libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions
14428 commits 4 branches 9 tags 483 MiB
Commit graph

3763 commits

Author SHA1 Message Date
Vlastimil Elias
2be5f528e4 KEYCLOAK-18700 - consistently record User profile attribute changes in 
UPDATE_PROFILE event
 2021-09-15 08:26:01 -03:00
bohmber
4fe7d6d318 KEYCLOAK-17110 
LDAP Connection Pool not used with org.keycloak.truststore.SSLSocketFactory
 2021-09-15 10:55:59 +02:00
Luca Leonardo Scorcia
6d0708d263
KEYCLOAK-17368 Show forwarded errors when a default remote IdP is configured (#7838) 2021-09-14 09:44:59 +02:00
bal1imb
67e3df654f KEYCLOAK-18740 Admin events trigger transaction rollback if exception is thrown. 2021-09-13 14:07:28 +02:00
Luca Leonardo Scorcia
af8354267b
KEYCLOAK-16462 X509 Auth: add option to revalidate certificate trust 2021-09-13 12:12:38 +02:00
David Hellwig
a6cd80c933
KEYCLOAK-16076 added new warining when cookies are disabled -with new branch- (#7632) 
* KEYCLOAK-16076 added new warining when cookies are disabled

Co-authored-by: David Hellwig <david.hellwig@bosch.com>
Co-authored-by: Christoph Leistert <christoph.leistert@bosch-si.com>
 2021-09-13 11:30:11 +02:00
Hynek Mlnarik
4518b3d3d1 KEYCLOAK-19143 Split note for broker and SP SAML request ID 2021-09-07 17:04:30 +02:00
Olivier Boudet
c7f8544b0c KEYCLOAK-18454 Reset password : wrong email instructions when duplicates email is allowed 2021-09-02 14:44:18 +02:00
Thomas Darimont
e217e9a175 KEYCLOAK-18818 Add CORS preflight handler to token revocation endpoint 2021-08-31 10:07:32 +02:00
vramik
5fe675b612 KEYCLOAK-18841 prevent deletion of default role using RoleContainerResource 2021-08-20 12:02:07 +02:00
Thomas Darimont
f16eb4d8b9 KEYCLOAK-18954 Refactor user consent list retrieval to avoid ConcurrentModificationException 
This avoids a ConcurrentModificationException to be thrown in UserResource.getConsents()
calls that got introduced in 4e8b18f560 by filtering
the resulting stream explicitly instead of removing items from the collection
that we iterate over, which triggered the CME in the first place.

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
 2021-08-18 10:39:44 +02:00
wuweixin
6431afe360 KEYCLOAK-18974 BitbucketIdentityProvider IdentityBrokerException message 
github => bitbucket
 2021-08-18 10:32:07 +02:00
rmartinc
5ff6ff57a8 [KEYCLOAK-18535] KeycloakSanitizerMethod causes java.lang.IndexOutOfBoundsException when there is more then one href in a sanitized message 2021-08-18 10:19:22 +02:00
bal1imb
269b661b8a KEYCLOAK-16633 Prevent deletion of internal clients. 2021-08-09 11:45:03 -03:00
Martin Kanis
b42f765c2a KEYCLOAK-18982 Token OIDC introspection endpoint should not update any of the timestamps 2021-08-05 18:21:16 +02:00
Yoshiyuki Tabata
b31b60fffe KEYCLOAK-18341 Support JWKS OAuth2 Client Metadata in the "by value" key loading method 2021-08-05 16:52:55 +02:00
mposolda
b1d39aa136 KEYCLOAK-18949 DirectGrant login should fail if authenticationSession contains some required actions 2021-08-04 08:50:27 +02:00
carlChen
a0b01b6ef4 KEYCLOAK-16703 The username returned by token introspect endpoint is null when remove or modify username mapper 2021-08-03 17:38:37 +02:00
Florian Ritterhoff
65480cb5a1 Prevent security flaw using passwordless authentication 
If you register without an password or delete your last token your account can be hijacked. This is can be done by simply trying to login in that moment where the account is without a token. You get the "normal" registration dialog and can capture the complete account.
 2021-08-03 10:49:45 -03:00
Sebastian Kanzow
4e8e4592ca [KEYCLOAK-18419] Support SAML 2.0 Encrypted IDs in Assertion 2021-08-03 11:55:36 +02:00
laskasn
f265d1d662 KEYCLOAK-18933 2021-08-02 15:27:08 +02:00
keycloak-bot
262ec3d031 Set version to 16.0.0-SNAPSHOT 2021-07-30 14:56:10 +02:00
Pedro Igor
afb0b16e43 [KEYCLOAK-18922] - Ignore empty values for internal attributes not set to user 2021-07-30 12:30:43 +02:00
Pedro Igor
ff70e2e04b [KEYCLOAK-18916] - Do not consider empty values when checking read-only attributes 2021-07-29 08:46:16 +02:00
Vlastimil Elias
32f2f095fe KEYCLOAK-7724 User Profile default validations 2021-07-29 08:42:37 +02:00
mposolda
4dacbb9e0b KEYCLOAK-16996 User not able to revoke his offline token for directGrant clients 2021-07-29 08:04:16 +02:00
mposolda
9b0e1fff8d KEYCLOAK-18903 More customizable OIDC WellKnown provider 2021-07-28 18:03:23 +02:00
mposolda
05dfed721a KEYCLOAK-18636 The mtls_endpoint_aliases claim is not advertized in the discovery document 2021-07-28 13:32:31 +02:00
Pedro Igor
ef72343a6a [KEYCLOAK-18882] - User Profile still tech preview 2021-07-28 08:45:35 +02:00
mposolda
4520cbd38c KEYCLOAK-18904 Support cert-bound tokens when doing client credentials grant. Client policies support for client credentials grant 2021-07-28 07:24:30 +02:00
mposolda
643b3c4c5a KEYCLOAK-18594 CIBA Ping Mode 2021-07-27 08:33:17 +02:00
Hynek Mlnarik
8889122dc1 KEYCLOAK-18845 Remove key type in map storage (simplify generics) 2021-07-23 17:04:20 +02:00
Takashi Norimatsu
9018fe9fad KEYCLOAK-18863 Global client profile for FAPI CIBA 2021-07-23 14:30:26 +02:00
Joerg Matysiak
9dff21d0a7 KEYCLOAK-18552 
* added group as attribute metadata
* validation for groups and references to groups
* adapted template to use show attribute groups
* test and integration tests for attribute groups
 2021-07-23 09:26:21 -03:00
Takashi Norimatsu
6436716514 KEYCLOAK-18834 Client Policies : ClientScopesCondition needs to be evaluated on CIBA backchannel authentication request and token request 2021-07-23 10:06:02 +02:00
Martin Bartoš
036239a901 KEYCLOAK-18643 Generic Javascript failure in server and adapters test pipeline 2021-07-23 08:47:27 +02:00
Takashi Norimatsu
84e19f1c57 KEYCLOAK-18833 FAPI-CIBA-ID1 : need to only accept confidential client on Backchannel Authentication endpoint 2021-07-23 08:26:36 +02:00
Luca Leonardo Scorcia
6bd7420907 KEYCLOAK-17290 SAML Client - Generate AttributeConsumingService SP metadata section 2021-07-22 21:53:16 +02:00
Pedro Igor
8260c3c623 [KEYCLOAK-18860] - Fixing attributes returned from user api 2021-07-22 15:09:30 -03:00
Vlastimil Elias
f307c56fe1 KEYCLOAK-18812 UserProfile metadata in Account REST API 2021-07-22 08:46:30 -03:00
Pedro Igor
b4c940fe3f [KEYCLOAK-18860] - Return attributes defined in user profile from user api 2021-07-22 08:32:47 -03:00
Robert Schuh
843bbf1bb3 KEYCLOAK-18852 Prevent NPE in case of missing truststore 
even though the "return null" at the top of the method is called if no truststore is set, the finally block is still executed. And since the keystore is not there an NPE is thrown when calling the remove method.
 2021-07-21 14:13:22 +02:00
Pedro Igor
d29d945cc4 [KEYCLOAK-18857] - Do not force default to RS256 when verifying tokens sent by clients and JWK does not hold an algorithm 2021-07-21 11:09:02 +02:00
Takashi Norimatsu
2c019c9ce5 KEYCLOAK-18832 FAPI-CIBA-ID1 conformance test : need to return 401 error=invalid_client if client authentication is not successfully completed on Backchannel Authentication endpoint 2021-07-21 10:13:55 +02:00
Takashi Norimatsu
8df36fbf28 KEYCLOAK-18828 FAPI-CIBA-ID1 conformance test : Additional checks of signed authentication request 2021-07-21 08:19:19 +02:00
Takashi Norimatsu
61fcbb307b KEYCLOAK-18830 FAPI-CIBA-ID1 conformance test : HolderOfKeyEnforcerExecutor needs to be executed on CIBA token request 2021-07-21 08:07:50 +02:00
Pedro Igor
54a0e84070 [KEYCLOAK-18741] - Review error messages when validating PAR requests 2021-07-20 14:08:49 -03:00
Pedro Igor
7f34af4016 Revert "[KEYCLOAK-18425] - Allow mapping user profile attributes" 
This reverts commit 3e07ca3c
 2021-07-20 14:08:09 -03:00
mposolda
db7e247f7b KEYCLOAK-18848 KEYCLOAK-18850 Enable CIBA and PAR by default 2021-07-20 15:59:06 +02:00
Takashi Norimatsu
f154b0b209 KEYCLOAK-18831 FAPI-CIBA-ID1 conformance test : need to return 400 if user authentication is not successfully completed 2021-07-20 10:46:16 +02:00
Takashi Norimatsu
e2c5fa20a2 KEYCLOAK-18849 Client Policy - Condition : ClientRolesCondition needs to be evaluated on PAR endpoint 2021-07-20 09:41:48 +02:00
Pedro Igor
396a78bcc4 [KEYCLOAK-18723] - Configurable constraints for request object encryption 2021-07-20 09:28:09 +02:00
Pedro Igor
730d4e8ac9 [KEYCLOAK-18807] - Fixing claims in JARM responses 2021-07-20 08:23:33 +02:00
Pedro Igor
13a08362d4 [KEYCLOAK-18819] - SecureResponseType executor shall allow response_type=code when using JARM and response_mode=jwt 2021-07-20 08:16:19 +02:00
Takashi Norimatsu
f76c07476c KEYCLOAK-18827 FAPI-CIBA-ID1 conformance test : Client JWT authentication should allow Backchannel Authentication endpoint as audience 2021-07-20 06:39:28 +02:00
Takashi Norimatsu
02a9eb442d KEYCLOAK-18829 FAPI-CIBA-ID1 conformance test : ClientRolesCondition needs to be evaluated on CIBA backchannel authentication request and token request 2021-07-20 06:31:10 +02:00
Pedro Igor
fe4e089e81 [KEYCLOAK-18745] - Client JWT authentication should allow PAR endpoint as audience 2021-07-19 14:23:53 -03:00
Vlastimil Elias
61aa4e6a70 KEYCLOAK-18750 - Set "Email Verified" to false when email changed in 
UserProfile Provider
 2021-07-19 11:19:29 -03:00
Takashi Norimatsu
f188f02d03 KEYCLOAK-18826 FAPI-CIBA-ID1 conformance test : ID Token needs to include auth_time claim 2021-07-19 15:11:23 +02:00
Takashi Norimatsu
63f04c1118 KEYCLOAK-18683 Client policy executor for check Backchannel signed request algorithms matching FAPI compliant algorithms 2021-07-19 14:48:31 +02:00
Pedro Igor
a79d28f115 [KEYCLOAK-18729] - Support JAR when using PAR 2021-07-19 11:42:20 +02:00
bal1imb
2c8d4ad9b4 KEYCLOAK-18590 Realm localizations of one realm must not affect themes displayed in context of other realms. 2021-07-16 16:12:58 +02:00
bal1imb
fbaeb18a5f KEYCLOAK-18471 Added ID to admin event object. 2021-07-16 12:46:07 +02:00
Pedro Igor
f1face6973 [KEYCLOAK-18748] - Do not remove attributes when declarative provider is enabled 2021-07-15 12:00:39 -03:00
Vlastimil Elias
7618e66136 [KEYCLOAK-18541] separate template for IDP review page 2021-07-13 21:43:52 -03:00
vramik
00017b44a3 KEYCLOAK-18311 fix creation of roles during client registration 2021-07-12 11:39:47 +02:00
Pedro Igor
1baab67f3b [KEYCLOAK-18630] - Request object encryption support 2021-07-09 11:27:30 -03:00
Vlastimil Elias
6686482ba5 [KEYCLOAK-18591] - Support a dynamic IDP user review form 2021-07-09 10:05:26 -03:00
Takashi Norimatsu
7cdcf0f93e KEYCLOAK-18654 Client Policy - Endpoint : support Token Request by CIBA Backchannel Authentication 2021-07-09 11:24:12 +02:00
Takashi Norimatsu
43eb2b7c90 KEYCLOAK-18123 Client Policy - Executor : Enforce Backchannel Authentication Request satisfying high security level 2021-07-09 09:11:13 +02:00
Takashi Norimatsu
63b737545f KEYCLOAK-18653 Client Policy - Endpoint : support Pushed Authorization Request Endpoint 2021-07-09 09:06:38 +02:00
Pedro Igor
4099833be8 [KEYCLOAK-18693] - Declarative profile validating read-only attribute if it exists 2021-07-08 15:22:02 -03:00
Takashi Norimatsu
dce163d3e2 KEYCLOAK-18587 CIBA signed request: Client must configure the algorithm 2021-07-08 10:16:22 +02:00
Dmitry Telegin
3b3a61dfba KEYCLOAK-18639 Token Exchange SPI Milestone 1 2021-07-06 15:48:45 -03:00
Benjamin Weimer
8c1ea60b04 * Add sid claim to ID Token 
* deprecate session state parameter in ID Token
* remove charset=UTF-8 from backchannel logout post request Content-Type header
 2021-07-06 15:30:53 -03:00
Takashi Norimatsu
2b1624390a KEYCLOAK-17937 Client Policy - Endpoint : support CIBA Backchannel Authentication Endpoint 2021-07-03 08:57:20 +02:00
Hryhorii Hevorkian
2803685cd7 KEYCLOAK-18353 Implement Pushed Authorization Request inside the Keycloak 
Co-authored-by: Takashi Norimatsu <takashi.norimatsu.ws@hitachi.com>
Co-authored-by: mposolda <mposolda@gmail.com>
 2021-07-03 08:47:42 +02:00
lbortoli
e5ae113453 KEYCLOAK-18452 FAPI JARM: JWT Secured Authorization Response Mode for OAuth 2.0 2021-07-03 00:00:32 +02:00
Vlastimil Elias
04ff2c327b [KEYCLOAK-18429] Support a dynamic update profile form 2021-07-02 10:22:47 -03:00
Vlastimil Elias
f32447bcc1 [KEYCLOAK-18424] GUI order for user profile attributes 2021-07-02 08:37:24 -03:00
Pedro Igor
b26b41332e [KEYCLOAK-18626] - Avoid changing username when registration as email is enabled 2021-07-02 08:07:04 -03:00
Pedro Igor
3e07ca3c22 [KEYCLOAK-18425] - Allow mapping user profile attributes 2021-07-01 10:19:28 -03:00
lbortoli
164f3df080 KEYCLOAK-18502 - Support for additional parameters from the backchannel authentication request and backchannel authentication callback. 2021-07-01 00:31:26 +02:00
Valentin Hervieu
aab6782bae KEYCLOAK-18603 Remove duplicated statement 
This is super minor but saw this while reading this file.
 2021-06-30 15:56:32 +02:00
Vlastimil Elias
bcfa6e4309 KEYCLOAK-18592 - put attribute validators configuration into freemarker 
template for user profile pages
 2021-06-30 09:01:12 -03:00
Václav Muzikář
eb3bd8bbb5 KEYCLOAK-18554 Make ErrorHandler to log all errors for debugging purposes 2021-06-30 08:58:09 +02:00
Takashi Norimatsu
cef742ee3f KEYCLOAK-18583 Remove OIDCWellKnownProvider.isAsymmetricAlgorithm 2021-06-30 07:35:46 +02:00
Luca Leonardo Scorcia
ae98d8ea28 KEYCLOAK-18315 SAML Client - Add parameter to request specific AttributeConsumingServiceIndex 2021-06-29 16:22:38 +02:00
Takashi Norimatsu
57c80483bb KEYCLOAK-17936 FAPI-CIBA : support Signed Authentication Request 
Co-authored-by: Pritish Joshi <pritish@banfico.com>
Co-authored-by: mposolda <mposolda@gmail.com>
 2021-06-29 08:07:40 +02:00
Pedro Igor
948f453e2d [KEYCLOAK-18427] - Allowing switching to declarative provider 2021-06-28 15:50:04 -03:00
Vlastimil Elias
512bcd14f7 [KEYCLOAK-18428] - dynamic registration form 2021-06-25 17:11:15 -03:00
Pedro Igor
faadb896ea [KEYCLOAK-18426] - Support required by role and scopes in Admin UI 2021-06-24 10:43:49 -03:00
Vlastimil Elias
b7a4fd8745 KEYCLOAK-18423 - Support a user-friendly name property for user profile 
attributes
 2021-06-24 08:17:06 -03:00
Luca Leonardo Scorcia
cdf9621257 KEYCLOAK-18450 Add basic tests for the Identity Provider Redirector Default IdP feature 2021-06-23 08:42:14 +02:00
Vlastimil Elias
458c841c39 [KEYCLOAK-18447] Dynamically select attributes based on requested scopes 2021-06-22 08:54:03 -03:00
Vlastimil Elias
82491ae5d2 KEYCLOAK-17446 - Prefill username in "Forgot Your Password" form if 
called from Login form
 2021-06-22 08:48:43 -03:00
Vlastimil Elias
b87d764137 [KEYCLOAK-17443] Username and email form fields kept in registration 
form when duplicate
 2021-06-22 08:46:42 -03:00
Luca Leonardo Scorcia
f5123cb51b KEYCLOAK-17935 SAML Client - Validate InResponseTo attribute 2021-06-21 12:25:18 +02:00
keycloak-bot
13f7831a77 Set version to 15.0.0-SNAPSHOT 2021-06-18 10:42:27 +02:00
vramik
e3c76035b2 KEYCLOAK-18359 Default role migration is not performed correctly when empty realm id 2021-06-14 20:54:37 +02:00
Davide Setti
74089a51b3 KEYCLOAK-18383 Update Group: don't check siblings if the name doesn't change 2021-06-14 12:58:45 +02:00
Pedro Igor
ef3a0ee06c [KEYCLOAK-17399] - Declarative User Profile and UI 
Co-authored-by: Vlastimil Elias <velias@redhat.com>
 2021-06-14 11:28:32 +02:00
Martin Bartoš
7ffa2835ef KEYCLOAK-18391 CIBATest failure 2021-06-11 10:36:56 +02:00
Yoshiyuki Tabata
4d1576b96a KEYCLOAK-18328 "access_denied" instead of "interaction_required" should 
be returned when a user cancels the login
 2021-06-10 11:16:50 +02:00
mposolda
070c68e18a KEYCLOAK-18069 Migration of client policies JSON from Keycloak 13 2021-06-10 10:40:14 +02:00
Douglas Palmer
aac0b6ec5f [KEYCLOAK-17602] Email account verification link is wrongly encoded 2021-06-10 08:34:53 +02:00
mposolda
91865fa93e KEYCLOAK-18368 Invalidate client session after refresh token re-use 2021-06-09 14:43:29 +02:00
Benjamin Weimer
f66354a80e KEYCLOAK-16947 add error parameters to access token response & improve logging 2021-06-07 17:53:30 +02:00
Marek Posolda
7a81dfff7a Update services/src/main/java/org/keycloak/services/clientpolicy/executor/FullScopeDisabledExecutorFactory.java 
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
 2021-06-04 15:46:33 +02:00
mposolda
3d16a1e8d3 KEYCLOAK-16811 Add executor for disable 'Full Scope Allowed' and add it to FAPI profiles 2021-06-04 15:46:33 +02:00
Douglas Palmer
986b69c03f [KEYCLOAK-17405] Session auth time updated when user has not re-authenticated 2021-06-01 19:35:42 +02:00
stianst
c3a15cb368 KEYCLOAK-17796 Add options to http-builder to enable expect-continue, and to disable re-use of connections 2021-06-01 10:28:31 +02:00
mposolda
73a38997d8 KEYCLOAK-14208 Default client profiles for FAPI 2021-05-31 12:31:52 +02:00
Michito Okai
bc6a746780 KEYCLOAK-18112 Token introspection of the revoked refresh token 2021-05-31 11:01:01 +02:00
Michal Hajas
4dcb69596b KEYCLOAK-18146 Search for clients by client attribute when doing saml artifact resolution 2021-05-27 23:02:22 +02:00
Stian Thorgersen
2cb59e2503
KEYCLOAK-17844 Add option to disable authorization services to workaround issues with many clients 2021-05-27 22:28:56 +02:00
Hynek Mlnarik
3d8f152787 KEYCLOAK-17747 KEYCLOAK-17754 Optimize getClients() calls 2021-05-27 22:12:56 +02:00
Martin Kanis
23aee6c210 KEYCLOAK-16616 Limit number of authSessios per rootAuthSession 2021-05-27 22:10:36 +02:00
Martin Kanis
122fbe1bc6 KEYCLOAK-18298 ClearExpiredUserSessions timeouts with large number of sessions 2021-05-27 16:31:10 +02:00
Takashi Norimatsu
669556af71 KEYCLOAK-18296 RefreshTokenRequest returns incorrect error code during failed HoK request 2021-05-27 15:28:29 +02:00
vramik
4e8b18f560 KEYCLOAK-17752 Avoid iterating over all clients in UserResource.getConsents() 2021-05-27 13:45:28 +02:00
vramik
3aa06c2721 KEYCLOAK-18073 avoid ModelDuplicateException during parallel starup of servers 2021-05-27 07:10:35 +02:00
Stefan Guilhen
eb631bf63b [KEYCLOAK-8730] Ensure role mappers don't remove roles already granted by another mapper when updating a brokered user 2021-05-26 17:21:54 +02:00
mposolda
9b76b07144 KEYCLOAK-18284 WARNING in the log when login to public clients 2021-05-26 14:38:14 +02:00
stianst
962047e7ea KEYCLOAK-17750 Check admin has view/query access first before listing clients 2021-05-25 16:14:35 +02:00
Luca Leonardo Scorcia
478319348b KEYCLOAK-16450 X509 Direct Grant Auth does not verify certificate timestamp validity 2021-05-25 10:32:17 +02:00
Takashi Norimatsu
6e7898039b KEYCLOAK-18139 SecureResponseTypeExecutor: polishing for FAPI 1 final 2021-05-25 08:32:43 +02:00
mposolda
d4374f37ae KEYCLOAK-18258 Not possible to login with public client, which was confidential with custom client authenticator set 2021-05-24 13:17:14 +02:00
Takashi Norimatsu
6532baa9a7 KEYCLOAK-18127 Option for skip return user's claims in the ID Token for hybrid flow 2021-05-24 08:02:34 +02:00
Vlastimil Elias
4ad1687f2b [KEYCLOAK-17399] UserProfile SPI - Validation SPI integration 2021-05-20 15:26:17 -03:00
Thomas Darimont
c49dbd66fa KEYCLOAK-15437 Ensure at_hash is generated for IDTokens on token-refresh 2021-05-20 16:05:11 +02:00
Hynek Mlnarik
860fc4c06c KEYCLOAK-17756 KEYCLOAK-17757 Optimize IdP-first lookup 2021-05-20 14:44:55 +02:00
Pedro Igor
a0f8d2bc0e [KEYCLOAK-17399] - Review User Profile SPI 
Co-Authored-By: Vlastimil Elias <vlastimil.elias@worldonline.cz>
 2021-05-20 08:44:24 -03:00
Michal Hajas
3bb5bff8e0 KEYCLOAK-17495 Do not include principal in the reference to broker sessionId 2021-05-20 11:32:11 +02:00
mposolda
d3e9e21abd KEYCLOAK-17906 Use auto-configure instead of is-augment. Use default-client-authenticator option in SecureClientAuthenticatorExecutor 2021-05-19 12:18:11 +02:00
Hynek Mlnarik
c02a706a86 KEYCLOAK-17748 Optimize validation of redirect URIs in logout endpoint 
Reimplementation of KEYCLOAK-17718
 2021-05-18 20:31:21 +02:00
Bastian Ike
5c3d7f186e KEYCLOAK-17784: URL encode Keycloak's remember-me cookie to allow non-ascii usernames. 
International users using non-ascii symbols such as the german `äöü`
will make Keycloak set the KEYCLOAK_REMEMBER_ME cookie without URL
encoding. This will trigger an java.lang.IllegalArgumentException:
UT000173 exception in undertow's cookie parser which does not
allow non-ascii characters.

Co-authored-by: Fabian Freyer <mail@fabianfreyer.de>
 2021-05-18 16:15:30 +02:00
Václav Muzikář
65fbf3f68c KEYCLOAK-18079 Client Policy UI Improvements: JSON error handling 2021-05-18 16:12:48 +02:00
Mathieu CLAUDEL
df714506cc KEYCLOAK-17655 - Can't impersonate 2021-05-18 14:16:01 +02:00
mposolda
71dcbec642 KEYCLOAK-18108 Refactoring retrieve of condition/executor providers. Make sure correct configuration of executor/condition is used for particular provider 2021-05-18 12:20:47 +02:00
mposolda
b8a7750000 KEYCLOAK-18113 Refactor some executor/condition provider IDs 2021-05-18 09:17:41 +02:00
Gregor Tudan
10f7ea01d4 KEYCLOAK-16091: only persist webauthn-authentication count if the authenticator increments it beyond zero 
Fixes an issue with Apple Keys stored in the secure enclave. They don's support counters and recommend attestation instead. This is a valid design choice according to the Webauthn-Spec (counters are mentioned as SHOULD)
 2021-05-17 08:42:50 +02:00
Václav Muzikář
62e6883524 KEYCLOAK-17084 KEYCLOAK-17434 Support querying clients by client attributes 2021-05-14 13:58:53 +02:00
vramik
d78d4a8d47 KEYCLOAK-17760 deprecate ScopeMappedResource.getScopeMappings() 2021-05-13 16:56:42 +02:00
Marek Posolda
a6d4316084
KEYCLOAK-14209 Client policies admin console support. Changing of format of JSON for client policies and profiles. Remove support for default policies (#7969) 
* KEYCLOAK-14209 KEYCLOAK-17988 Client policies admin console support. Changing of format of JSON for client policies and profiles. Refactoring based on feedback and remove builtin policies
 2021-05-12 16:19:55 +02:00
mhajas
f37a24dd91 KEYCLOAK-17348 Add manual pagination into UserStorageManager#query 2021-05-12 15:09:36 +02:00
Takashi Norimatsu
355a5d65fb KEYCLOAK-18052 Client Policies : Revise SecureRequestObjectExecutor to have an option for checking nbf claim 2021-05-11 14:29:33 +02:00
rmartinc
2539bd9ed3 [KEYCLOAK-17903] idp metadata describing one entity MUST have EntityDescriptor root element 2021-05-11 13:02:13 +02:00
Takashi Norimatsu
5dced05591 KEYCLOAK-18050 Client Policies : Rename "secure-redirecturi-enforce-executor" to indicate what this executor does 2021-05-11 07:42:18 +02:00
Takashi Norimatsu
b4e4e75743 KEYCLOAK-17928 Determine public client based on token_endpoint_auth_method during OIDC dynamic client registration 2021-05-10 08:24:18 +02:00
Takashi Norimatsu
624d300a55 KEYCLOAK-17938 Not possible to create client in the admin console when client policy with "secure-redirecturi-enforce-executor" condition is used 2021-05-07 17:52:09 +02:00
Takashi Norimatsu
b38b1eb782 KEYCLOAK-17895 SecureSigningAlgorithmEnforceExecutor: Ability to auto-configure default algorithm 2021-05-07 12:37:39 +02:00
Takashi Norimatsu
faab3183e0 KEYCLOAK-18034 Enforce SecureSigningAlgorithmForSignedJwtEnforceExecutor to private-key-jwt clients regardless their option 2021-05-07 12:26:46 +02:00
keycloak-bot
4b44f7d566 Set version to 14.0.0-SNAPSHOT 2021-05-06 14:55:01 +02:00
Hynek Mlnarik
6d97a573e6 KEYCLOAK-17696 Make MapStorageFactory amphibian 2021-05-06 11:38:41 +02:00
Takashi Norimatsu
0a4fdc64f3 KEYCLOAK-17929 SecureSigningAlgorithmForSignedJwtEnforceExecutor polishing for FAPI 2021-05-06 08:41:05 +02:00
Takashi Norimatsu
b78d151a23 KEYCLOAK-16808 Client Policy : Implement existing ConsentRequiredClientRegistrationPolicy as Client Policies' executor 
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
 2021-05-06 08:36:34 +02:00
Sam Dammers
e73c6103cf KEYCLOAK-17888 This reverts [KEYCLOAK-14299] - Do not create keys during startup but on-demand 
Restoring the original realm key provisioning process due to undesirable behaviour when using
on demand provisoning under load (duplicate keys created).
 2021-05-05 08:43:44 -03:00
Václav Muzikář
57fca2a34f KEYCLOAK-15170 Reset password link is not invalidated if email address is changed 2021-05-05 08:45:47 +02:00
Christoph Leistert
61bdc92ad9
KEYCLOAK-17387: 403 response on localization endpoint for cross realm users 
- add ForbiddenPage class for the assertion at the selenium test
- add assertion to selenium test
- GET requests for localization texts require at least one role for the realm
- Make GET requests for localization texts public, to display the admin UI correctly, even if the role view-realm is missing
 2021-05-03 13:29:11 -03:00
Hynek Mlnarik
96501760e0 KEYCLOAK-17501 Add support for map storage in WildFly 2021-05-03 16:00:30 +02:00
Hynek Mlnarik
32fb45eb5b KEYCLOAK-17774 Implement equals method for work cache events 
Co-Authored-By: stianst <stianst@gmail.com>
Co-Authored-By: Michal Hajas <mhajas@redhat.com>
 2021-05-03 10:47:15 +02:00
Václav Muzikář
5a33ec2244 disabledReason as read-only attribute, AuthenticatorUtils 2021-05-03 09:39:34 +02:00
Václav Muzikář
315b9e3c29 KEYCLOAK-17835 Account Permanent Lockout and login error messages 2021-05-03 09:39:34 +02:00
Christoph Leistert
b75648bda2 KEYCLOAK-17284 Evaluate ID-Token and UserInfo-Endpoint: 
- add additional REST endpoints for evaluation:
  - for ID Token: GET /realm/clients/id/evaluate-scopes/generate-example-id-token
  - for UserInfo-Endpoint: GET /realm/clients/id/evaluate-scopes/generate-example-userinfo
- extend UI: add additional tabs "Generated ID Token" and "Generated User Info" to the client scopes evaluation screen

Co-authored-by: Daniel Fesenmeyer <daniel.fesenmeyer@bosch.io>
 2021-04-29 16:45:30 +02:00
Takashi Norimatsu
65c48a4183
KEYCLOAK-12137 OpenID Connect Client Initiated Backchannel Authentication (CIBA) (#7679) 
* KEYCLOAK-12137 OpenID Connect Client Initiated Backchannel Authentication (CIBA)

Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
Co-authored-by: Christophe Lannoy <c4r1570p4e@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: mposolda <mposolda@gmail.com>
 2021-04-29 15:56:39 +02:00
vramik
162043beec KEYCLOAK-17615 Move database initialization from KeycloakApplication to JpaConnectionProviderFactory 2021-04-28 13:43:48 +02:00
Martin Kanis
515bfb5064 KEYCLOAK-16378 User / client session map store 
Co-authored-by: Martin Kanis <mkanis@redhat.com>
Co-authored-by: Hynek Mlnarik <hmlnarik@redhat.com>
 2021-04-28 09:09:15 +02:00
Ayat Bouchouareb
8255cba930 KEYCLOAK-17612- Invalid SAML Response : Invalid Destination 2021-04-26 11:15:28 +02:00
bohmber
455e93856c KEYCLOAK-17829 
Unnessary calls to session.users().getUserById in DefaultBruteForceProtector
 2021-04-23 13:44:34 +02:00
Takashi Norimatsu
190b60c5cd KEYCLOAK-17827 Client Policy - Condition : Client - Client Host : Removing Option 2021-04-21 15:16:00 +02:00
i7a7467
ada7f37430 KEYCLOAK-16918 Set custom user attribute to Name ID Format for a SAML client 
https://issues.redhat.com/browse/KEYCLOAK-16918

Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2021-04-20 10:29:17 +02:00
Michal Hajas
1e2db74d86 KEYCLOAK-16932 Authorization map storage 2021-04-16 17:26:16 +02:00
AlistairDoswald
8b3e77bf81 KEYCLOAK-9992 Support for ARTIFACT binding in server to client communication 
Co-authored-by: AlistairDoswald <alistair.doswald@elca.ch>
Co-authored-by: harture <harture414@gmail.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2021-04-16 12:15:59 +02:00
Michal Hajas
64ccbda5d5 KEYCLOAK-17323 Compute token expiration using Time.currentTime() instead of userSession.getStarted() 2021-04-14 12:58:45 +02:00
Martin Bartoš
5a9068e732 KEYCLOAK-16401 Deny/Allow access in a conditional context 2021-04-09 12:04:45 +02:00
Michito Okai
d9ebbe4958 KEYCLOAK-17202 Restrict Issuance of Refresh tokens to specific clients 2021-04-08 11:51:25 +02:00
Takashi Norimatsu
8b0b657a8f KEYCLOAK-17682 Client Policy - Executor : remove inner config class for executor without any config 2021-04-08 09:22:16 +02:00
Takashi Norimatsu
3221708499 KEYCLOAK-17667 Client Policy - Executor : Only Accept Confidential Client 2021-04-08 09:17:10 +02:00
Takashi Norimatsu
e9035bb7b3 KEYCLOAK-17681 Client Policy - Executor : Limiting available period of Request Object with its configuration 2021-04-08 09:12:20 +02:00
Daniel Fesenmeyer
a48d04bfe0 KEYCLOAK-16082 save attributes when role is created (with REST POST request) 
- add missing mapping code to RoleContainerResource#createRole
- extend ClientRolesTest and RealmRolesTest to check that now the attributes are saved when a role is created
- remove no longer needed code which updated roles because attributes were not saved on creation
 2021-04-07 14:08:49 -03:00
Takashi Norimatsu
7b227ae47c KEYCLOAK-17666 Client Policy - Executor : Limiting available period of Request Object 2021-04-07 08:36:26 +02:00
Takashi Norimatsu
42dec08f3c
KEYCLOAK-16805 Client Policy : Support New Admin REST API (Implementation) (#7780) 
* KEYCLOAK-16805 Client Policy : Support New Admin REST API (Implementation)

* support tests using auth-server-quarkus

* Configuration changes for ClientPolicyExecutorProvider

* Change VALUE of table REALM_ATTRIBUTES to NCLOB

* add author tag

* incorporate all review comments

Co-authored-by: mposolda <mposolda@gmail.com>
 2021-04-06 16:31:10 +02:00
Stan Silvert
ca49840266 KEYCLOAK-17610: WhoAMI doesn't support CORS 2021-03-31 18:51:39 +02:00
vramik
185075d373 KEYCLOAK-14552 Realm Map Store 2021-03-31 15:49:03 +02:00
Konstantinos Georgilakis
ec5c256562 KEYCLOAK-5657 Support for transient NameIDPolicy and AllowCreate in SAML IdP 2021-03-31 14:45:39 +02:00
rmartinc
0a0caa07d6 KEYCLOAK-17215 Slowness issue while hitting /auth/admin/realms/$REALM/clients?viewableOnly=true after DELETE a role 2021-03-31 12:57:17 +02:00
vramik
c3b9c66941 KEYCLOAK-17460 invalidate client when assigning scope 2021-03-30 10:58:16 +02:00
sma1212
e10f3b3672
[KEYCLOAK-17484] OIDC Conformance - Authorization response with Hybrid flow does not contain token_type (#7872) 
* [KEYCLOAK-17484] fix oidc conformance for hybrid-flow

* [KEYCLOAK-17484] add TokenType & ExpiresIn to OAuth2Constants

* [KEYCLOAK-17484] add request validation for oidc-flows automated tests
 2021-03-30 08:59:30 +02:00
devopsix
590ee1b1a2
KEYCLOAK-15459 Fix serialization of locale in admin console's “whoami” (#7397) 
call.
 2021-03-29 18:37:26 -04:00
Alexandros Trifyllis
a60cb65252 KEYCLOAK-17444 Enlist the EventListenerTransaction with the Keycloak Transaction Manager 2021-03-26 12:47:15 +01:00
Thomas Darimont
7ec6a54e22 KEYCLOAK-17581 Prevent empty group names 
Create / Update operations in `GroupResource ` and `GroupsResource#addTopLevelGroup`
did not validate the given group name. This allowed the creation of groups with empty names.

We now prevent the creation of groups with empty names.
 2021-03-25 19:10:38 -03:00
Hynek Mlnarik
a36fafe04e KEYCLOAK-17409 Support for amphibian (both component and standalone) provider 2021-03-25 13:28:20 +01:00
Xiangjiaox
ca81e6ae8c
KEYCLOAK-15015 Extend KeyWrapper to add whole certificate chain in x5c parameter (#7643) 
* [KEYCLOAK-15015] - Publishing the x5c for JWK

Co-authored-by: Vetle Bergstad <vetle.bergstad@evry.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2021-03-23 08:37:50 -03:00
cgeorgilakis
18afdea392
KEYCLOAK-16048 SAML Client import - add md:RequestedAttribute as "User Attribute" ProtocolMapper 2021-03-22 21:55:32 +01:00
mposolda
853a6d7327 KEYCLOAK-17000 Adding server tmp directory inside the auth-server home directory 2021-03-17 10:06:48 +01:00
Andrew Elwell
c76ca4ad13
Correct "doesn't exists" typos - fixes KEYCLOAK-14986 (#7316) 
* Correct "doesn't exists" typos

* Revert changes to imported package

Co-authored-by: Stian Thorgersen <stianst@gmail.com>
 2021-03-16 11:52:36 +01:00
Yang Xie
db30b470c4 KEYCLOAK-17342 Make the default value of default signature algorithm show up in the admin console 2021-03-16 09:15:22 +01:00
Michito Okai
298ab0bc3e KEYCLOAK-7675 Support for Device Authorization Grant 2021-03-15 10:09:20 -03:00
Łukasz Dywicki
f58bf0deeb Make sure additional params are passed between device request and user authnetication. 2021-03-15 10:09:20 -03:00
Hiroyuki Wada
5edf14944e KEYCLOAK-7675 SPI and default implementation for Device User Code. 
Author:    Hiroyuki Wada <h2-wada@nri.co.jp>
Date:      Sun May 12 15:47:15 2019 +0900

Signed-off-by: Łukasz Dywicki <luke@code-house.org>
 2021-03-15 10:09:20 -03:00
Hiroyuki Wada
9d57b88dba KEYCLOAK-7675 Prototype Implementation of Device Authorization Grant. 
Author:    Hiroyuki Wada <h2-wada@nri.co.jp>
Date:      Thu May 2 00:22:24 2019 +0900

Signed-off-by: Łukasz Dywicki <luke@code-house.org>
 2021-03-15 10:09:20 -03:00
Hynek Mlnarik
4946484cb6 KEYCLOAK-17377 Fix invalidation cluster tests (do not hide failures) 2021-03-11 16:14:59 +01:00
Yang Xie
2605eddbe7 KEYCLOAK-17300 Add a method to check if the token revocation request has duplicate parameters 2021-03-09 18:27:38 +01:00
vramik
6e501946b1 KEYCLOAK-17021 Client Scope map store 2021-03-08 21:59:28 +01:00
Michal Hajas
fc29a39e5a KEYCLOAK-16592 Do not require destination with SOAP binding 2021-03-05 19:52:00 +01:00
Douglas Palmer
852593310f [KEYCLOAK-14913] GitLab Identity Provider shouldn't request for 'api' scope 2021-03-05 14:23:34 +01:00
mposolda
99c1ee7f5a KEYCLOAK-16793 KEYCLOAK-16948 Cors on error responses for logoutEndpoint and tokenEndpoint 2021-03-05 14:14:53 +01:00
Pedro Igor
6c7f66d30c
[KEYCLOAK-17174] - Fxing not passing referrer param when reaching the account console (#7818) 2021-03-04 09:00:10 -05:00
Blake Smith
b122f31d2c
KEYCLOAK-17257 Fix NPEs when user storage doesn't implement the CredentialInputValidator interface 2021-03-04 09:49:12 +01:00
Denis
23bfaef4bb KEYCLOAK-15535 Account Log of user login with realm not available details when update profile 2021-03-04 08:06:36 +01:00
Yang Xie
78754d1127 KEYCLOAK-17259 Add a method to check if the introspection request has duplicate parameters 2021-03-03 16:23:27 +01:00
Pedro Igor
2796f62899
[KEYCLOAK-17174] - New admin console using wrong base URI for redirection (#7794) 2021-03-03 10:15:24 -05:00
Takashi Norimatsu
882f5ffea4 KEYCLOAK-15533 Client Policy : Extends Policy Interface to Migrate Client Registration Policies 
Co-authored-by: Hryhorii Hevorkian <hhe@adorsys.com.ua>
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
 2021-03-02 09:26:04 +01:00
i7a7467
b83064b142 KEYCLOAK-16679 Add algorithm settings for client assertion signature in OIDC identity broker 2021-03-01 18:11:25 +01:00
Takashi Norimatsu
c4bf8ecdf0 KEYCLOAK-16880 Client Policy - Condition : Negative Logic Support 2021-03-01 14:27:39 +01:00
mposolda
41dc94fead KEYCLOAK-14483 Broker state param fix 2021-02-24 19:07:58 -03:00
mposolda
6f409d088a KEYCLOAK-15239 Reset Password Success Message not shown when Kerberos is Enabled 2021-02-23 16:15:50 -03:00
Pedro Igor
dbc6514bfc [KEYCLOAK-17206] - Avoid removing attributes when updating user and profile 2021-02-23 08:41:41 +01:00
Juan Manuel Rodriguez Alvarado
6255ebe6b5 [KEYCLOAK-16536] Implement Audit Events for Authorization Services requests 2021-02-22 17:28:59 -03:00
mposolda
ed8d5a257f KEYCLOAK-16517 Make sure that just real clients with standardFlow or implicitFlow enabled are considered for redirectUri during logout 2021-02-22 14:30:32 +01:00
mposolda
0058011265 KEYCLOAK-16006 User should not be required to re-authenticate after revoking consent to an application 2021-02-22 14:29:42 +01:00
Pedro Igor
ffadbc3ba3 [KEYCLOAK-17173] - Support for script providers in keycloak.x 2021-02-22 10:12:36 -03:00
Pedro Igor
1dc0b005fe [KEYCLOAK-17087] - X509 OCSP Validation Not Checking Intermediate CAs 2021-02-22 13:50:19 +01:00
Pedro Igor
9356843c6c [KEYCLOAK-16521] - Fixing secret for non-confidential clients 2021-02-19 08:38:49 +01:00
Torsten Roemer
00ee6bb9fa KEYCLOAK-14577 OIDCIdentityProvider incorrectly sets firstName and lastName in BrokeredIdentityContext 2021-02-18 19:50:27 +01:00
rmartinc
056b52fbbe KEYCLOAK-16800 userinfo fails with 500 Internal Server Error for service account token 2021-02-18 19:37:52 +01:00
Pedro Igor
431f137c37 [KEYCLOAK-17123] - Avoid validation and updates for read-only attributes during updates 2021-02-17 17:57:46 +01:00
stefvdwel
8f719885fd Fixed tests. Removed styling changes. 2021-02-17 09:40:19 -03:00
stefvdwel
11b0c23937 Reduced code duplication 2021-02-17 09:40:19 -03:00
stefvdwel
ee28be982f Reduced code duplication 2021-02-17 09:40:19 -03:00
stefvdwel
c15361c129 Revert "Removed styling changes" 
This reverts commit d64361c3
 2021-02-17 09:40:19 -03:00
stefvdwel
1fa68c0a52 Removed styling changes 2021-02-17 09:40:19 -03:00
stefvdwel
b97f5eb128 Added PermissionTicket count test. 2021-02-17 09:40:19 -03:00
stefvdwel
5a500055f6 Added permission ticket /count endpoint. Todo: testing 2021-02-17 09:40:19 -03:00
mposolda
80bf0b6bad KEYCLOAK-16708 Unexpected exceptions during client authentication 2021-02-12 18:27:54 +01:00
Pedro Igor
ca2a761d4b [KEYCLOAK-16886] - Updating user account removes attributes 2021-02-12 12:01:50 -03:00
Michito Okai
33bb1fda38 KEYCLOAK-16931 Authorization Server Metadata of 
introspection_endpoint_auth_methods_supported and
introspection_endpoint_auth_signing_alg_values_supported
 2021-02-11 14:53:49 +01:00
Florian Apolloner
e7a3dc59ab [KEYCLOAK-15440] Fixed PasswordForm usage with LDAP users. 2021-02-11 14:32:28 +01:00
mposolda
456cdc51f2 KEYCLOAK-15719 CORS headers missing on userinfo error response 2021-02-11 13:37:42 +01:00
diodfr
cb12fed96e KEYCLOAK-4544 Detect existing user before granting user autolink 2021-02-11 11:06:49 +01:00
Pedro Igor
307e16391c [KEYCLOAK-14947] - Removing unnecessary code 2021-02-10 11:35:38 -03:00
Pedro Igor
f6c3ec5d9e [KEYCLOAK-14366] - Missing check for iss claim in JWT validation on Client Authentication (Token Endpoint) 2021-02-09 13:54:06 +01:00
mposolda
f4b5942c6c KEYCLOAK-16755 ClearExpiredUserSessions optimization. Rely on infinispan expiration rather than Keycloak own background task. 2021-02-04 08:49:42 +01:00
Yang Xie
cffe24f815 KECLOAK-16009 Add a method to check if the token request has duplicate parameters 2021-02-03 16:10:41 +01:00
Florian Apolloner
eeec82dea3 KEYCLOAK-16656 Only set execution authenticator for form flows. 2021-01-29 17:19:15 +01:00
Martin Kanis
8432513daa KEYCLOAK-16908 Refactor UserSessionPersisterProvider 2021-01-29 09:29:00 +01:00
Hynek Mlnarik
60e4bd622f KEYCLOAK-16828 Fix HttpClient failures and close HttpResponses 2021-01-28 08:38:34 +01:00
rmartinc
f3a4991b6a KEYCLOAK-15975 NPE in DefaultThemeManager.loadTheme() if theme directory is absent 2021-01-27 22:05:19 +01:00
mposolda
99a70267d9 KEYCLOAK-16801 Improve performance of ClearExpiredEvents background task 2021-01-27 09:57:46 +01:00