Josh Cain
89fcddd605
KEYCLOAK-3592 Docker auth implementation
2017-06-29 06:37:34 +02:00
Stian Thorgersen
ce4506f367
Merge pull request #4261 from hmlnarik/KEYCLOAK-4377-null
...
KEYCLOAK-4377
2017-06-28 08:21:20 +02:00
Hynek Mlnarik
a3ccac2012
KEYCLOAK-4377
2017-06-27 14:34:47 +02:00
Stian Thorgersen
4be0e36306
Merge pull request #4208 from ASzc/KEYCLOAK-4758
...
KEYCLOAK-4758
2017-06-27 11:35:43 +02:00
Bill Burke
f1132ffabe
Merge pull request #4175 from mrezai/fix-pkce-s256-code-challenge
...
KEYCLOAK-4956: Fix incorrect PKCE S256 code challenge generation
2017-06-21 17:04:31 -04:00
mposolda
32cf8b7cad
KEYCLOAK-3316 Fixes for OAuth2 requests without 'scope=openid'
2017-06-20 17:17:43 +02:00
Martin Hardselius
60942346f3
KEYCLOAK-4924: pairwise clients get duplicate subs in tokens
2017-06-14 10:47:40 +02:00
Pedro Igor
f12cef2c86
[KEYCLOAK-4904] - Authorization Audit - Part 1
2017-06-09 13:31:06 -03:00
Alex Szczuczko
5d88c2b8be
KEYCLOAK-4758 Update Encode class using latest resteasy. Use encodeQueryParamAsIs instead of encodeQueryParam when encoding key=value pairs for URI query sections. Also fix a few callers who were relying on the bad behaviour of queryParam.
2017-06-05 16:24:38 -06:00
mposolda
5560175888
KEYCLOAK-4626 Changed javadoc. Remove unused ClientSessionModel class
2017-05-25 18:51:05 +02:00
mposolda
2b59db71a8
KEYCLOAK-3316 Remove the IDToken if scope=openid is not used
2017-05-24 09:23:14 +02:00
Mohammad Rezai
acd78ee407
KEYCLOAK-4956: Fix incorrect PKCE S256 code challenge generation
2017-05-23 16:15:44 +04:30
Hynek Mlnarik
f47283f61a
KEYCLOAK-4813 Destination validation counts on port being not specified
2017-05-23 12:52:48 +02:00
mposolda
7d8796e614
KEYCLOAK-4626 Support for sticky sessions with AUTH_SESSION_ID cookie. Clustering tests with embedded undertow. Last fixes.
2017-05-11 22:24:07 +02:00
mposolda
168153c6e7
KEYCLOAK-4626 Authentication sessions - SAML, offline tokens, broker logout and other fixes
2017-05-11 22:16:26 +02:00
mposolda
e7272dc05a
KEYCLOAK-4626 AuthenticationSessions - brokering works. Few other fixes and tests added
2017-05-11 22:16:26 +02:00
mposolda
a9ec69e424
KEYCLOAK-4626: AuthenticationSessions - working login, registration, resetPassword flows
2017-05-11 22:16:26 +02:00
Hynek Mlnarik
19a41c8704
KEYCLOAK-4627 Refactor TokenVerifier to support more than just access token checks. Action tokens implementation with reset e-mail action converted to AT
2017-05-11 22:16:26 +02:00
mposolda
83b29c5080
KEYCLOAK-4626 AuthenticationSessions: start
2017-05-11 22:16:26 +02:00
mposolda
e4aba9e471
KEYCLOAK-4829 Access token from offline token falsely reported as inactive by token introspection
2017-05-11 21:17:04 +02:00
Bill Burke
e1b6ba13cc
Merge pull request #3893 from anderius/feature/KEYCLOAK-3056-verify-signature
...
[WIP] Saml broker: Added wantAssertionsSigned and wantAssertionsEncrypted
2017-05-05 09:04:41 -04:00
Marc Heide
d5c643eaf9
KEYCLOAK-4521: consider offline sessions if no active user session was found for user info endpoint
2017-05-04 15:25:09 +02:00
Hynek Mlnarik
e8a65017fa
KEYCLOAK-4779 Fix NPE
2017-04-24 23:09:27 +02:00
Stian Thorgersen
8919015f74
KEYCLOAK-4287 Remove deprecated session iframe endpoint
2017-04-19 15:01:15 +02:00
Takashi Norimatsu
ef3aef9381
Merge branch 'master' into master
2017-03-28 16:21:40 +09:00
Mark Pardijs
c78c0b73d3
KEYCLOAK-4360: Add OneTimeUse condition to SAMLResponse
...
Add OneTimeUse Condition to SAMLResponse when configured in client settings
2017-03-09 13:01:05 +01:00
Thomas Darimont
1dea38bdbb
KEYCLOAK-4205 Allow to return json arrays in Client and Realm Role Mappers
...
Previously the ClientRoleMapper and RealmRoleMapper returned
roles as a comma delimited String in OIDC tokens which
needed to be parsed by client applications.
We now support to generate the role information as JSON
arrays by setting "multi valued" to "true" in the
client role mapper or realm role mappers respectively
which makes it easier for clients to consume.
The default setting for "multi valued" is "false" to
remain backwards compatible.
An example AccessToken that shows the two modes can be found here:
https://gist.github.com/thomasdarimont/dff0cd691cd6e0b5e33c2eb4c76ae5e8
2017-03-08 20:56:56 +01:00
Anders Båtstrand
89c6cda2ac
Two new configuration options for the Saml broker:
...
* wantAssertionsSigned: This will toggle the flag in the SP Metadata Descriptor, and validate the signature if and only if "Validate signature" is selected.
* wantAssertionsEncrypted: This will simply require that the assertion is encrypted.
Default behavior is unchanged. The signature validation uses the original XML, and supports therefore an IdP that adds whitespace and line breaks between tags (for example OpenAM).
2017-02-24 15:08:57 +01:00
Takashi Norimatsu
88bfa563df
KEYCLOAK-2604 Proof Key for Code Exchange by OAuth Public Clients - RFC
...
7636 - Server Side Implementation
2017-02-03 10:38:54 +09:00
Stian Thorgersen
d1e491d57d
KEYCLOAK-4286 Add deprecated support for old keycloak.js
2017-01-25 15:59:43 +01:00
Stian Thorgersen
94ffeda62a
Merge pull request #3773 from hmlnarik/KEYCLOAK-4181-SAML-Response-without-any-assertion-leads-to-an-exception
...
KEYCLOAK-4181 Fix handling of SAML error code in broker
2017-01-24 10:33:05 +01:00
Marek Posolda
29c0fe564c
Merge pull request #3752 from mposolda/master
...
KEYCLOAK-4024 Migration of old offline tokens
2017-01-23 16:25:35 +01:00
Hynek Mlnarik
f289b281a0
KEYCLOAK-4262
2017-01-19 16:00:03 +01:00
Stian Thorgersen
5a0504b5d9
Merge pull request #3753 from hmlnarik/KEYCLOAK-4216-mod-auth-mellon-logout-failed-when-using-SSO
...
KEYCLOAK-4216 Fix NPE and logout binding choice
2017-01-18 08:40:02 +01:00
Hynek Mlnarik
02eda8943c
KEYCLOAK-4216 Fix NPE and logout binding choice
2017-01-13 14:30:32 +01:00
mposolda
9ad14d991c
KEYCLOAK-4140 Migration of old offline tokens
2017-01-13 11:35:19 +01:00
Hynek Mlnarik
9fb3201c8b
KEYCLOAK-3399 Ignore user session expiration on OIDC logout
2017-01-06 15:15:46 +01:00
Stian Thorgersen
40b5731198
KEYCLOAK-4133
...
Login status iframe endpoint doesn't set encoding
2016-12-22 08:20:55 +01:00
Stian Thorgersen
d365d9d784
Merge pull request #3649 from sldab/bearer-client-credentials
...
KEYCLOAK-4086 Client credentials missing in bearer-only JSON config
2016-12-20 12:32:03 +01:00
Slawomir Dabek
16fb1e2078
KEYCLOAK-4086 Client credentials missing in bearer-only Keycloak OIDC JSON
2016-12-19 16:55:19 +01:00
Stian Thorgersen
f29bb7d501
KEYCLOAK-4092 key provider for HMAC signatures
2016-12-19 10:50:43 +01:00
Hynek Mlnarik
5453bec1bf
KEYCLOAK-4079, KEYCLOAK-4080 Fix for single-valued claims
2016-12-16 10:00:36 +01:00
Stian Thorgersen
394676222f
Merge pull request #3616 from sldab/fix-cors
...
KEYCLOAK-4047 WebOrigins not expanded in CORS handling of token endpoints
2016-12-14 15:13:49 +01:00
Hynek Mlnarik
24a36e6848
KEYCLOAK-4057 Do not include KeyName for brokered IdPs
...
Active Directory Federation Services require that the subject name
matches KeyName element when present. While KeyName is beneficial for
Keycloak adapters, it breaks functionality for AD FS as the name
included there is a key ID, not certificate subject expected by AD FS.
This patch contains functionality that excludes KeyName from SAML
messages to identity providers. This behaviour should be made
configurable per client/identity provider and is prepared to do so,
however actual GUI changes are left for a separate patch.
2016-12-09 14:33:40 +01:00
Bill Burke
7271fdaaaa
KEYCLOAK-3509
2016-12-06 18:52:37 -05:00
Slawomir Dabek
4069be3ff6
KEYCLOAK-4047 Expand + to valid WebOrigins in Cors class
2016-12-06 20:22:35 +01:00
Bill Burke
693d6c0e5d
Merge pull request #3608 from hmlnarik/KEYCLOAK-4035
...
KEYCLOAK-4035 Composite roles need to be expanded in SAML attribute mapper
2016-12-05 14:44:21 -05:00
Bill Burke
952c1decf0
Merge pull request #3607 from patriot1burke/master
...
KEYCLOAK-4033
2016-12-05 14:44:07 -05:00
Hynek Mlnarik
3c4114091f
KEYCLOAK-4035 Composite roles need to be expanded in SAML attribute mapper
2016-12-05 16:16:08 +01:00
Bill Burke
d354aa1f62
KEYCLOAK-4033
2016-12-05 10:15:55 -05:00
