Commit graph

1068 commits

Author SHA1 Message Date
Pedro Igor
54ebc1918c [KEYCLOAK-3135] - Using abstract policy representation when creating policies and updating tests 2017-04-12 00:52:13 -03:00
Pedro Igor
d60dcb4c62 [KEYCLOAK-3135] - Some more tests and making policy type rest api more generic 2017-04-12 00:52:13 -03:00
Pedro Igor
8e64bc3e4d Tests for new permission management rest api 2017-04-12 00:52:13 -03:00
Pedro Igor
cf1e8d1dd8 [KEYCLOAK-3135] - Tests and typos 2017-04-12 00:52:13 -03:00
Pavel Drozd
bfd76d7813 Merge pull request #3962 from mhajas/KEYCLOAK-4366
KEYCLOAK-4366
2017-04-10 08:44:52 +02:00
Stian Thorgersen
83d0f313ce Merge pull request #4011 from mstruk/KEYCLOAK-4719
KEYCLOAK-4719 CLI tests fail when run from within the IDE
2017-04-07 09:17:19 +02:00
Bill Burke
3ce0c57e17 Merge pull request #3831 from Hitachi/master
KEYCLOAK-2604 Proof Key for Code Exchange by OAuth Public Clients
2017-04-06 15:36:08 -04:00
Bill Burke
c198f4ffa7 Merge pull request #4015 from patriot1burke/master
KEYCLOAK-4727 KEYCLOAK-4652
2017-04-06 15:27:49 -04:00
Bill Burke
26db0dd1fc Merge pull request #4016 from pedroigor/KEYCLOAK-4726
[KEYCLOAK-4726] - Multiple role policies crash realm delete
2017-04-06 13:21:53 -04:00
Pedro Igor
1f50421a54 [KEYCLOAK-4726] - Multiple role policies crash realm delete 2017-04-06 12:36:03 -03:00
Bill Burke
1b3549f828 oops 2017-04-06 10:49:48 -04:00
Bill Burke
201d2c6aac Merge remote-tracking branch 'upstream/master' 2017-04-06 10:44:43 -04:00
Bill Burke
31074c3c8d KEYCLOAK-4727 KEYCLOAK-4652 2017-04-06 10:44:33 -04:00
Stian Thorgersen
af4c74f1d9 Merge pull request #3718 from thomasdarimont/issue/KEYCLOAK-4163-improve-support-for-email-addresses
KEYCLOAK-4163 Improve support for e-mail addresses
2017-04-06 15:34:30 +02:00
Marko Strukelj
0269db0e85 KEYCLOAK-4719 CLI tests fail when run from within the IDE 2017-04-06 12:46:05 +02:00
Marek Posolda
ad1ca78034 Merge pull request #4002 from mposolda/master
KEYCLOAK-4705 Running test from IDE should log INFO to the console
2017-04-04 11:52:10 +02:00
Pavel Drozd
30b785c60d Merge pull request #3999 from vmuzikar/ie-fix
KEYCLOAK-4351 Stabilize TermsAndConditions test in IE
2017-04-04 10:48:22 +02:00
Pavel Drozd
b4c5eb8354 Merge pull request #3994 from vramik/KEYCLOAK-4534
KEYCLOAK-4534 ClientInitiatedAccountLinkTest fails with auth-server-w…
2017-04-04 10:47:36 +02:00
Pavel Drozd
91c3977d71 Merge pull request #3988 from mhajas/KEYCLOAK-3955
KEYCLOAK-3955
2017-04-04 10:46:12 +02:00
mposolda
457f183d46 KEYCLOAK-4705 Running test from IDE should log INFO to the console 2017-04-04 10:15:22 +02:00
Vaclav Muzikar
5e360cf919 KEYCLOAK-4351 Stabilize TermsAndConditions test in IE 2017-04-04 07:40:16 +02:00
vramik
ca6d8c9dbe KEYCLOAK-4534 ClientInitiatedAccountLinkTest fails with auth-server-wildlfy 2017-03-30 12:47:51 +02:00
mhajas
3bb587530b KEYCLOAK-3955 2017-03-28 16:05:44 +02:00
mhajas
bc05010ece Fix javascript adapter tests 2017-03-28 15:02:44 +02:00
Takashi Norimatsu
ef3aef9381 Merge branch 'master' into master 2017-03-28 16:21:40 +09:00
Vaclav Muzikar
66c13b4a72 KEYCLOAK-4613 Fix Console UI and Social Login tests 2017-03-27 15:25:24 +02:00
mhajas
36fc643bfb KEYCLOAK-4366 2017-03-27 11:22:01 +02:00
Pavel Drozd
ed67dcc712 Merge pull request #3975 from vmuzikar/KEYCLOAK-4660
KEYCLOAK-4660 Add support for Chrome CLI switches to Arquillian Tests…
2017-03-27 09:38:33 +02:00
Pavel Drozd
4aa996c2db Merge pull request #3959 from mhajas/KEYCLOAK-4141
KEYCLOAK-4141 Added saml tests
2017-03-27 09:36:41 +02:00
Bill Burke
71f0c01d4f Merge pull request #3980 from patriot1burke/master
KEYCLOAK-4664 KEYCLOAK-4665
2017-03-25 20:12:22 -04:00
Bill Burke
f554fd90db Merge pull request #3911 from almighty/oso_provider
[KEYCLOAK-4528] Adds Openshift Identity Provider as part of social brokers
2017-03-25 19:25:44 -04:00
Bill Burke
dd8a64f30c KEYCLOAK-4664 2017-03-25 11:21:11 -04:00
Vaclav Muzikar
6a093abfdb KEYCLOAK-4660 Add support for Chrome CLI switches to Arquillian Testsuite 2017-03-24 12:25:49 +01:00
Bill Burke
815e9e8e02 Merge pull request #3968 from vramik/KEYCLOAK-4229
KEYCLOAK-4229 Add migration test from 2.5.5
2017-03-23 14:48:39 -04:00
Bill Burke
d1e71acf10 Merge pull request #3961 from jblashka/maxLifespanInvalidationFixes
KEYCLOAK-4612 Fix CachePolicy.MAX_LIFESPAN invalidation
2017-03-23 14:25:21 -04:00
Bartosz Majsak
210143738e Merge branch 'master' into oso_provider 2017-03-23 13:45:07 +01:00
vramik
1fccff7e7c KEYCLOAK-4229 Add migration test from 2.5.5 2017-03-22 14:19:35 +01:00
mhajas
7c1eb5582a KEYCLOAK-4141 Added saml tests 2017-03-21 10:41:06 +01:00
Jared Blashka
61bd9bb58c Fix CachePolicy.MAX_LIFESPAN invalidation 2017-03-20 22:56:35 -04:00
Peter Nalyvayko
b2f10359c8 KEYCLOAK-4335: x509 client certificate authentication
Started on implementing cert thumbprint validation as a part of x509 auth flow. Added a prompt screen to give users a choice to either log in based on the identity extracted from X509 cert or to continue with normal browser login flow authentication; clean up some of the comments

x509 authentication for browser and direct grant flows. Implemented certificate to user mapping based on user attribute

Implemented CRL and OCSP certificate revocation checking and added corresponding configuration settings to set up responderURI (OCSP), a location of a file containing X509CRL entries and switiches to enable/disable revocation checking; reworked the certificate validation; removed superflous logging; changed the certificate authentication prompt page to automatically log in the user after 10 seconds if no response from user is received

Support for loading CRL from LDAP directory; finished the CRL checking using the distribution points in the certificate; updated the instructions how to add X509 authentication to keycloak authentication flows; minor styling changes

Stashing x509 unit test related changes; added the steps to configure mutual SSL in WildFly to the summary document

A minor fix to throw a security exception when unable to check cert revocation status using OCSP; continue working on README

Changes to the formating of the readme

Added a list of features to readme

Fixed a potential bug in X509 cert user authenticator that may cause NPE if the client certificate does not define keyusage or extended key usage extensions

Fixed compile time errors in X509 validators caused by the changes to the user credentials model in upstream master

Removed a superfluous file created when merging x509 and main branches

X509 authentication: removed the PKIX path validation as superflous

Reverted changes to the AbstractAttributeMapper introduced during merging of x509 branch into main

Merge the unit tests from x509 branch

added mockito dependency to services project; changes to the x509 authenticators to expose methods in order to support unit tests; added a default ctor to CertificateValidator class to support unit testing; updated the direct grant and browser x509 authenticators to report consistent status messages; unit tests to validate X509 direct grant and browser authenticators; fixed OCSP validation to throw an exception if the certificate chain contains a single certificate; fixed the CRL revocation validation to only use CRL distribution point validation only if configured

CRL and OSCP mock tests using mock netty server. Changed the certificate validator to better support unit testing.

changes to the mockserver dependency to explicitly exclude xercesImpl that was causing SAMLParsingTest to fail

Added a utility class to build v3 certificates with optional extensions to facilitate X509 unit testing; removed supoerfluous certificate date validity check (undertow should be checking the certificate dates during PKIX path validation anyway)

X509: changes to make configuring the user identity extraction simplier for users - new identity sources to map certificate CN and email (E) attributes from X500 subject and issuer names directly rather than using regular expressions to parse them

X509 fixed a compile error caused by the changes to the user model in master

Integration tests to validate X509 client certificate authentication

Minor tweaks to X509 client auth related integration tests

CRLs to support x509 client cert auth integration tests

X509: reverted the changes to testrealm.json and updated the test to configure the realm at runtime

X509 - changes to the testsuite project configuration to specify a path to a trust store used to test x509 direct grant flow; integration tests to validate x509 authentication in browser and direct grant flows; updated the client certificate to extend its validatity dates; x509 integration tests and authenticators have been refactored to use a common configuration class

X509 separated the browser and direct grant x509 authenction integration tests

x509 updated the authenticator provider test to remove no longer supported cert thumbprint authenticator

x509 removed the dependency on mockito

x509 re-implemented OCSP certificate revocation client used to check revocation status when logging in with x509 certificate to work around the dependency on Sun OCSP implementation; integration tests to verify OCSP revocation requests

index.txt.attr is needed by openssl to run a simple OCSP server

x509: minor grammar fixes

Add OCSP stub responder to integration tests

This commit adds OCSP stub responder needed for the integration tests,
and eliminates the need to run external OCSP responder in order to run
the OCSP in X509OCSPResponderTest.

Replace printStackTrece with logging

This commit replaces call to printStackTrace that will end up going to
the stderr with logging statement of WARN severity.

Remove unused imports

Removed unused imports in
org.keycloak.authentication.authenticators.x509 package.

Parameterized Hashtable variable

Removed unused CertificateFactory variable

Declared serialVersionUID for Serializable class

Removed unused CertificateBuilder class

The CertificateBuilder was not used anywhere in the code, removing it to
prevent technical debt.

Removing unused variable declaration

`response` variable is not used in the test, removed it.

Made sure InputStreams are closed

Even though the InputStreams are memory based, added try-with-resources
to make sure that they are closed.

Removed deprecated usage of URLEncoder

Replaced invocation of deprecated method from URLEncoder with Encode
from Keycloak util package.

Made it more clear how to control OCSP stub responder in the tests

X509 Certificate user authentication: moved the integration unit tests into their own directory to fix a failing travis test job

KEYCLOAK-4335: reduced the logging level; added the instructions how to run X.509 related tests to HOW-TO-RUN.md doc; removed README.md from x509 folder; removed no longer used ocsp profile and fixed the exclusion filter; refactored the x509 base test class that was broken by the recent changes to the integration tests

KEYCLOAK-4335: fixed a few issues after rebasing
2017-03-17 05:24:57 -04:00
Stian Thorgersen
a87ee04024 Bump to 3.1.0.CR1-SNAPSHOT 2017-03-16 14:21:40 +01:00
Pavel Drozd
b2d677256d Merge pull request #3877 from mhajas/KEYCLOAK-3955
KEYCLOAK-3955 Add CORS tests to integration arquillian testsuite
2017-03-15 23:52:03 +01:00
Stian Thorgersen
feeac69197 Merge pull request #3888 from daklassen/KEYCLOAK-4421
KEYCLOAK-4421 Change any http maven urls to https to reduce build-time MITM vulnerability
2017-03-15 09:54:21 +01:00
Thomas Darimont
b782892769 KEYCLOAK-4163 Improve support for e-mail addresses
Added support for user friendly email addresses as well as dedicated
reply-to addresses for emails being sent by Keycloak.
Both can be customized via the email settings per realm in
the admin-console.
User friendly email addresses use the format:
"Friendly Name"<email@example.org> and provide way to add a meaning
full name to an e-mail address.

We also allow to specify an optional envelope from bounce address.
If a mail sent to a user could not be delivered the email-provider
will sent a notification to that address.

See: https://en.wikipedia.org/wiki/Bounce_address

Add test for proper email headers in sent messages
2017-03-14 18:22:54 +01:00
Bill Burke
6d51862057 Merge pull request #3897 from anderius/feature/KEYCLOAK-4504-redirect-logout
[WIP] Saml broker: Option to specify logout request binding
2017-03-14 11:32:26 -04:00
David Klassen
32d3f760ec KEYCLOAK-4421: Change http url to https
Change any http maven urls to https to reduce build-time MITM vulnerability
2017-03-14 10:18:40 +01:00
Pedro Igor
9d1d22565c Merge pull request #3938 from pedroigor/authz-fixes
AuthZ Services Fixes
2017-03-13 15:20:41 -03:00
Pedro Igor
e7e6314146 [KEYCLOAK-4555] - Fixes and improvements to evaluation code 2017-03-13 14:08:54 -03:00
Marek Posolda
649ca36ece Merge pull request #3945 from mposolda/master
KEYCLOAK-4572 AccountTest.changeProfileNoAccess unstable
2017-03-13 15:57:43 +01:00
Pavel Drozd
253c8a342b Merge pull request #3941 from pdrozd/KEYCLOAK-4569
KEYCLOAK-4569 SSSDTest rewrited to be usable in different enviroments
2017-03-13 15:50:06 +01:00