Because the current distinguished name determination is security provider
dependent, a new authenticator option is added to use the canonical format
of the distinguished name, as descriped in
javax.security.auth.x500.X500Principal.getName(String format).
We now wrap the result of a role-selection in an JS array and
use the config value as is for rendering, instead of extracting
the first component (which was the first char, since the value
is a string).
Previously any mapper that used role selection could not be
used due to `LDAPMapperCreateCtrl` generating invalid config structures.
Since the component configuration is represented via
org.keycloak.representations.idm.ComponentRepresentation whose
`config` property is a `MultivaluedHashMap`
config values needs to be passed as an Array. However the
LDAPMapperCreateCtrl in (users.js) only passed the role as a String.
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
Added the metadata url as an attribute on the IDP in the keycloak saml configuration which then propagates through to the DefaultSamlDeployment where it is used on the construction of the SamlDescriptorPublicKeyLocator thereby allowing support for ADFS or other IDP which uses a path that is different to the Keycloak IDP.
To make this work when testing with ADFS a change was made to SamlDescriptorIDPKeysExtractor because it would not extract keys from metadata which contained the EntityDescriptor as the root element. The solution was to change the xpath expression in SamlDescriptorIDPKeysExtractor so that it does not require a wrapping EntitiesDescriptor but instead loads all EntityDescriptors located in the document. This allows it to handle a single EntityDescriptor or multiple descriptors wrapped in an EntitiesDescriptor in the same xpath expression. A unit test SamlDescriptorIDPKeysExtractorTest has been added which validates that keys can be loaded in both scenarios.
