libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions
13292 commits 4 branches 9 tags 483 MiB
Commit graph

3499 commits

Author SHA1 Message Date
Michal Hajas
4dcb69596b KEYCLOAK-18146 Search for clients by client attribute when doing saml artifact resolution 2021-05-27 23:02:22 +02:00
Stian Thorgersen
2cb59e2503
KEYCLOAK-17844 Add option to disable authorization services to workaround issues with many clients 2021-05-27 22:28:56 +02:00
Hynek Mlnarik
3d8f152787 KEYCLOAK-17747 KEYCLOAK-17754 Optimize getClients() calls 2021-05-27 22:12:56 +02:00
Martin Kanis
23aee6c210 KEYCLOAK-16616 Limit number of authSessios per rootAuthSession 2021-05-27 22:10:36 +02:00
Martin Kanis
122fbe1bc6 KEYCLOAK-18298 ClearExpiredUserSessions timeouts with large number of sessions 2021-05-27 16:31:10 +02:00
Takashi Norimatsu
669556af71 KEYCLOAK-18296 RefreshTokenRequest returns incorrect error code during failed HoK request 2021-05-27 15:28:29 +02:00
vramik
4e8b18f560 KEYCLOAK-17752 Avoid iterating over all clients in UserResource.getConsents() 2021-05-27 13:45:28 +02:00
vramik
3aa06c2721 KEYCLOAK-18073 avoid ModelDuplicateException during parallel starup of servers 2021-05-27 07:10:35 +02:00
Stefan Guilhen
eb631bf63b [KEYCLOAK-8730] Ensure role mappers don't remove roles already granted by another mapper when updating a brokered user 2021-05-26 17:21:54 +02:00
mposolda
9b76b07144 KEYCLOAK-18284 WARNING in the log when login to public clients 2021-05-26 14:38:14 +02:00
stianst
962047e7ea KEYCLOAK-17750 Check admin has view/query access first before listing clients 2021-05-25 16:14:35 +02:00
Luca Leonardo Scorcia
478319348b KEYCLOAK-16450 X509 Direct Grant Auth does not verify certificate timestamp validity 2021-05-25 10:32:17 +02:00
Takashi Norimatsu
6e7898039b KEYCLOAK-18139 SecureResponseTypeExecutor: polishing for FAPI 1 final 2021-05-25 08:32:43 +02:00
mposolda
d4374f37ae KEYCLOAK-18258 Not possible to login with public client, which was confidential with custom client authenticator set 2021-05-24 13:17:14 +02:00
Takashi Norimatsu
6532baa9a7 KEYCLOAK-18127 Option for skip return user's claims in the ID Token for hybrid flow 2021-05-24 08:02:34 +02:00
Vlastimil Elias
4ad1687f2b [KEYCLOAK-17399] UserProfile SPI - Validation SPI integration 2021-05-20 15:26:17 -03:00
Thomas Darimont
c49dbd66fa KEYCLOAK-15437 Ensure at_hash is generated for IDTokens on token-refresh 2021-05-20 16:05:11 +02:00
Hynek Mlnarik
860fc4c06c KEYCLOAK-17756 KEYCLOAK-17757 Optimize IdP-first lookup 2021-05-20 14:44:55 +02:00
Pedro Igor
a0f8d2bc0e [KEYCLOAK-17399] - Review User Profile SPI 
Co-Authored-By: Vlastimil Elias <vlastimil.elias@worldonline.cz>
 2021-05-20 08:44:24 -03:00
Michal Hajas
3bb5bff8e0 KEYCLOAK-17495 Do not include principal in the reference to broker sessionId 2021-05-20 11:32:11 +02:00
mposolda
d3e9e21abd KEYCLOAK-17906 Use auto-configure instead of is-augment. Use default-client-authenticator option in SecureClientAuthenticatorExecutor 2021-05-19 12:18:11 +02:00
Hynek Mlnarik
c02a706a86 KEYCLOAK-17748 Optimize validation of redirect URIs in logout endpoint 
Reimplementation of KEYCLOAK-17718
 2021-05-18 20:31:21 +02:00
Bastian Ike
5c3d7f186e KEYCLOAK-17784: URL encode Keycloak's remember-me cookie to allow non-ascii usernames. 
International users using non-ascii symbols such as the german `äöü`
will make Keycloak set the KEYCLOAK_REMEMBER_ME cookie without URL
encoding. This will trigger an java.lang.IllegalArgumentException:
UT000173 exception in undertow's cookie parser which does not
allow non-ascii characters.

Co-authored-by: Fabian Freyer <mail@fabianfreyer.de>
 2021-05-18 16:15:30 +02:00
Václav Muzikář
65fbf3f68c KEYCLOAK-18079 Client Policy UI Improvements: JSON error handling 2021-05-18 16:12:48 +02:00
Mathieu CLAUDEL
df714506cc KEYCLOAK-17655 - Can't impersonate 2021-05-18 14:16:01 +02:00
mposolda
71dcbec642 KEYCLOAK-18108 Refactoring retrieve of condition/executor providers. Make sure correct configuration of executor/condition is used for particular provider 2021-05-18 12:20:47 +02:00
mposolda
b8a7750000 KEYCLOAK-18113 Refactor some executor/condition provider IDs 2021-05-18 09:17:41 +02:00
Gregor Tudan
10f7ea01d4 KEYCLOAK-16091: only persist webauthn-authentication count if the authenticator increments it beyond zero 
Fixes an issue with Apple Keys stored in the secure enclave. They don's support counters and recommend attestation instead. This is a valid design choice according to the Webauthn-Spec (counters are mentioned as SHOULD)
 2021-05-17 08:42:50 +02:00
Václav Muzikář
62e6883524 KEYCLOAK-17084 KEYCLOAK-17434 Support querying clients by client attributes 2021-05-14 13:58:53 +02:00
vramik
d78d4a8d47 KEYCLOAK-17760 deprecate ScopeMappedResource.getScopeMappings() 2021-05-13 16:56:42 +02:00
Marek Posolda
a6d4316084
KEYCLOAK-14209 Client policies admin console support. Changing of format of JSON for client policies and profiles. Remove support for default policies (#7969) 
* KEYCLOAK-14209 KEYCLOAK-17988 Client policies admin console support. Changing of format of JSON for client policies and profiles. Refactoring based on feedback and remove builtin policies
 2021-05-12 16:19:55 +02:00
mhajas
f37a24dd91 KEYCLOAK-17348 Add manual pagination into UserStorageManager#query 2021-05-12 15:09:36 +02:00
Takashi Norimatsu
355a5d65fb KEYCLOAK-18052 Client Policies : Revise SecureRequestObjectExecutor to have an option for checking nbf claim 2021-05-11 14:29:33 +02:00
rmartinc
2539bd9ed3 [KEYCLOAK-17903] idp metadata describing one entity MUST have EntityDescriptor root element 2021-05-11 13:02:13 +02:00
Takashi Norimatsu
5dced05591 KEYCLOAK-18050 Client Policies : Rename "secure-redirecturi-enforce-executor" to indicate what this executor does 2021-05-11 07:42:18 +02:00
Takashi Norimatsu
b4e4e75743 KEYCLOAK-17928 Determine public client based on token_endpoint_auth_method during OIDC dynamic client registration 2021-05-10 08:24:18 +02:00
Takashi Norimatsu
624d300a55 KEYCLOAK-17938 Not possible to create client in the admin console when client policy with "secure-redirecturi-enforce-executor" condition is used 2021-05-07 17:52:09 +02:00
Takashi Norimatsu
b38b1eb782 KEYCLOAK-17895 SecureSigningAlgorithmEnforceExecutor: Ability to auto-configure default algorithm 2021-05-07 12:37:39 +02:00
Takashi Norimatsu
faab3183e0 KEYCLOAK-18034 Enforce SecureSigningAlgorithmForSignedJwtEnforceExecutor to private-key-jwt clients regardless their option 2021-05-07 12:26:46 +02:00
keycloak-bot
4b44f7d566 Set version to 14.0.0-SNAPSHOT 2021-05-06 14:55:01 +02:00
Hynek Mlnarik
6d97a573e6 KEYCLOAK-17696 Make MapStorageFactory amphibian 2021-05-06 11:38:41 +02:00
Takashi Norimatsu
0a4fdc64f3 KEYCLOAK-17929 SecureSigningAlgorithmForSignedJwtEnforceExecutor polishing for FAPI 2021-05-06 08:41:05 +02:00
Takashi Norimatsu
b78d151a23 KEYCLOAK-16808 Client Policy : Implement existing ConsentRequiredClientRegistrationPolicy as Client Policies' executor 
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
 2021-05-06 08:36:34 +02:00
Sam Dammers
e73c6103cf KEYCLOAK-17888 This reverts [KEYCLOAK-14299] - Do not create keys during startup but on-demand 
Restoring the original realm key provisioning process due to undesirable behaviour when using
on demand provisoning under load (duplicate keys created).
 2021-05-05 08:43:44 -03:00
Václav Muzikář
57fca2a34f KEYCLOAK-15170 Reset password link is not invalidated if email address is changed 2021-05-05 08:45:47 +02:00
Christoph Leistert
61bdc92ad9
KEYCLOAK-17387: 403 response on localization endpoint for cross realm users 
- add ForbiddenPage class for the assertion at the selenium test
- add assertion to selenium test
- GET requests for localization texts require at least one role for the realm
- Make GET requests for localization texts public, to display the admin UI correctly, even if the role view-realm is missing
 2021-05-03 13:29:11 -03:00
Hynek Mlnarik
96501760e0 KEYCLOAK-17501 Add support for map storage in WildFly 2021-05-03 16:00:30 +02:00
Hynek Mlnarik
32fb45eb5b KEYCLOAK-17774 Implement equals method for work cache events 
Co-Authored-By: stianst <stianst@gmail.com>
Co-Authored-By: Michal Hajas <mhajas@redhat.com>
 2021-05-03 10:47:15 +02:00
Václav Muzikář
5a33ec2244 disabledReason as read-only attribute, AuthenticatorUtils 2021-05-03 09:39:34 +02:00
Václav Muzikář
315b9e3c29 KEYCLOAK-17835 Account Permanent Lockout and login error messages 2021-05-03 09:39:34 +02:00
Christoph Leistert
b75648bda2 KEYCLOAK-17284 Evaluate ID-Token and UserInfo-Endpoint: 
- add additional REST endpoints for evaluation:
  - for ID Token: GET /realm/clients/id/evaluate-scopes/generate-example-id-token
  - for UserInfo-Endpoint: GET /realm/clients/id/evaluate-scopes/generate-example-userinfo
- extend UI: add additional tabs "Generated ID Token" and "Generated User Info" to the client scopes evaluation screen

Co-authored-by: Daniel Fesenmeyer <daniel.fesenmeyer@bosch.io>
 2021-04-29 16:45:30 +02:00
Takashi Norimatsu
65c48a4183
KEYCLOAK-12137 OpenID Connect Client Initiated Backchannel Authentication (CIBA) (#7679) 
* KEYCLOAK-12137 OpenID Connect Client Initiated Backchannel Authentication (CIBA)

Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
Co-authored-by: Christophe Lannoy <c4r1570p4e@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: mposolda <mposolda@gmail.com>
 2021-04-29 15:56:39 +02:00
vramik
162043beec KEYCLOAK-17615 Move database initialization from KeycloakApplication to JpaConnectionProviderFactory 2021-04-28 13:43:48 +02:00
Martin Kanis
515bfb5064 KEYCLOAK-16378 User / client session map store 
Co-authored-by: Martin Kanis <mkanis@redhat.com>
Co-authored-by: Hynek Mlnarik <hmlnarik@redhat.com>
 2021-04-28 09:09:15 +02:00
Ayat Bouchouareb
8255cba930 KEYCLOAK-17612- Invalid SAML Response : Invalid Destination 2021-04-26 11:15:28 +02:00
bohmber
455e93856c KEYCLOAK-17829 
Unnessary calls to session.users().getUserById in DefaultBruteForceProtector
 2021-04-23 13:44:34 +02:00
Takashi Norimatsu
190b60c5cd KEYCLOAK-17827 Client Policy - Condition : Client - Client Host : Removing Option 2021-04-21 15:16:00 +02:00
i7a7467
ada7f37430 KEYCLOAK-16918 Set custom user attribute to Name ID Format for a SAML client 
https://issues.redhat.com/browse/KEYCLOAK-16918

Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2021-04-20 10:29:17 +02:00
Michal Hajas
1e2db74d86 KEYCLOAK-16932 Authorization map storage 2021-04-16 17:26:16 +02:00
AlistairDoswald
8b3e77bf81 KEYCLOAK-9992 Support for ARTIFACT binding in server to client communication 
Co-authored-by: AlistairDoswald <alistair.doswald@elca.ch>
Co-authored-by: harture <harture414@gmail.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2021-04-16 12:15:59 +02:00
Michal Hajas
64ccbda5d5 KEYCLOAK-17323 Compute token expiration using Time.currentTime() instead of userSession.getStarted() 2021-04-14 12:58:45 +02:00
Martin Bartoš
5a9068e732 KEYCLOAK-16401 Deny/Allow access in a conditional context 2021-04-09 12:04:45 +02:00
Michito Okai
d9ebbe4958 KEYCLOAK-17202 Restrict Issuance of Refresh tokens to specific clients 2021-04-08 11:51:25 +02:00
Takashi Norimatsu
8b0b657a8f KEYCLOAK-17682 Client Policy - Executor : remove inner config class for executor without any config 2021-04-08 09:22:16 +02:00
Takashi Norimatsu
3221708499 KEYCLOAK-17667 Client Policy - Executor : Only Accept Confidential Client 2021-04-08 09:17:10 +02:00
Takashi Norimatsu
e9035bb7b3 KEYCLOAK-17681 Client Policy - Executor : Limiting available period of Request Object with its configuration 2021-04-08 09:12:20 +02:00
Daniel Fesenmeyer
a48d04bfe0 KEYCLOAK-16082 save attributes when role is created (with REST POST request) 
- add missing mapping code to RoleContainerResource#createRole
- extend ClientRolesTest and RealmRolesTest to check that now the attributes are saved when a role is created
- remove no longer needed code which updated roles because attributes were not saved on creation
 2021-04-07 14:08:49 -03:00
Takashi Norimatsu
7b227ae47c KEYCLOAK-17666 Client Policy - Executor : Limiting available period of Request Object 2021-04-07 08:36:26 +02:00
Takashi Norimatsu
42dec08f3c
KEYCLOAK-16805 Client Policy : Support New Admin REST API (Implementation) (#7780) 
* KEYCLOAK-16805 Client Policy : Support New Admin REST API (Implementation)

* support tests using auth-server-quarkus

* Configuration changes for ClientPolicyExecutorProvider

* Change VALUE of table REALM_ATTRIBUTES to NCLOB

* add author tag

* incorporate all review comments

Co-authored-by: mposolda <mposolda@gmail.com>
 2021-04-06 16:31:10 +02:00
Stan Silvert
ca49840266 KEYCLOAK-17610: WhoAMI doesn't support CORS 2021-03-31 18:51:39 +02:00
vramik
185075d373 KEYCLOAK-14552 Realm Map Store 2021-03-31 15:49:03 +02:00
Konstantinos Georgilakis
ec5c256562 KEYCLOAK-5657 Support for transient NameIDPolicy and AllowCreate in SAML IdP 2021-03-31 14:45:39 +02:00
rmartinc
0a0caa07d6 KEYCLOAK-17215 Slowness issue while hitting /auth/admin/realms/$REALM/clients?viewableOnly=true after DELETE a role 2021-03-31 12:57:17 +02:00
vramik
c3b9c66941 KEYCLOAK-17460 invalidate client when assigning scope 2021-03-30 10:58:16 +02:00
sma1212
e10f3b3672
[KEYCLOAK-17484] OIDC Conformance - Authorization response with Hybrid flow does not contain token_type (#7872) 
* [KEYCLOAK-17484] fix oidc conformance for hybrid-flow

* [KEYCLOAK-17484] add TokenType & ExpiresIn to OAuth2Constants

* [KEYCLOAK-17484] add request validation for oidc-flows automated tests
 2021-03-30 08:59:30 +02:00
devopsix
590ee1b1a2
KEYCLOAK-15459 Fix serialization of locale in admin console's “whoami” (#7397) 
call.
 2021-03-29 18:37:26 -04:00
Alexandros Trifyllis
a60cb65252 KEYCLOAK-17444 Enlist the EventListenerTransaction with the Keycloak Transaction Manager 2021-03-26 12:47:15 +01:00
Thomas Darimont
7ec6a54e22 KEYCLOAK-17581 Prevent empty group names 
Create / Update operations in `GroupResource ` and `GroupsResource#addTopLevelGroup`
did not validate the given group name. This allowed the creation of groups with empty names.

We now prevent the creation of groups with empty names.
 2021-03-25 19:10:38 -03:00
Hynek Mlnarik
a36fafe04e KEYCLOAK-17409 Support for amphibian (both component and standalone) provider 2021-03-25 13:28:20 +01:00
Xiangjiaox
ca81e6ae8c
KEYCLOAK-15015 Extend KeyWrapper to add whole certificate chain in x5c parameter (#7643) 
* [KEYCLOAK-15015] - Publishing the x5c for JWK

Co-authored-by: Vetle Bergstad <vetle.bergstad@evry.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2021-03-23 08:37:50 -03:00
cgeorgilakis
18afdea392
KEYCLOAK-16048 SAML Client import - add md:RequestedAttribute as "User Attribute" ProtocolMapper 2021-03-22 21:55:32 +01:00
mposolda
853a6d7327 KEYCLOAK-17000 Adding server tmp directory inside the auth-server home directory 2021-03-17 10:06:48 +01:00
Andrew Elwell
c76ca4ad13
Correct "doesn't exists" typos - fixes KEYCLOAK-14986 (#7316) 
* Correct "doesn't exists" typos

* Revert changes to imported package

Co-authored-by: Stian Thorgersen <stianst@gmail.com>
 2021-03-16 11:52:36 +01:00
Yang Xie
db30b470c4 KEYCLOAK-17342 Make the default value of default signature algorithm show up in the admin console 2021-03-16 09:15:22 +01:00
Michito Okai
298ab0bc3e KEYCLOAK-7675 Support for Device Authorization Grant 2021-03-15 10:09:20 -03:00
Łukasz Dywicki
f58bf0deeb Make sure additional params are passed between device request and user authnetication. 2021-03-15 10:09:20 -03:00
Hiroyuki Wada
5edf14944e KEYCLOAK-7675 SPI and default implementation for Device User Code. 
Author:    Hiroyuki Wada <h2-wada@nri.co.jp>
Date:      Sun May 12 15:47:15 2019 +0900

Signed-off-by: Łukasz Dywicki <luke@code-house.org>
 2021-03-15 10:09:20 -03:00
Hiroyuki Wada
9d57b88dba KEYCLOAK-7675 Prototype Implementation of Device Authorization Grant. 
Author:    Hiroyuki Wada <h2-wada@nri.co.jp>
Date:      Thu May 2 00:22:24 2019 +0900

Signed-off-by: Łukasz Dywicki <luke@code-house.org>
 2021-03-15 10:09:20 -03:00
Hynek Mlnarik
4946484cb6 KEYCLOAK-17377 Fix invalidation cluster tests (do not hide failures) 2021-03-11 16:14:59 +01:00
Yang Xie
2605eddbe7 KEYCLOAK-17300 Add a method to check if the token revocation request has duplicate parameters 2021-03-09 18:27:38 +01:00
vramik
6e501946b1 KEYCLOAK-17021 Client Scope map store 2021-03-08 21:59:28 +01:00
Michal Hajas
fc29a39e5a KEYCLOAK-16592 Do not require destination with SOAP binding 2021-03-05 19:52:00 +01:00
Douglas Palmer
852593310f [KEYCLOAK-14913] GitLab Identity Provider shouldn't request for 'api' scope 2021-03-05 14:23:34 +01:00
mposolda
99c1ee7f5a KEYCLOAK-16793 KEYCLOAK-16948 Cors on error responses for logoutEndpoint and tokenEndpoint 2021-03-05 14:14:53 +01:00
Pedro Igor
6c7f66d30c
[KEYCLOAK-17174] - Fxing not passing referrer param when reaching the account console (#7818) 2021-03-04 09:00:10 -05:00
Blake Smith
b122f31d2c
KEYCLOAK-17257 Fix NPEs when user storage doesn't implement the CredentialInputValidator interface 2021-03-04 09:49:12 +01:00
Denis
23bfaef4bb KEYCLOAK-15535 Account Log of user login with realm not available details when update profile 2021-03-04 08:06:36 +01:00
Yang Xie
78754d1127 KEYCLOAK-17259 Add a method to check if the introspection request has duplicate parameters 2021-03-03 16:23:27 +01:00
Pedro Igor
2796f62899
[KEYCLOAK-17174] - New admin console using wrong base URI for redirection (#7794) 2021-03-03 10:15:24 -05:00
Takashi Norimatsu
882f5ffea4 KEYCLOAK-15533 Client Policy : Extends Policy Interface to Migrate Client Registration Policies 
Co-authored-by: Hryhorii Hevorkian <hhe@adorsys.com.ua>
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
 2021-03-02 09:26:04 +01:00