roles
* Extends UserQueryProvider with default methods (throwing Runtime Exception if not overriden)
* Testing in base testsuite and Console
 2017-09-22 15:05:49 +01:00
Bill Burke
15ddb2009d Merge pull request #4475 from mstruk/KEYCLOAK-5328 
KEYCLOAK-5328 Documentation issue for kcadm.sh set-password command
 2017-09-21 21:50:16 -04:00
Bill Burke
8ace0e68c3 KEYCLOAK-910 KEYCLOAK-5455 2017-09-21 17:15:18 -04:00
Bill Burke
ab58052a4c Merge pull request #4482 from patriot1burke/master 
KEYCLOAK-5491 KEYCLOAK-5492 KEYCLOAK-5490
 2017-09-19 14:01:40 -04:00
Pavel Drozd
c67a1d0469 Merge pull request #4483 from vmuzikar/KEYCLOAK-5495 
KEYCLOAK-5495 Update Arquillian Drone to 2.4.2
 2017-09-19 16:34:16 +02:00
Marko Strukelj
87cad0d84b KEYCLOAK-5328 Documentation issue for kcadm.sh set-password command 2017-09-18 20:01:31 +02:00
mposolda
ca92bcbf7f KEYCLOAK-5480 Cross-DC setup: Remote cache stores are connecting to Infinispan servers in both datacenters 2017-09-18 18:04:04 +02:00
Marek Posolda
fa35249afd Merge pull request #4480 from TeliaSoneraNorge/KEYCLOAK-5494 
Fix introspection error for pairwise access tokens
 2017-09-18 16:44:24 +02:00
Pedro Igor
e8ef050093 Merge pull request #4471 from pedroigor/KEYCLOAK-5095 
[KEYCLOAK-5095] - RPT should contain the RS as audience
 2017-09-18 09:32:47 -03:00
Martin Hardselius
6b687c4318 Fix offline validation errors 
Refactored token validation method to run user checks only if the user
session is valid.
 2017-09-18 11:26:57 +02:00
Vaclav Muzikar
b4aae198fc KEYCLOAK-5495 Update Arquillian Drone to 2.4.2 2017-09-18 09:52:45 +02:00
Bill Burke
2276279434 fix 2017-09-15 17:46:42 -04:00
Bill Burke
5a22b360f1 resolve conflicts 2017-09-15 16:37:35 -04:00
Bill Burke
f927ee7b4e KEYCLOAK-5491 KEYCLOAK-5492 2017-09-15 16:30:45 -04:00
Pavel Drozd
42bb09fa31 Merge pull request #4463 from vmuzikar/fix-socialtests 
KEYCLOAK-5437 Fix Facebook social login test
 2017-09-15 13:37:16 +02:00