libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions
13034 commits 4 branches 5 tags 483 MiB
Commit graph

2508 commits

Author SHA1 Message Date
mposolda
41dc94fead KEYCLOAK-14483 Broker state param fix 2021-02-24 19:07:58 -03:00
mposolda
6f409d088a KEYCLOAK-15239 Reset Password Success Message not shown when Kerberos is Enabled 2021-02-23 16:15:50 -03:00
Pedro Igor
dbc6514bfc [KEYCLOAK-17206] - Avoid removing attributes when updating user and profile 2021-02-23 08:41:41 +01:00
Juan Manuel Rodriguez Alvarado
6255ebe6b5 [KEYCLOAK-16536] Implement Audit Events for Authorization Services requests 2021-02-22 17:28:59 -03:00
mposolda
ed8d5a257f KEYCLOAK-16517 Make sure that just real clients with standardFlow or implicitFlow enabled are considered for redirectUri during logout 2021-02-22 14:30:32 +01:00
mposolda
0058011265 KEYCLOAK-16006 User should not be required to re-authenticate after revoking consent to an application 2021-02-22 14:29:42 +01:00
Pedro Igor
1dc0b005fe [KEYCLOAK-17087] - X509 OCSP Validation Not Checking Intermediate CAs 2021-02-22 13:50:19 +01:00
Lukas Hanusovsky
4a2830bc2e KEYCLOAK-15849 : auth-remote-server exclude -> removed duplicated annotation, fixed @Test(timeout) bug -> replaced by lambda expression. 2021-02-22 13:40:47 +01:00
Pedro Igor
9356843c6c [KEYCLOAK-16521] - Fixing secret for non-confidential clients 2021-02-19 08:38:49 +01:00
Torsten Roemer
750f5fdb0a KEYCLOAK-14577 OIDCIdentityProvider incorrectly sets firstName and lastName in BrokeredIdentityContext 2021-02-18 19:50:27 +01:00
Torsten Roemer
00ee6bb9fa KEYCLOAK-14577 OIDCIdentityProvider incorrectly sets firstName and lastName in BrokeredIdentityContext 2021-02-18 19:50:27 +01:00
rmartinc
056b52fbbe KEYCLOAK-16800 userinfo fails with 500 Internal Server Error for service account token 2021-02-18 19:37:52 +01:00
Pedro Igor
431f137c37 [KEYCLOAK-17123] - Avoid validation and updates for read-only attributes during updates 2021-02-17 17:57:46 +01:00
stefvdwel
b97f5eb128 Added PermissionTicket count test. 2021-02-17 09:40:19 -03:00
Pedro Igor
2593c3dbc4 [KEYCLOAK-15893] - Incorrect resource match is returned for some cases when using wildcard in uri 2021-02-17 12:51:26 +01:00
mposolda
80bf0b6bad KEYCLOAK-16708 Unexpected exceptions during client authentication 2021-02-12 18:27:54 +01:00
Pedro Igor
ca2a761d4b [KEYCLOAK-16886] - Updating user account removes attributes 2021-02-12 12:01:50 -03:00
Michito Okai
33bb1fda38 KEYCLOAK-16931 Authorization Server Metadata of 
introspection_endpoint_auth_methods_supported and
introspection_endpoint_auth_signing_alg_values_supported
 2021-02-11 14:53:49 +01:00
Pedro Igor
7a4733acc9 [KEYCLOAK-14034] - Adding tests for matching uris once updated 2021-02-11 09:44:43 -03:00
mposolda
456cdc51f2 KEYCLOAK-15719 CORS headers missing on userinfo error response 2021-02-11 13:37:42 +01:00
diodfr
cb12fed96e KEYCLOAK-4544 Detect existing user before granting user autolink 2021-02-11 11:06:49 +01:00
Pedro Igor
f6c3ec5d9e [KEYCLOAK-14366] - Missing check for iss claim in JWT validation on Client Authentication (Token Endpoint) 2021-02-09 13:54:06 +01:00
Pedro Igor
ab9a38ec27 [KEYCLOAK-13115] - Unable to add a role to a user if username query matches multiple acounts 2021-02-09 13:49:25 +01:00
Pedro Igor
eb37a1ed69 [KEYCLOAK-17031] - ClientInvalidationClusterTest failing on Quarkus due to unreliable comparison 2021-02-05 16:09:27 +01:00
mposolda
f4b5942c6c KEYCLOAK-16755 ClearExpiredUserSessions optimization. Rely on infinispan expiration rather than Keycloak own background task. 2021-02-04 08:49:42 +01:00
Yang Xie
cffe24f815 KECLOAK-16009 Add a method to check if the token request has duplicate parameters 2021-02-03 16:10:41 +01:00
Florian Apolloner
eeec82dea3 KEYCLOAK-16656 Only set execution authenticator for form flows. 2021-01-29 17:19:15 +01:00
Martin Kanis
8432513daa KEYCLOAK-16908 Refactor UserSessionPersisterProvider 2021-01-29 09:29:00 +01:00
Pedro Igor
922d7da3ae [KEYCLOAK-16497] - AuthzClient.create() fails when env variables are used in auth-server-url 2021-01-28 12:07:58 -03:00
Hynek Mlnarik
60e4bd622f KEYCLOAK-16828 Fix HttpClient failures and close HttpResponses 2021-01-28 08:38:34 +01:00
rmartinc
f3a4991b6a KEYCLOAK-15975 NPE in DefaultThemeManager.loadTheme() if theme directory is absent 2021-01-27 22:05:19 +01:00
Pedro Igor
0c501f8302 [KEYCLOAK-16837] - Authz client still relying on refresh tokens when doing client credentials 2021-01-27 12:23:32 -03:00
mposolda
99a70267d9 KEYCLOAK-16801 Improve performance of ClearExpiredEvents background task 2021-01-27 09:57:46 +01:00
Takashi Norimatsu
b89edabcfc KEYCLOAK-16889 Client Policy : Refactor Test Class 2021-01-27 09:06:08 +01:00
Martin Kanis
9f580e3ed8 KEYCLOAK-15695 Streamification cleanup 2021-01-20 14:39:53 +01:00
Thomas Darimont
6315fe5d22 KEYCLOAK-16464 Test mapping of enabled and emailVerified user model attribute to LDAP attributes 2021-01-20 09:24:06 +01:00
Takashi Norimatsu
bcf313f321 KEYCLOAK-16858 Client Policy - Improper retainAll operation in Client Scope Condition and other minor bugs 2021-01-20 09:10:21 +01:00
Martin Bartoš
9df7fdbc55 KEYCLOAK-14718 Adding test case for User Client Role Mapper 2021-01-19 17:49:36 +01:00
Michal Hajas
ba8e2fef6b KEYCLOAK-15524 Cleanup user related interfaces 2021-01-18 16:56:10 +01:00
mposolda
dae4a3eaf2 KEYCLOAK-16468 Support for deny list of metadata attributes not updateable by account REST and admin REST 
(cherry picked from commit 79db549c9d561b8d5efe3596370190c4da47e4e1)
(cherry picked from commit bf4401cddd5d3b0033820b1cb4904bd1c8b56db9)
 2021-01-18 13:17:51 +01:00
mposolda
eac3329d22 KEYCLOAK-14019 Improvements for request_uri parameter 
(cherry picked from commit da38b36297a5bd9890f7df031696b516268d6cff)
 2021-01-18 13:05:09 +01:00
Pedro Igor
c631013031 [KEYCLOAK-16515] - Scope permissions not added to result if previous permission is granted 2021-01-14 17:08:05 +01:00
Takashi Norimatsu
5f445ec18e KEYCLOAK-14200 Client Policy - Executor : Enforce Holder-of-Key Token 
Co-authored-by: Hryhorii Hevorkian <hhe@adorsys.com.ua>
 2021-01-12 11:21:41 +01:00
Takashi Norimatsu
f423c0dc51 KEYCLOAK-16249 Client Policy - Condition : Client - Any Client 2021-01-08 17:29:50 +01:00
vramik
1402d021de KEYCLOAK-14846 Default roles processing 2021-01-08 13:55:48 +01:00
Takashi Norimatsu
05dfac75ca KEYCLOAK-14202 Client Policy - Executor : Enforce secure signature algorithm for Signed JWT client authentication 
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
 2021-01-06 08:58:20 +01:00
Thomas Darimont
1a7600e356
KEYCLOAK-13923 Support PKCE for OIDC based Identity Providers (#7381) 
* KEYCLOAK-13923 - Support PKCE for Identity Provider

We now support usage of PKCE for OIDC based Identity Providers.

* KEYCLOAK-13923 Warn if PKCE information cannot be found code-to-token request in OIDCIdentityProvider

* KEYCLOAK-13923 Pull up PKCE handling from OIDC to OAuth IdentityProvider infrastructure

* KEYCLOAK-13923 Adding test for PKCE support for OAuth Identity providers

* KEYCLOAK-13923 Use URI from KeycloakContext instead of HttpRequest

Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>

Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2021-01-05 10:59:59 -03:00
mposolda
d4a36d0d9c KEYCLOAK-16350 invalid_scope error response should be displayed for openid-connect/auth 2021-01-05 12:55:53 +01:00
Stefan Guilhen
d6422e415c [KEYCLOAK-16508] Complement methods for accessing user sessions with Stream variants 2020-12-15 19:52:31 +01:00
Takashi Norimatsu
edabbc9449 KEYCLOAK-14203 Client Policy - Executor : Enforce HTTPS URIs 2020-12-15 09:31:20 +01:00
Martin Bartoš
cfc035ee42 KEYCLOAK-15066 Internal Server error when calling random idp endpoint 2020-12-14 16:37:53 +01:00
Cédric Couralet
f4abc86a66 KEYCLOAK-16112 don't remove username attribute 2020-12-14 15:46:25 +01:00
Takashi Norimatsu
200b53ed1e KEYCLOAK-14192 Client Policy - Condition : Author of a client - User Role 2020-12-14 15:37:05 +01:00
Michal Hajas
8e376aef51
KEYCLOAK-15847 Add MapUserProvider 2020-12-10 08:57:53 +01:00
Martin Kanis
3ddedc49f5 KEYCLOAK-11417 Internal server error on front channel logout with expired session 2020-12-09 14:45:04 +01:00
Martin Bartoš
873a69305f KEYCLOAK-15264 Import realm using directory provider twice with IGNORE_EXISTING will cause NPE for clientId 2020-12-08 11:28:07 +01:00
Martin Kanis
f6be378eca KEYCLOAK-14556 Authentication session map store 2020-12-07 20:48:59 +01:00
Stefan Guilhen
edef93cd49 [KEYCLOAK-16232] Streamify the UserCredentialStore and UserCredentialManager interfaces 2020-12-07 19:48:35 +01:00
Stefan Guilhen
73d0bb34c4 [KEYCLOAK-16232] Replace usages of deprecated collection-based methods with the respective stream variants 2020-12-07 19:48:35 +01:00
Takashi Norimatsu
7da5a71314 KEYCLOAK-14191 Client Policy - Condition : Author of a client - User Group 2020-12-03 17:52:06 +01:00
Ian
be4c99dfe5 KEYCLOAK-15287 Ability to add custom claims to the AccessTokenResponse 2020-12-03 17:28:03 +01:00
Takashi Norimatsu
a51e0cc484 KEYCLOAK-14197 Client Policy - Condition : Client - Client Host 2020-12-02 09:05:42 +01:00
vramik
cd9e01af90 KEYCLOAK-16502 Migration of DELETE_ACCOUNT role 2020-12-01 13:10:20 +01:00
Jan Lieskovsky
833bf98643 [KEYCLOAK-15692] Upgrade to Wildfly "21.0.1.Final" 
Base fixes:
* [KEYCLOAK-15780]      Upgrade Keycloak to Wildfly 21.0.0.Beta1 / Wildfly Core 13.0.0.Beta6
* [KEYCLOAK-16031]      Upgrade Keycloak to Wildfly 21.0.0.Final / Wildfly Core 13.0.1.Final
* [KEYCLOAK-16442]      Upgrade Keycloak to Wildfly 21.0.1.Final / Wildfly Core 13.0.3.Final

Other (dependent) fixes:
* [KEYCLOAK-15408]      Deprecate former Wildfly and Wildfly Core versions in Arquillian's
                        testsuite pom.xml file as part of the upgrade script
* [KEYCLOAK-15442]      Update the version of 'jboss-parent' as part of the Wildfly upgrade
                        script if necessary
* [KEYCLOAK-15474]      Add --verbose and --force options to the Wildfly upgrade automated script
* [KEYCLOAK-15649]      Update "urn:jboss:domain:infinispan:10.0" version as part of the Wildfly
                        upgrade automated script
* [KEYCLOAK-15652]      Wildfly upgrade automated script - Align Python artifact version
                        comparsion algorithm with the Maven / Java one

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
 2020-11-26 09:25:29 +01:00
Hynek Mlnarik
5c2122d36f KEYCLOAK-16444 Initialize JAXP components consistently 2020-11-25 14:20:19 +01:00
zak905
4f330f4a57 KEYCLOAK-953: add allowing user to delete his own account feature 2020-11-24 15:50:07 +01:00
Stan Silvert
0afd55f32c KEYCLOAK-14547: Make New Account Console the default. 2020-11-23 20:56:05 +01:00
Takashi Norimatsu
5dd5b5bedf KEYCLOAK-16392 Client Policy - Condition : NPE without any initial configuration 2020-11-23 12:07:28 +01:00
st
a7666d4ccf KEYCLOAK-11699 add support for 127.0.0.1 for native app 2020-11-20 11:03:29 +01:00
Douglas Palmer
43e075afa5 [KEYCLOAK-14352] JavaScript injection vulnerability of Realm registration REST API 2020-11-18 10:48:11 -03:00
Martin Bartos
ab347df5ee KEYCLOAK-14915 Upgrade registration screen to PF4 2020-11-18 10:54:17 +01:00
Takashi Norimatsu
9ce2e9b1f7 KEYCLOAK-14193 Client Policy - Condition : Client - Client Access Type 2020-11-18 09:49:22 +01:00
Hynek Mlnarik
29e3d89f3a KEYCLOAK-16297 Fix HttpClient stale connections 2020-11-16 14:59:00 +01:00
Martin Bartoš
59aa31084e KEYCLOAK-16143 Login form expected, but registraion form is displayed 2020-11-13 21:36:51 +01:00
Michal Hajas
a766a1dd16 KEYCLOAK-16074 Fix check3pCookiesSupported message callback 2020-11-13 16:01:50 -03:00
Takashi Norimatsu
21c7af1c53 KEYCLOAK-14207 Client Policy - Executor : Enforce more secure client signature algorithm when client registration 2020-11-13 09:24:59 +01:00
Takashi Norimatsu
244a1b2382 KEYCLOAK-14196 Client Policy - Condition : Client - Client Scope 2020-11-12 08:40:28 +01:00
vmuzikar
01be601dbd KEYCLOAK-14306 OIDC redirect_uri allows dangerous schemes resulting in potential XSS 
(cherry picked from commit e86bec81744707f270230b5da40e02a7aba17830)

Conflicts:
    testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java
    testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ClientTest.java
    services/src/main/java/org/keycloak/validation/DefaultClientValidationProvider.java
 2020-11-12 08:21:54 +01:00
Takashi Norimatsu
e35a4bcefc KEYCLOAK-14206 Client Policy - Executor : Enforce more secure state and nonce treatment for preventing CSRF 2020-11-11 21:11:34 +01:00
Pedro Igor
852c4a57ff [KEYCLOAK-14468] - Scope permission sometimes not removed when removing scopes 2020-11-11 08:44:28 +01:00
niwde
c69f92831b
[KEYCLOAK-16215] Typo in EventConfigTest 2020-11-10 13:54:39 -03:00
Martin Kanis
d9029b06b9 KEYCLOAK-15889 Streamification of ProtocolMappers 2020-11-10 16:40:34 +01:00
Takashi Norimatsu
a0b1710735 KEYCLOAK-14198 Client Policy - Condition : Client - Client IP 2020-11-10 15:37:26 +01:00
Stefan Guilhen
aa46735173 [KEYCLOAK-15200] Complement methods for accessing users with Stream variants 2020-11-10 15:13:11 +01:00
Takashi Norimatsu
a63814da67 KEYCLOAK-14201 Client Policy - Executor : Enforce Proof Key for Code Exchange (PKCE) 2020-11-09 08:18:05 +01:00
Thomas Darimont
de20830412 KEYCLOAK-9551 KEYCLOAK-16159 Make refresh_token generation for client_credentials optional. Support for revocation of access tokens. 
Co-authored-by: mposolda <mposolda@gmail.com>
 2020-11-06 09:15:34 +01:00
vmuzikar
2df62369c3 KEYCLOAK-15295 User can manage resources with just "view-profile" role using new Account Console 
(cherry picked from commit 1b063825755d9f5aa13e612757e8ef7299430761)
 2020-11-06 08:55:57 +01:00
stianst
6b2e1cbc5f KEYCLOAK-16167 Enable Account REST API by default 2020-11-06 08:06:03 +01:00
Takashi Norimatsu
6dc136dfc0 KEYCLOAK-14199 Client Policy - Executor : Enforce more secure client authentication method when client registration 2020-11-05 20:42:49 +01:00
Martin Bartos
7522d5ac74 KEYCLOAK-15841 Upgrade rest of the minor forms to PF4 2020-11-05 17:58:41 +01:00
Hynek Mlnarik
7b8575fa1a KEYCLOAK-16090 Work around LDAPUserLoginTest false failures 2020-11-03 08:38:54 +01:00
Christoph Leistert
e131de9574 KEYCLOAK-14855 Added realm-specific localization texts which affect texts in every part of the UI (admin console / login page / personal info page / email templates). Also new API endpoints and a new UI screen to manage the realm-specific localization texts were introduced. 
Co-authored-by: Daniel Fesenmeyer <daniel.fesenmeyer@bosch.io>
 2020-10-30 08:02:43 -03:00
vramik
785f2e78bc KEYCLOAK-14977 create MapRoleProvider 2020-10-30 08:15:22 +01:00
Johannes Knutsen
23c575c236 KEYCLOAK-15399: Wrong token type in token response. bearer vs Bearer 2020-10-28 10:38:22 -03:00
Pedro Igor
24f90ca6cb [KEYCLOAK-15406] - Grant access when evaluating user-managed permission for the owner 2020-10-28 09:59:24 -03:00
Martin Bartos
a8df7d88a1 [KEYCLOAK-14139] Upgrade login screen to PF4 2020-10-27 20:24:07 +01:00
Hynek Mlnarik
267f1797d4 KEYCLOAK-15735 Fix LDAPSamlIdPInitiatedVaryingLetterCaseTest failures on few DBs 2020-10-23 15:15:03 +02:00
Hynek Mlnarik
e80538c60c KEYCLOAK-15921 Fix auth server URL 2020-10-23 15:14:01 +02:00
Daniel Fesenmeyer
de8d2eafa3 KEYCLOAK-14781 Extend Admin REST API with search by federated identity 
- Add parameters idpAlias and idpUserId to the resource /{realm}/users and allow it to be combined with the other search parameters like username, email and so on
- Add attribute "federatedIdentities" to UserEntity to allow joining on this field
- extend integration test "UserTest"
 2020-10-22 08:51:26 +02:00
Sven-Torben Janus
850d3e7fef KEYCLOAK-15511 OTP registration during login with LDAP read-only 
When LDAP user federation is configured in read-only mode, it is not
possible to set required actions for users from LDAP.
Keycloak credential model allows for registering OTP devices when LDAP
ist configured with "Import Users" flag enabled. Registering OTP devices
needs to be done via the account management console and works as
expecetd. However, it fails, if a user has to register aN OTP device
during login (i.e. within the authentication flow), because the OTP Form
Authenticator tries to enforce OTP registration via setting the
corresponding required action for the user. That fails, because the user
is read-only.
To work around this, the required action is set on the authentication
session instead.
 2020-10-21 17:00:11 +02:00