Pedro Igor
7483bae130
Make sure admin events are not referencing sensitive data from their representation
...
Closes #21562
Signed-off-by: Joerg Matysiak <joerg.matysiak@bosch.com>
2024-04-18 18:26:47 -03:00
Pedro Igor
1e3837421e
Organization member onboarding using the organization identity provider
...
Closes #28273
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-04-17 07:24:01 -03:00
Alexander Schwartz
13af4f44f5
Defer updates of last session updates and batch them ( #28502 )
...
Defer updates of last session refreshes and batch them
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: Michal Hajas <mhajas@redhat.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2024-04-17 09:25:05 +02:00
Martin Kanis
f764a9cb4a
NPE when listing sessions in UI if associated user is gone
...
Closes #28801
Signed-off-by: Martin Kanis <mkanis@redhat.com>
2024-04-16 11:53:36 -03:00
Pedro Ruivo
2494ad6950
Refactor and remove deprecated Infinispan methods from DefaultInfinispanConnectionProviderFactory
...
Closes #28752
Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2024-04-16 10:51:57 +02:00
Stefan Guilhen
2ab8bf852d
Add validation for the organization's internet domains.
...
Closes #28634
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-04-15 09:03:52 -03:00
Alexander Schwartz
004f419fd0
Leave a tombstone after the deletion of a cache entry
...
This captures the scenario of multiple deletion calls in the current session.
Closes #28672
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-04-12 17:00:19 +02:00
Pedro Igor
61b1eec504
Prevent members with an email other than the domain set to an organization
...
Closes #28644
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-04-12 08:33:18 -03:00
Alexander Schwartz
b4cfebd8d5
Persistent sessions code also for offline sessions ( #28319 )
...
Persistent sessions code also for offline sessions
Closes #28318
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-04-12 13:15:02 +02:00
rmartinc
6d74e6b289
Escape slashes in full group path representation but disabled by default
...
Closes #23900
Signed-off-by: rmartinc <rmartinc@redhat.com>
2024-04-12 10:53:39 +02:00
Douglas Palmer
69ba92808d
DefaultBruteForceProtector leverages a single thread to write success/failed events
...
Closes #14084
Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
2024-04-12 09:53:40 +02:00
Pedro Igor
8f8094408e
Encapsulate the logic to set attributes into the domain model
...
Closes #28646
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-04-11 15:32:21 -03:00
ali_dandach
eb77220cca
Fix string comparison for action
...
Closes #28628
Signed-off-by: ali dandach <alidandach1995@gmail.com>
2024-04-11 17:59:57 +02:00
tqe1999
6e0fc8a774
fix integer overflow with explicit cast
...
Closes #28564
Signed-off-by: tqe1999 <tqe1999@gmail.com>
2024-04-11 10:58:44 +02:00
Stefan Guilhen
9a466f90ab
Add ability to set one or more internet domain to an organization.
...
Closed #28274
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-04-10 13:18:12 -03:00
vramik
00ce3e34bd
Manage a single identity provider for an organization
...
Closes #28272
Signed-off-by: vramik <vramik@redhat.com>
2024-04-10 09:47:51 -03:00
Martin Kanis
51fa054ba7
Manage organization attributes
...
Closes #28253
Signed-off-by: Martin Kanis <mkanis@redhat.com>
2024-04-10 09:10:49 -03:00
Michal Hajas
1bb5e14134
Use ReentrantLock instead of synchronized to avoid thread pinning
...
+ since the runSerialized mechanism is currently on the best effort basis it is possible there are concurrent executions if T1 obtained a lock T2 removed the lock and T3 created a new lock before T1 called putIfAbsent therefore I added a debug log detecting this situation
Signed-off-by: Michal Hajas <mhajas@redhat.com>
2024-04-09 14:55:21 +02:00
Alexander Schwartz
355901dfd8
Add a back-off period when replacing cache entries fails
...
Closes #28388
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-04-09 14:55:21 +02:00
Alexander Schwartz
63e7523a6d
Avoid unnecessary updates to the sessions during refreshes of tokens
...
Closes #28388
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-04-09 14:55:21 +02:00
Alexander Schwartz
dc18bd4efb
Avoid conflicts when writing to session stores by checking for concurrent requests within the JVM
...
Closes #28388
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-04-09 14:55:21 +02:00
Stijn Last
e9498079e0
LDAP: Show error message when groups synchronization fails
...
closes : #28436
Signed-off-by: Stijn Last <stijn.last@barco.com>
2024-04-09 09:10:19 -03:00
vibrown
3fffc5182e
Added ClientType implementation from Marek's prototype
...
Signed-off-by: vibrown <vibrown@redhat.com>
More updates
Signed-off-by: vibrown <vibrown@redhat.com>
Added client type logic from Marek's prototype
Signed-off-by: vibrown <vibrown@redhat.com>
updates
Signed-off-by: vibrown <vibrown@redhat.com>
updates
Signed-off-by: vibrown <vibrown@redhat.com>
updates
Signed-off-by: vibrown <vibrown@redhat.com>
Testing to see if skipRestart was cause of test failures in MR
2024-04-08 20:20:37 +02:00
Pedro Igor
52ba9b4b7f
Make sure attribute metadata from user storage providers are added only for the provider associated with a federated user
...
Closes #28248
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-04-08 09:05:16 -03:00
Garth
16770ffad8
updated organization table name to not conflict. fixes #28246
...
Signed-off-by: Garth <244253+xgp@users.noreply.github.com>
2024-04-03 17:57:26 -03:00
Pedro Igor
fefeb83588
Changes the contract to make it simpler and rely on the realm available from the current session
...
Closes #28403
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-04-03 14:45:31 +02:00
Giuseppe Graziano
fe06df67c2
New default client scope for 'basic' claims with 'auth_time' protocol mapper
...
Closes #27623
Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
2024-04-02 08:44:28 +02:00
Alexander Schwartz
c580c88c93
Persist online sessions to the database ( #27977 )
...
Adding two feature toggles for new code paths to store online sessions in the existing offline sessions table. Separate the code which is due to be changed in the next iteration in new classes/providers which used instead of the old one.
Closes #27976
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: Michal Hajas <mhajas@redhat.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2024-03-28 09:17:07 +01:00
vramik
fa1571f231
Map organization metadata when issuing tokens for OIDC clients acting on behalf of an organization member
...
Closes #27993
Signed-off-by: vramik <vramik@redhat.com>
2024-03-26 14:02:09 -03:00
rmartinc
220564c7ba
ORA-01450 error for index IDX_CLIENT_ATT_BY_NAME_VALUE in oracle when MAX_STRING_SIZE is EXTENDED
...
Closes #27967
Signed-off-by: rmartinc <rmartinc@redhat.com>
2024-03-22 08:48:01 -03:00
Steven Hawkins
35b9d8aa49
task: remove usage of resteasy-core-spi ( #27387 )
...
closes : #27242
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-03-21 15:28:34 +01:00
synth3
99478887a4
Remove custom Hibernate dialect detection
...
Closes #27954
Signed-off-by: synth3 <19573241+synth3@users.noreply.github.com>
2024-03-21 14:27:19 +01:00
Pedro Igor
32541f19a3
Allow managing members for an organization
...
Closes #27934
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-03-21 10:26:30 -03:00
Sebastian Schuster
0542554984
12671 querying by user attribute no longer forces case insensitivity for keys
...
Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.io>
2024-03-21 08:35:29 -03:00
Konstantinos Georgilakis
4bca804d5a
Correct unique constraints for UserConsent entity
...
Closes #13045
Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>
2024-03-19 22:16:42 +01:00
Alexander Schwartz
62d24216e3
Remove offline session preloading
...
Closes #27602
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-03-15 15:19:27 +01:00
Pedro Igor
7fc2269ba5
The bare minimum implementation for organization
...
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: vramik <vramik@redhat.com>
2024-03-15 11:06:43 -03:00
Stefan Guilhen
0e717f735e
Add realm to session context when exporting to prevent NPE when vault is enabled. ( #27911 )
...
Closes #22617
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-03-15 12:24:22 +01:00
Stefan Guilhen
970a78fe7a
Set correct version for the federated user terms and conditions migration
...
Closes #27228
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-03-13 18:03:41 -03:00
PetkoNosal
3989cb5e90
Fix missing log argument in MigrateTo24_0_0
...
Closes #27779
Signed-off-by: Nosal, Peter (pn1895) <pn1895@att.com>
Co-authored-by: Nosal, Peter (pn1895) <pn1895@att.com>
2024-03-13 16:36:27 +00:00
Pedro Igor
9ad447390a
Only remove attributes with empty values when updating user profile
...
Closes #27797
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-03-13 15:03:08 +01:00
Alexander Schwartz
f168b8cce9
Avoid invalidating the cache if removing an entry doesn't exist
...
Closes #27852
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-03-13 13:36:07 +01:00
Stefan Guilhen
1099f03fe6
Add migration for terms and conditions required action in FED_USER_REQUIRED_ACTION table
...
Closes #27228
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-03-13 08:43:11 -03:00
Pedro Igor
1e48cce3ae
Make sure empty configuration resolves to the system default configuration
...
Closes #27611
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-03-11 09:01:38 -03:00
Alexander Schwartz
050acf0d94
Map Storage Removal: Remove deprecated model/legacy module ( #27601 )
...
Closes #26657
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-03-08 15:17:24 +00:00
Steve Hawkins
4091baf4c2
fix: accounting for the possibility of null flows from existing realms
...
closes : #23980
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-03-08 14:25:23 +01:00
rmartinc
ea4155bbcd
Remove recursively when deleting an authentication executor
...
Closes #24795
Signed-off-by: rmartinc <rmartinc@redhat.com>
2024-03-07 14:43:23 +01:00
vramik
4fc7e3d607
Map Store Removal: Remove unnecessary check in Jpa Connection Provider
...
Closes #26406
Signed-off-by: vramik <vramik@redhat.com>
2024-03-04 14:00:54 +01:00
vramik
7adcc98c6c
Map Store Removal: Remove obsolete KeycloakModelUtils.isRealmProviderJpa method
...
Closes #27445
Signed-off-by: vramik <vramik@redhat.com>
2024-03-04 12:22:04 +01:00
Steven Hawkins
8d9439913c
fix: removal of resteasy-core ( #27032 )
...
* fix: partial removal of resteasy-core
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* fix: fully removing resteasy-core
closes : #26315
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2024-02-29 11:43:13 +00:00
Pedro Igor
326d63ce74
Make sure group searches are cached and entries invalidate accordingly
...
Closes #26983
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2024-02-29 05:06:36 +09:00
Vlasta Ramik
ade3b31a91
Introduce new CLI config options for Infinispan remote store
...
Closes #25676
Signed-off-by: vramik <vramik@redhat.com>
Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Pedro Ruivo <pruivo@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2024-02-28 15:49:19 +00:00
Réda Housni Alaoui
a3b3ee4b87
Ability to declare a default "First broker login flow" per Realm
...
Closes #25823
Signed-off-by: Réda Housni Alaoui <reda-alaoui@hey.com>
Co-authored-by: Jon Koops <jonkoops@gmail.com>
2024-02-28 16:17:51 +01:00
rmartinc
2bd9f09e29
Re-index CLIENT_ATTRIBUTES using name and value
...
Closes #26618
Signed-off-by: rmartinc <rmartinc@redhat.com>
2024-02-28 11:07:03 +01:00
Alexander Schwartz
ee3a4a6e4f
Set expiry and maxidle when loading entries from the remote store ( #26942 )
...
Closes #26941
Signed-off-by: Michal Hajas <mhajas@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2024-02-27 17:56:17 +01:00
Douglas Palmer
b0ef746f39
Permanently lock users out after X temporary lockouts during a brute force attack
...
Closes #26172
Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
2024-02-22 09:34:51 +01:00
Vlasta Ramik
76453550a5
User attribute value length extension
...
Closes #9758
Signed-off-by: vramik <vramik@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: Michal Hajas <mhajas@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2024-02-16 08:09:34 +01:00
Michal Hajas
f7f7f1bd10
Add caching for subGroupsCount
...
Closes #25731
Signed-off-by: Michal Hajas <mhajas@redhat.com>
2024-02-15 19:46:04 +09:00
rmartinc
4ff4c3f897
Increase internal algorithm security using HS512 and 128 byte hmac keys
...
Closes #13080
Signed-off-by: rmartinc <rmartinc@redhat.com>
2024-02-15 08:16:45 +01:00
Alexander Schwartz
c7b51fc7f0
Use the appropriate database dialect to add quotes to the schema name ( #26964 )
...
Closes #25961
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-02-13 13:09:55 +01:00
Stefan Guilhen
2161e72872
Add migration for the useTruststoreSpi config property in LDAP user storage provider
...
- legacy `ldapsOnly` value now migrated to `always`.
Closes #25912
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-02-12 11:53:19 +01:00
Thomas Darimont
93fc6a6c54
Shorter lifespan for offline session cache entries in memory
...
Closes #26810
Co-authored-by: Thomas Darimont <thomas.darimont@googlemail.com>
Co-authored-by: Martin Kanis <mkanis@redhat.com>
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
Signed-off-by: Martin Kanis <mkanis@redhat.com>
2024-02-09 19:44:04 +01:00
Douglas Palmer
66f0d2ff1d
blah
...
Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
2024-02-07 15:55:06 -03:00
Douglas Palmer
d9d41b1a09
Brute Force Detection is disabled when updating frontenUrl via admin client
...
Closes #21409
Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
2024-02-07 15:55:06 -03:00
Stian Thorgersen
3e08a1713b
Ignore empty attribute values when retriveing boolean/int/long ( #26729 ) ( #26737 )
...
Resolves #26597 , resolves #26665
Signed-off-by: stianst <stianst@gmail.com>
2024-02-06 15:29:34 +01:00
Stefan Guilhen
fbeba83b87
Upgrade liquibase to version 4.25.1
...
Closes #26570
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2024-02-05 19:07:25 +01:00
Michal Hajas
00742a62dd
Remove RealmModel from authorization services interfaces ( #26708 )
...
Closes #26530
Signed-off-by: Michal Hajas <mhajas@redhat.com>
2024-02-02 16:51:32 +01:00
Thomas Darimont
277af021d7
Improve ScheduledTask task-name handling
...
This PR introduces a String getTaskName() default method to
the ScheduledTask interface and adjusts call sites to use the
implementation derived task name where possible.
Previously, ScheduledTask names were passed around separately, which
lead to unhelpful debug messages.
We now give ScheduledTask implementations control over their task-name
which allows for more flexible naming.
Enlist call StoreSyncEvent.fire(...) to after transaction to ensure realm is present in database.
Ensure that Realm is already committed before updating sync via UserStorageSyncManager
Align Sync task name generation for cancellation to support SyncFederationTest
Only log a message if sync task was actually canceled.
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
2024-02-02 09:57:03 -03:00
mposolda
cdc5d8fff8
Migrating Realm JSON with declarative user profile fails when scope selectors present on any attributes
...
closes #26266
Signed-off-by: mposolda <mposolda@gmail.com>
2024-02-01 09:54:09 +01:00
Martin Kanis
a3fcacdab7
Map Store Removal: deprecate model legacy module
...
Closes #26598
Signed-off-by: Martin Kanis <mkanis@redhat.com>
2024-01-31 17:40:45 +01:00
Václav Muzikář
4096a2657e
Supported option to specify site name for multi-site deployments
...
Closes #26460
Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2024-01-31 11:52:19 +00:00
Lex Cao
cf3f05a259
Skip grant role if exists for federated storage ( #26508 )
...
Closes #26507
Signed-off-by: Lex Cao <lexcao@foxmail.com>
2024-01-26 17:08:47 +00:00
Martin Kanis
7797f778d1
Map Store Removal: Rename legacy modules
...
Closes #24107
Signed-off-by: Martin Kanis <mkanis@redhat.com>
2024-01-25 16:29:16 +01:00
Martin Kanis
84603a9363
Map Store Removal: Rename Legacy* classes ( #26273 )
...
Closes #24105
Signed-off-by: Martin Kanis <mkanis@redhat.com>
2024-01-23 13:50:31 +00:00
Alexander Schwartz
b9498b91cb
Deprecating the offline session preloading ( #26160 )
...
Closes #25300
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2024-01-16 09:29:01 +01:00
Alexander Schwartz
a8eca6add0
Changing to the Infinispan BOM to avoid mis-aligned Infinispan dependencies ( #26137 )
...
Closes #22922
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
Co-authored-by: Pedro Ruivo <pruivo@redhat.com>
2024-01-15 09:20:47 +01:00
mposolda
692aeee17d
Enable user profile by default
...
closes #25151
Signed-off-by: mposolda <mposolda@gmail.com>
2024-01-11 12:48:44 -03:00
Réda Housni Alaoui
98230aa372
Add federated identity ProviderEvent(s)
...
Signed-off-by: Réda Housni Alaoui <reda-alaoui@hey.com>
2024-01-10 11:56:38 -03:00
Alexander Schwartz
01939bcf34
Remove concurrent loading of remote sessions as at startup time only one node is up anyway. ( #25709 )
...
Closes #22082
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Martin Kanis <martin-kanis@users.noreply.github.com>
2024-01-09 16:55:22 +01:00
atharva kshirsagar
d7542c9344
Fix for empty realm name issue
...
Throw ModelException if name is empty when creating/updating a realm
Closes #17449
Signed-off-by: atharva kshirsagar <atharva4894@gmail.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2024-01-05 14:23:42 +01:00
Réda Housni Alaoui
5287500703
@NoCache is not considered anymore
...
Signed-off-by: Réda Housni Alaoui <reda-alaoui@hey.com>
2024-01-02 09:06:55 -03:00
Pedro Igor
810ebf4efd
Migration steps for enabling user profile by default
...
Closes #25528
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2023-12-19 10:19:45 -03:00
Alexander Schwartz
9e4fc3f491
Keep workaround permanently for concurrent shutdowns of embedded Infinispan
...
Closes #9871
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2023-12-15 10:58:22 +01:00
Alexander Schwartz
e01827693a
Avoid shutdown of Infinispan when using cache
...
Closes #24508
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2023-12-13 15:46:37 +01:00
Alexander Schwartz
a8cff72ed0
Avoid logged warning about objects not present in the cache for tasks ( #25324 )
...
Closes #25322
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2023-12-08 13:10:14 +01:00
Alexander Schwartz
5b1b3ca11b
Allow concurrent remote cache operations ( #25390 )
...
Closes #25388
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2023-12-08 10:07:25 +01:00
Pedro Igor
ab1173182c
Make sure realm is available from session when migrating to 23
...
Closes #25183
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2023-12-06 07:42:54 -03:00
Alexander Schwartz
e4be3ed244
Prevent client cache stampede after invalidation of a client or on startup ( #25217 )
...
Closes #24202
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2023-12-05 16:01:37 +01:00
Michal Hajas
ec061e77ed
Remove GlobalLockProviderSpi ( #25206 )
...
Closes #24103
Signed-off-by: Michal Hajas <mhajas@redhat.com>
2023-12-01 16:40:56 +00:00
vramik
587cef7de4
Delete Profile.Feature.MAP_STORAGE
...
Signed-off-by: vramik <vramik@redhat.com>
Closes #24102
2023-11-30 13:04:39 +01:00
rmartinc
16afecd6b4
Allow automatic download of SAML certificates in the identity provider
...
Closes https://github.com/keycloak/keycloak/issues/24424
Signed-off-by: rmartinc <rmartinc@redhat.com>
2023-11-29 18:03:31 +01:00
Michal Hajas
2b2207af93
Publish information about Infinispan availability in lb-check if MULTI_SITE is enabled
...
Closes #25077
Signed-off-by: Michal Hajas <mhajas@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Pedro Ruivo <pruivo@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2023-11-29 11:06:41 +00:00
Pedro Igor
2c611cb8fc
User profile configuration scoped to user-federation provider
...
closes #23878
Co-Authored-By: mposolda <mposolda@gmail.com>
Signed-off-by: mposolda <mposolda@gmail.com>
2023-11-27 14:45:44 +01:00
Sebastian Schuster
030f42ec83
More efficient listing of assigned and available client role mappings
...
Closes #23404
Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.io>
Co-authored-by: Vlasta Ramik <vramik@users.noreply.github.com>
2023-11-22 14:10:11 +01:00
Alexander Schwartz
a45934a762
Disable cache store and load only if a remote store is used
...
Closes #10803
Closes #24766
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: daviddelannoy <16318239+daviddelannoy@users.noreply.github.com>
2023-11-20 18:50:02 +01:00
Douglas Palmer
f9665acc29
KeycloakErrorHandler NullPointerException String.toLowerCase() because message is null
...
Closes #22958
Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
2023-11-16 18:06:33 +01:00
Réda Housni Alaoui
3f014c7299
Cannot display 'Authentication Flows' screen when a realm contains more than ~4000 clients ( #21058 )
...
closes #21010
Signed-off-by: Réda Housni Alaoui <reda-alaoui@hey.com>
2023-11-13 19:13:01 +01:00
vramik
926be135e8
Remove map related modules
...
Signed-off-by: vramik <vramik@redhat.com>
Closes #24100
2023-11-13 12:34:52 +01:00
Alexander Schwartz
26e2fde115
Avoid reseting cachemanger to null to avoid a re-initialization ( #24086 )
...
Also follow best practices of using volatile variables for double-locking, and not using shutdown caches.
Closes #24085
2023-11-08 11:33:44 -05:00
vramik
6fa26d7ff4
Delete map dependencies from dependency management
...
Closes #24101
2023-11-08 13:53:17 +01:00
vramik
593c14cd26
Data too long for column 'DETAILS_JSON'
...
Closes #17258
2023-11-02 20:29:35 +01:00
rokkiter
e1735138cb
clean util * ( #24174 )
...
Signed-off-by: rokkiter <yongen.pan@daocloud.io>
2023-11-01 17:14:11 +01:00
ashwingroot
dee1cec290
fix to preload offline sessions faster
...
slow loading offline tokens during start up leads to connection timeout
closes #24295
2023-10-30 12:58:06 +01:00
Alice
69497382d8
Group scalability upgrades ( #22700 )
...
closes #22372
Co-authored-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2023-10-26 16:50:45 +02:00
Hynek Mlnarik
c036980c37
Add TRANSIENT_USERS feature flag
2023-10-25 12:02:35 +02:00
Hynek Mlnarik
26328a7c1e
Support for transient sessions via lightweight users
...
Part-of: Add support for not importing brokered user into Keycloak database
Closes : #11334
2023-10-25 12:02:35 +02:00
Hynek Mlnarik
35a226f928
Expose InMemoryUserAdapter to services and model modules
...
Part-of: Add support for not importing brokered user into Keycloak database
Closes : #11334
2023-10-25 12:02:35 +02:00
Marek Posolda
1bd6aca629
Remove RegistrationProfile class and handle migration ( #24215 )
...
closes #24182
Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
2023-10-24 20:19:33 +02:00
Martin Kanis
10a2c96c72
Users in role Rest API returns empty when User federation used ( #23318 )
...
* Users in role Rest API returns empty when User federation used
Co-authored-by: Shankar Yadav <ET1024@neeyamoworks.com>
Co-authored-by: Martin Kanis <mkanis@redhat.com>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2023-10-24 11:10:20 -04:00
rmartinc
ad01ed1497
Do not reset the user profile configuration on disable
...
Closes https://github.com/keycloak/keycloak/issues/23527
2023-10-24 03:05:34 -07:00
Håvar Nøvik
bc55846809
Fixes a NullPointerException after import validation ( #20151 )
...
* Fixes a NullPointerException after import validation
If the import validation (when getting a user by email)
returns null, indicating that the user entity should be
removed from local storage, an email equality check results
in a NullPointerException.
This commit fixes this issue by explicitly checking for null.
Closes #20150
---------
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2023-10-23 17:19:25 -04:00
vramik
a0f04fa2be
Declarative User Profile export
...
Closes #12062
Resolves #20885
2023-10-21 19:21:20 +02:00
JesseEstum
71777df3d9
Prevent stampede after realm cache invalidation
...
Closes #22988
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2023-10-21 18:47:13 +02:00
Marek Posolda
829b7090fa
Avoid breaking change in UserSessionModel ( #24134 )
...
closes #24096
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2023-10-20 18:06:07 +02:00
mposolda
04777299b0
After tab1 finish authentication, make sure that rootAuthenticationSession is expired shortly
...
closes #23880
2023-10-19 19:23:50 +02:00
Vlasta Ramik
f6d582c761
Import migration step for kc22
...
Closes #24031
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2023-10-19 09:00:49 +02:00
shigeyuki kabano
6112b25648
Enhancing Light Weight Token( #22148 )
...
Closes #21183
2023-10-17 13:12:36 +02:00
Alice Wood
5a76ddfc2e
Remove realm model storage from OAuth2DeviceConfig class to avoid persisting old session and entity manager in infinispan fixes keycloak/keycloak#23943
2023-10-16 16:18:31 +02:00
Lex Cao
eedc4ceb18
Fix unexpected expiration when import offline client session
...
Closes #23397
2023-10-13 15:45:07 +02:00
Charley Wu
31759f9c37
WebAuthn support for native applications. Support custom FIDO2 origin validation ( #23156 )
...
Closes #23155
2023-10-13 15:25:10 +02:00
Steve Hawkins
7c6f173d3a
adds the ability to set the default groups via kcadm
...
Closes #19125
2023-10-06 17:30:24 +02:00
Martin Kanis
0853d484ec
Remove transaction in InfinispanSingleUseObjectProvider#remove ( #23708 )
...
Co-authored-by: mposolda <mposolda@gmail.com>
2023-10-06 10:00:04 +02:00
vramik
7f2f4aae67
Upgrade liquibase version to avoid a bug where a changeset is executed twice
...
Closes #23220
2023-10-05 13:35:05 +02:00
Michal Hajas
496c5ad989
Use new findGroupByPath implementation and remove the old one
...
Closes #23344
Signed-off-by: Michal Hajas <mhajas@redhat.com>
2023-09-25 10:44:24 +02:00
mkrueger92
498be3d928
Reuse already fixed code to fetch offline user ( #22429 )
...
The problem is again the wrap(...) function.
In case the user is not found, then null is
returned. This can happen when a federated user
is deleted on the federation side but Keycloak
is not informed about it. In that case, the
session is still present but no UserModel can
be created.
Without this patch the stream contains null
values. Some downstream users can not cope well
with that.
The adjustment of the function getUserSessionsCount(...)
is slightly more expensive in execution, but
returns the correct number.
Closes #22428
Co-authored-by: Martin Krüger <mkrueger@mkru.de>
2023-09-21 20:19:09 +00:00
Bernd Bohmann
bb2f59df87
Calling getTopLevelGroups is slow inside GroupLDAPStorageMapper#getLDAPGroupMappingsConverted ( #8430 )
...
Closes #14820
---------
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2023-09-20 17:20:43 +02:00
Pedro Igor
217a09ce46
Switch to Resteasy Reactive
...
Closes #10713
2023-09-18 09:19:03 -03:00
Alexander Schwartz
798846df6f
Remove legacy code which isn't used anymore and was deprecated for some time ( #23264 )
...
Closes #23263
2023-09-18 11:04:02 +02:00
Jacek Kowalski
f5182deb30
Fix valid redirect URIs for built-in account-console client on realm rename ( #20894 )
...
Closes #9541
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2023-09-13 15:28:07 +02:00
vramik
dc9970f578
Introduce a workaround for liquibase bug to allow use database schema with a dash in its name
...
Closes #20870
2023-09-12 17:21:43 +02:00
Peter Skopek
ef272f7668
SAML Adapter fix for EAP8 and WF29
...
Signed-off-by: Peter Skopek <pskopek@redhat.com>
2023-09-07 13:32:25 +02:00
Marek Posolda
6f989fc132
Fallback to next LDAP/Kerberos provider when not able to find authenticated Kerberos principal ( #22531 )
...
closes #22352 #9422
2023-08-29 11:21:01 +00:00
Alexander Schwartz
dfc8c80264
Upgrade to Infinispan 14.0.14 ( #22386 )
...
Closes #21092
2023-08-16 14:43:03 +02:00
Razvan Petrescu
6db0bc5428
KEYCLOAK-21868 ( #22373 )
...
Add the realm Id as a param to named query getGoupIdsByParent in order to use (or make better use of) the SIBLING_NAMES index on KEYCLOAK_GROUP table.
Closes #21868
2023-08-10 22:26:02 +00:00
Todor Staykovski
dffa7a31cb
Add subgroups sorting ( #22295 )
...
* Review comments to add a test, update the API description and adjust the map storage.
Closes #19348
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2023-08-07 21:18:09 +02:00
Alexander Schwartz
5f95929092
Prevent concurrent session cleanup on different instances in the cluster ( #22199 )
...
Closes #22198
2023-08-07 14:58:41 +02:00
Thomas Darimont
82269f789a
Avoid using deprecated junit APIs in tests
...
- Replaced usage of Assert.assertThat with static import
- Replaced static import org.junit.Assert.assertThat with org.hamcrest.MatcherAssert.assertThat
Fixes : #22111
2023-08-01 11:44:25 +02:00
mposolda
6f6b5e8e84
Fix authenticatorConfig for javascript providers
...
Closes #20005
2023-07-31 19:28:25 +02:00
Alexander Schwartz
cf911075af
Re-adding Infinispan workarounds to prevent deadlocks ( #22058 )
...
Relates to #9871
Closes #22057
2023-07-31 10:37:28 +02:00
Vlasta Ramik
29b67fc8df
Inconsistent Wildcard handling for JPA ( #21671 )
...
* Inconsistent Wildcard handling for JPA
Closes #20610
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2023-07-27 17:03:22 +02:00
Alexander Schwartz
23f3a1a872
Prevent EntityNotFoundException when ID doesn't exist in the DB ( #21867 )
...
This makes the behavior consistent with the other store implementations.
Closes #21866
2023-07-25 13:43:38 +02:00
Alexander Schwartz
bd0f87fc4d
Remove Infinispan workarounds introduced to prevent deadlocks ( #21862 )
...
This should no longer be necessary after the upgrade to Infinispan 14.0.13.Final and ISPN-13666 being resolved.
Closes #9871
2023-07-24 09:50:32 +02:00
ali_dandach
ef19e08814
Fix String comparisona ( #21752 )
...
Closes #21773
2023-07-21 10:37:24 +02:00
todor
897965f604
KEYCLOAK-20343 Add message bundle to export/import
...
Closes #20343
2023-07-20 23:00:28 +02:00
vramik
2f5a96351d
Introduce re-try mechanism when deserializing during import for map store
...
Closes #21824
2023-07-20 18:01:50 +02:00
William Burns
de04684dd0
Do not cache a session that is already expired in listener ( #21684 )
...
Fixes part of #20983
2023-07-18 12:04:04 +02:00
Alexander Schwartz
9b3effb4b8
Prevent cache stampede on realms
...
Closes #21521
2023-07-15 09:03:53 +02:00
Patrick Jennings
399a23bd56
Find an appropriate key based on the given KID and JWA ( #21160 )
...
* keycloak-20847 Find an appropriate key based on the given KID and JWA. Prefers matching on both inputs but will match on partials if found. Or return the first key if a match is not found.
Mark Key as fallback if it is the singular client certificate to be used for signed JWT authentication.
* Update js/apps/admin-ui/public/locales/en/clients.json
Co-authored-by: Marek Posolda <mposolda@gmail.com>
* Updating boolean variable name based on suggestions by Marek.
* Adding integration test specifically for the JWT parameters for regression #20847 .
---------
Co-authored-by: Marek Posolda <mposolda@gmail.com>
2023-07-10 13:28:55 +02:00
Pedro Igor
bde57ca839
Ignoring artifacts when running re-aug to isolate the current and new stores
...
Closes #20974
2023-07-05 07:56:49 -03:00
Stijn Last
91e543f415
Improve error messages when testing LDAP connection ( #21013 )
...
Closes #15434
2023-07-01 19:45:49 +02:00
Hynek Mlnarik
c092c76ae8
Remove ldapsOnly (Java)
...
In `LDAPConstants.java`, the function to set the Truststore SPI system property was removed, as this is now handled by the `shouldUseTruststoreSpi` method in `LdapUtil`.
Closes : #9313
2023-06-28 08:30:09 +02:00
Martin Kanis
db9b6c2152
Make awaitInitialTransfer for ISPN configurable
...
Closes #16671
2023-06-27 14:04:03 +02:00
Gilvan Filho
2493f11331
count users by custom user attribute
...
closes #14747
2023-06-21 11:56:22 -03:00
Stian Thorgersen
f82577a7f3
Removed old account console ( #21098 )
...
Co-authored-by: Jon Koops <jonkoops@gmail.com>
Closes #9864
2023-06-20 20:46:57 +02:00
Alexander Schwartz
f0f664dbb5
Prevent NPE on close() if postInit() hasn't been called
...
Closes #20977
2023-06-14 10:50:12 +02:00
Alexander Schwartz
e410a76c42
Avoid caching the list of clientscopes in two places
...
Closes #20426
Co-authored-by: Martin Kanis <mkanis@redhat.com>
2023-06-13 21:33:21 +02:00
vramik
535bba5792
Update UserQueryProvider methods
...
Closes #20438
2023-06-12 16:04:26 +02:00
Arnaud Martin
ae5a47d548
Impossible to update a federated user credential label
...
Closes #16613
2023-06-12 15:39:52 +02:00
Vlasta Ramik
ed473da22b
Clean-up of deprecated methods and interfaces
...
Fixes #20877
Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
2023-06-09 17:11:20 +00:00
Marek Posolda
8080085cc1
Removing 'http challenge' authentication flow and related authenticators ( #20731 )
...
closes #20497
Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
2023-06-08 14:52:34 +02:00
Hynek Mlnarik
12dd3edb10
Fix pagination issue with H6
...
With Hibernate ORM 6, pagination started to be unreliable: When
setting the max results only if the first row was 0 has randomly
affected other threads where first row was greater than 0. The
latter thread sometimes produced query which did *not* account
for the offset (cf. threads `-t1` and `-t2` below, while `-t2`
missed the `offset ? rows` part whic `-t3` has).
This has been fixed by setting the first row offset unconditionally.
Closes : #20202
Closes : #16570
```
2023-06-02 10:19:03.855000 TRACE [org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker] (blocking-thread-node-2-p8-t1) Running computation for segment 0 with worker 0
2023-06-02 10:19:03.856000 TRACE [org.keycloak.models.sessions.infinispan.initializer.OfflinePersistentUserSessionLoader] (blocking-thread-node-2-p8-t1) Loading sessions for segment=0 lastSessionId=00000000-0000-0000-0000-000000000000 first=0
2023-06-02 10:19:03.856000 DEBUG [org.keycloak.models.jpa.PaginationUtils] (blocking-thread-node-2-p8-t1) Set max to 64 in org.hibernate.query.sqm.internal.QuerySqmImpl@2fb60f8b
2023-06-02 10:19:03.856000 DEBUG [org.keycloak.models.jpa.PaginationUtils] (blocking-thread-node-2-p8-t1) After pagination: 0, 64
2023-06-02 10:19:03.857000 TRACE [org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker] (blocking-thread-node-2-p8-t2) Running computation for segment 1 with worker 1
2023-06-02 10:19:03.857000 TRACE [org.keycloak.models.sessions.infinispan.initializer.OfflinePersistentUserSessionLoader] (blocking-thread-node-2-p8-t2) Loading sessions for segment=1 lastSessionId=00000000-0000-0000-0000-000000000000 first=64
2023-06-02 10:19:03.857000 TRACE [org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker] (blocking-thread-node-2-p8-t3) Running computation for segment 2 with worker 2
2023-06-02 10:19:03.857000 DEBUG [org.keycloak.models.jpa.PaginationUtils] (blocking-thread-node-2-p8-t2) Set first to 64 in org.hibernate.query.sqm.internal.QuerySqmImpl@71464e9f
2023-06-02 10:19:03.857000 DEBUG [org.keycloak.models.jpa.PaginationUtils] (blocking-thread-node-2-p8-t2) Set max to 64 in org.hibernate.query.sqm.internal.QuerySqmImpl@71464e9f
2023-06-02 10:19:03.857000 DEBUG [org.keycloak.models.jpa.PaginationUtils] (blocking-thread-node-2-p8-t2) After pagination: 64, 64
2023-06-02 10:19:03.857000 TRACE [org.keycloak.models.sessions.infinispan.initializer.OfflinePersistentUserSessionLoader] (blocking-thread-node-2-p8-t3) Loading sessions for segment=2 lastSessionId=00000000-0000-0000-0000-000000000000 first=128
10:19:03,859 DEBUG [org.hibernate.SQL] (blocking-thread-node-2-p8-t1)
select
p1_0.OFFLINE_FLAG,
p1_0.USER_SESSION_ID,
p1_0.CREATED_ON,
p1_0.DATA,
p1_0.LAST_SESSION_REFRESH,
p1_0.REALM_ID,
p1_0.USER_ID
from
OFFLINE_USER_SESSION p1_0,
REALM r1_0
where
r1_0.ID=p1_0.REALM_ID
and p1_0.OFFLINE_FLAG=?
and p1_0.USER_SESSION_ID>?
order by
p1_0.USER_SESSION_ID fetch first ? rows only
10:19:03,859 DEBUG [org.hibernate.SQL] (blocking-thread-node-2-p8-t2)
select
p1_0.OFFLINE_FLAG,
p1_0.USER_SESSION_ID,
p1_0.CREATED_ON,
p1_0.DATA,
p1_0.LAST_SESSION_REFRESH,
p1_0.REALM_ID,
p1_0.USER_ID
from
OFFLINE_USER_SESSION p1_0,
REALM r1_0
where
r1_0.ID=p1_0.REALM_ID
and p1_0.OFFLINE_FLAG=?
and p1_0.USER_SESSION_ID>?
order by
p1_0.USER_SESSION_ID fetch first ? rows only
2023-06-02 10:19:03.860000 TRACE [org.hibernate.orm.jdbc.bind] (blocking-thread-node-2-p8-t1) binding parameter [1] as [VARCHAR] - [1]
2023-06-02 10:19:03.860000 TRACE [org.hibernate.orm.jdbc.bind] (blocking-thread-node-2-p8-t1) binding parameter [2] as [VARCHAR] - [00000000-0000-0000-0000-000000000000]
2023-06-02 10:19:03.860000 TRACE [org.hibernate.orm.jdbc.bind] (blocking-thread-node-2-p8-t1) binding parameter [3] as [INTEGER] - [64]
10:19:03,860 DEBUG [org.hibernate.SQL] (blocking-thread-node-2-p8-t3)
select
p1_0.OFFLINE_FLAG,
p1_0.USER_SESSION_ID,
p1_0.CREATED_ON,
p1_0.DATA,
p1_0.LAST_SESSION_REFRESH,
p1_0.REALM_ID,
p1_0.USER_ID
from
OFFLINE_USER_SESSION p1_0,
REALM r1_0
where
r1_0.ID=p1_0.REALM_ID
and p1_0.OFFLINE_FLAG=?
and p1_0.USER_SESSION_ID>?
order by
p1_0.USER_SESSION_ID offset ? rows fetch first ? rows only
2023-06-02 10:19:03.861000 TRACE [org.hibernate.orm.jdbc.bind] (blocking-thread-node-2-p8-t3) binding parameter [3] as [INTEGER] - [128]
2023-06-02 10:19:03.861000 TRACE [org.hibernate.orm.jdbc.bind] (blocking-thread-node-2-p8-t3) binding parameter [4] as [INTEGER] - [64]
```
Co-authored-by: mkanis <mkanis@redhat.com>
2023-06-07 20:45:34 +02:00
Vlasta Ramik
3b2dea64ac
Remove duplicated and unused PersistenceExceptionConverter ( #20844 )
...
Closes #20842
2023-06-07 14:46:36 +02:00
Martin Bartoš
bea8778683
Use new method for obtaining DB dialect
2023-06-07 10:14:34 +02:00
rmartinc
81aa588ddc
Fix and correlate session timeout calculations in legacy and new map implementations
...
Closes https://github.com/keycloak/keycloak/issues/14854
Closes https://github.com/keycloak/keycloak/issues/11990
2023-06-05 18:46:23 +02:00
vramik
a175efcb72
Split UserQueryProvider
into UserQueryMethods
and UserCountMethods
and make LdapStorageProvider
implement only UserQueryMethods
...
Co-authored-by: mhajas <mhajas@redhat.com>
Closed #20156
2023-05-31 11:47:54 +02:00
stianst
0832992e59
Removing OpenShift integration and moving to separate extension
...
closes #20496
Co-authored-by: mposolda <mposolda@gmail.com>
2023-05-30 17:39:32 +02:00
Tomas Slusny
1b06c4cf6c
Use cached policy store in Infinispan PolicyAdapter ( #20566 )
2023-05-29 10:39:24 -03:00
Alexander Schwartz
5cd0d51fa6
Don't remove an element from the cache that was queued to be created during the current request
...
This avoids a remove Infinispan call in multi-node and cross-DC setups.
Closes #20404
2023-05-25 10:33:23 +02:00
Hynek Mlnarik
fc0e47caa4
Fix KcCustomOidcBrokerTest
...
Fixes : #20541
2023-05-25 10:20:36 +02:00
Pedro Ruivo
abd75a786f
Enable simple-cache for local-cache
...
Closes #20486
2023-05-24 09:47:20 +02:00
Stefan Guilhen
2252b09949
Remove deprecated default roles methods
...
Closes #15046
2023-05-23 22:32:52 +02:00
Alexander Schwartz
7f64ca0048
Avoid querying with secondary columns which might fetch and lock additional rows ( #20474 )
...
* Accessing UserSession by primary key
This resolves problematic locking queries databases running on SERIALIZABLE isolation level like CockroachDB
Closes #16977
* Avoid querying with expiring column
This resolves problematic locking queries databases running on SERIALIZABLE isolation level like CockroachDB
Closes #16977
2023-05-23 07:19:58 +00:00
Alexander Schwartz
23683970bb
Avoid optimistic locking queries on CockroachDB to avoid rolling back transactions
...
Closes #16976
2023-05-23 08:42:03 +02:00
Alexander Schwartz
d7a408d081
Remove log4j dependency from model/jpa which is EOL
...
Closes #20421
2023-05-19 17:43:51 -03:00
Alex Szczuczko
1578506475
Seperate version properties for hibernate-enhance and quarkus-maven ( #20264 )
...
This will allow them to be defined seperately from aligned dependency
versions suitable for product
Closes #20261
2023-05-18 14:37:55 +00:00
mkrueger92
256bb84cc4
Avoid NPE while fetching offline sessions ( #17577 )
2023-05-18 13:32:02 +02:00
Stefan Guilhen
053f774f13
Fix broker link query param order to match the columns order in the primary key index
...
Closes #19193
2023-05-17 10:22:59 +02:00
Dominik Schlosser
8c58f39a49
Updates Datastore provider to contain full data model
...
Closes #15490
2023-05-16 15:05:10 +02:00
Hynek Mlnařík
edb292664c
File store freeze
...
* File store: Fix ID determination
* Forbid changing ID (other setters)
* Improve handling of null values
* Support convertible keys in maps
* Fix writing empty values
* Fix updated flag
* Proceed if an object has been deleted in the same tx
* Fix condition
Co-authored-by: Michal Hajas <mhajas@redhat.com>
---------
Co-authored-by: Michal Hajas <mhajas@redhat.com>
2023-05-16 12:03:59 +02:00
Martin Bartoš
960e3503ec
Artifact SLF4J LOG4J-12 has been relocated ( #20113 )
2023-05-05 13:57:45 +02:00
vramik
d1ab921c50
JpaUserProvider count methods are inconsistent with searchForUser's param filter handling
...
Closes #17581
2023-05-05 08:22:05 +02:00
rmartinc
d9025db536
Migrate realms if configured to use RH-SSO themes
...
Closes https://github.com/keycloak/keycloak/issues/17484
2023-05-02 15:38:33 +02:00
vramik
6c6907ef4e
Clean RealmProvider from methods from other areas
...
Closes #15044
2023-05-02 15:09:26 +02:00
Alexander Schwartz
c2c5012cfb
Upgrade to latest Infinispan version 14.0.8
...
Closes #20067
2023-05-02 13:45:05 +02:00
Alexander Schwartz
a10d511b12
Remove workaround for fix available in Hibernate 6.2.1
...
Closes #19323
2023-05-02 13:43:49 +02:00
Peter Zaoral
72663060c9
Quarkus3 branch sync no. 13
...
11.4.2023:
* renamed imports from javax to jakarta as a part of the migration from JavaEE to JakartaEE
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-04-27 13:36:54 +02:00
Alexander Schwartz
f345c8b931
Revert "Fix problem when Hibernate on MySQL is confused to read back Enums from VARCHARs"
...
This doesn't work with Hibernate 6.2.0.Final any more, and it is no longer needed after changing the VARCHAR to TINYINT for the enums
This reverts commit 0d96b8db6b9f8cefc2997d350cc6359c01cd61be.
2023-04-27 13:36:54 +02:00
Alexander Schwartz
02b0683053
Revert "Workaround to avoid replacing element collections"
...
With the update Hibernate 6.2.0.Final this is no longer needed.
Closes #19162
This reverts commit 93e32f3191a1ddc3498000244b35b3c14fe6880e and e369f7c212b3d9ee4810518f5a2bfe9b846ba15d.
2023-04-27 13:36:54 +02:00
vramik
d962dec954
Remove workaround for Lazy initialization of Realm's collections
...
Closes #19069
2023-04-27 13:36:54 +02:00
Alexander Schwartz
b508b18391
Removing workaround for H6 as this is now fixed
...
This reverts commit c74b832995759d4c9f330a4ba1767d01f9e3c174.
Closes #16551
2023-04-27 13:36:54 +02:00
Alexander Schwartz
e00af7e172
Fix problem when Hibernate on MySQL is confused to read back Enums from VARCHARs
...
It treated the single byte String with its ASCII values, which then didn't find a representation in the enum's values, which lead to a "ArrayIndexOutOfBoundsException: Index 48" for a value "0" (ASCII 48).
This behavior changed when migrating from Hibernate 5 to Hibernate 6.
Hibernate expects a TinyInt value for all Enums by default, and this annotation overrides it.
2023-04-27 13:36:54 +02:00
Alexander Schwartz
b7d5b6a135
Fix problem when Hibernate exception is hidden when executing "ClientScopeTest".
...
This behavior changed when upgrading to Hibernate 6
2023-04-27 13:36:54 +02:00
Alexander Schwartz
16d4c732e0
Fix problem with "InterpretationException: Error interpreting query / this may indicate a semantic (user query) problem or a bug in the parser"
...
This behavior changed when upgrading from Hibernate 6.2.0.CR3 to 6.2.0.CR4
2023-04-27 13:36:54 +02:00
Alexander Schwartz
b68a5be38d
Workaround to avoid replacing element collections
...
Relates to #19162
2023-04-27 13:36:54 +02:00
Alexander Schwartz
2762e17dc0
Create proper one-to-many in RealmLocalizationTextsEntity
...
This avoids Hibernate 6.2.0.CR4 to fail with 'BasicValue cannot be cast to class ToOne'.
It used to work on Hibernate 6.2.0.CR3.
2023-04-27 13:36:54 +02:00
Alexander Schwartz
ad82252a44
Create workaround for "identifier of an instance altered"
...
Related to: #19323
2023-04-27 13:36:54 +02:00
Martin Bartoš
9719e1d210
Handle DB exceptions for JTA TX
2023-04-27 13:36:54 +02:00
Alexander Schwartz
5252992384
Workaround to avoid replacing element collections
...
Relates to #19162
2023-04-27 13:36:54 +02:00
Alexander Schwartz
28975b950d
Workaround for lazy loaded collections for RealmEntity
...
---
Quarkus3 branch sync no. 13 (11.4.2023)
Resolved conflicts:
keycloak/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java - Modified
2023-04-27 13:36:54 +02:00
Martin Bartoš
8584174099
Change default DB dialects
2023-04-27 13:36:54 +02:00
Peter Zaoral
181c8a5340
Quarkus3 branch sync no. 11
...
24.3.2023:
* renamed imports from javax to jakarta as a part of the migration from JavaEE to JakartaEE
* fixed the metadata field's Type annotation
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-04-27 13:36:54 +02:00
vramik
ae56c657b0
JpaMapStorageProviderFactory should use AvailableSettings.JAKARTA... properties
...
Closes #17077
2023-04-27 13:36:54 +02:00
Peter Zaoral
946eacd5b6
Quarkus3 branch sync no. 5
...
10.2.2023:
* renamed imports from javax to jakarta as a part of the migration from JavaEE to JakartaEE
* fixed Undertow server not starting due to ClassNotFoundException: javax.transaction.TransactionManager
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-04-27 13:36:54 +02:00
vramik
7b51d8617d
Remove one side of association which is not used.
...
Closes #16693
2023-04-27 13:36:54 +02:00
Alexander Schwartz
434cc7c711
Fix errors pointed out by Hibernate 6 in the queries
...
Closes #16337
2023-04-27 13:36:54 +02:00
Alexander Schwartz
4bdf2fe21d
Fixing parameter which should be a string plus dependencies
...
Closes #16649
2023-04-27 13:36:54 +02:00
Alexander Schwartz
80f7452950
Results of AttributeConverters are mutable; workaround a regression in H6
...
Relates to #16551
2023-04-27 13:36:54 +02:00
vramik
b55be98115
Fix JpaClientModelCriteriaBuilder when querying by ALWAYS_DISPLAY_IN_CONSOLE with H6
2023-04-27 13:36:54 +02:00
Hynek Mlnarik
4189edc9f1
Fix dependency
...
Fixes : #16538
2023-04-27 13:36:54 +02:00
vramik
60e6fb9dae
Register custom functions FunctionContributor
...
Closes #16336
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/JpaMapStorage.java - Modified
keycloak/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/JpaMapStorageCockroachdb.java - Modified
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 3 (27.1.2023)
Resolved conflicts:
keycloak/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/JpaMapStorage.java - Modified
keycloak/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/JpaMapStorageCockroachdb.java - Modified
2023-04-27 13:36:54 +02:00
Alexander Schwartz
33e2bcd94f
Avoid warnings on bean validation as we don't use it in JPA
...
Closes #16502
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 3 (27.1.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
2023-04-27 13:36:54 +02:00
Hynek Mlnarik
386c58c78b
Use proper @Type
annotation for JSON type
...
Fixes : #16335
---
Quarkus3 branch sync no. 11 (24.3.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 7 (27.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/client/entity/JpaClientEntity.java - Modified
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/clientScope/entity/JpaClientScopeEntity.java - Modified
2023-04-27 13:36:54 +02:00
Peter Zaoral
4ff2de7f46
Quarkus3 branch sync
...
18.1.2023:
* applied Quarkus 3 OpenRewrite recipe
* fixed the parts that were missed by the script
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2023-04-27 13:36:54 +02:00
Alexander Schwartz
9d217d66a0
Align code with H6 DefaultAutoFlushEventListener
...
This is taken from Version 6.1.6
Closes #16334
2023-04-27 13:36:54 +02:00
Alexander Schwartz
137a2bf0e9
Remove functionality not supported in Hibernate 6
...
Closes #16330
2023-04-27 13:36:54 +02:00
Martin Bartoš
124591ce1a
Adapters can still use Java EE
...
- Provided all JavaEE dependencies for adapters
- Automatically build Undertow Jakarta EE for testsuite (missing SAML)
---
Quarkus3 branch sync no. 11 (24.3.2023)
Resolved conflicts:
keycloak/adapters/oidc/spring-security/pom.xml - Modified
---
Quarkus3 branch sync no. 7 (27.2.2023)
Resolved conflicts:
keycloak/pom.xml - Modified
---
Quarkus3 branch sync no. 5 (10.2.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml - Modified
---
Quarkus3 branch sync no. 1 (18.1.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/pom.xml - Modified
2023-04-27 13:36:54 +02:00
Stefan Guilhen
3111ef0085
Map Storage JPA fixes
...
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 3 (27.1.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
2023-04-27 13:36:54 +02:00
Stefan Guilhen
384d7c17f7
- Fix issues in legacy store
...
- Testsuite (switch undertow-embedded.version)
2023-04-27 13:36:54 +02:00
Martin Bartoš
cecd059af2
WiP - Resolve failure with JakartaEE Tx and Infinispan/HotRod
...
---
Quarkus3 branch sync #1 (18.1.2023)
Resolved conflicts:
keycloak/quarkus/runtime/pom.xml - Modified
keycloak/quarkus/pom.xml - Modified
keycloak/quarkus/deployment/pom.xml - Modified
2023-04-27 13:36:54 +02:00
Stefan Guilhen
e505021681
Model upgrade Hibernate/JPA
...
---
Quarkus3 branch sync no. 14 (24.4.2023)
Resolved conflicts:
keycloak/pom.xml - Modified
---
Quarkus3 branch sync no. 13 (11.4.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 11 (24.3.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 7 (27.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/client/entity/JpaClientEntity.java - Modified
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/clientScope/entity/JpaClientScopeEntity.java - Modified
keycloak/pom.xml - Modified
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaMapStorageProviderFactory.java - Modified
---
Quarkus3 branch sync no. 1 (18.1.2023)
Resolved conflicts:
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/hibernate/dialect/JsonbPostgreSQL95Dialect.java - Modified
2023-04-27 13:36:54 +02:00
Martin Bartoš
7cff857238
Migrate packages from javax.* to jakarta.*
...
---
Quarkus3 branch sync no. 14 (24.4.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ComponentExportImportTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/DeclarativeUserTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/FlowTest.java - Modified
keycloak/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java - Modified
---
Quarkus3 branch sync no. 13 (11.4.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AccountTotpPage.java - Deleted
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BackwardsCompatibilityUserStorageTest.java - Modified
---
Quarkus3 branch sync no. 12 (31.3.2023)
Resolved conflicts:
keycloak/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/QuarkusWelcomeResource.java - Modified
keycloak/services/src/main/java/org/keycloak/protocol/saml/profile/util/Soap.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UserInfoClientUtil.java - Modified
keycloak/services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsTest.java - Modified
---
Quarkus3 branch sync no. 10 (17.3.2023)
Resolved conflicts:
keycloak/services/src/main/java/org/keycloak/protocol/saml/SamlProtocolUtils.java - Modified
---
Quarkus3 branch sync no. 9 (10.3.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java - Modified
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java - Modified
---
Quarkus3 branch sync no. 8 (3.3.2023)
Resolved conflicts:
keycloak/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SamlClient.java Modified - Modified
keycloak/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java - Modified
keycloak/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticator.java - Modified
---
Quarkus3 branch sync no. 6 (17.2.2023)
Resolved conflicts:
keycloak/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ComponentsResource.java - Modified
keycloak/testsuite/utils/src/main/java/org/keycloak/testsuite/KeycloakServer.java - Modified
keycloak/services/src/main/java/org/keycloak/protocol/saml/installation/SamlSPDescriptorClientInstallation.java - Modified
---
Quarkus3 branch sync no. 5 (10.2.2023)
Resolved conflicts:
/keycloak/services/src/main/java/org/keycloak/social/google/GoogleIdentityProvider.java Modified - Modified
keycloak/services/src/main/java/org/keycloak/social/twitter/TwitterIdentityProvider.java - Modified
---
Quarkus3 branch sync no. 4 (3.2.2023)
Resolved conflicts:
keycloak/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java - Modified
---
Quarkus3 branch sync no. 1 (18.1.2023)
Resolved conflicts:
keycloak/testsuite/client/ClientPoliciesTest.java - Deleted
keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java - Modified
keycloak/model/map-jpa/src/main/java/org/keycloak/models/map/storage/jpa/JpaModelCriteriaBuilder.java - Modified
2023-04-27 13:36:54 +02:00
Alexander Schwartz
7562f8ec6e
Rewrite changelog SQL to make it work on Oracle
...
Closes #19841
2023-04-24 13:30:16 +02:00
Hynek Mlnarik
68b3c87666
Support for realm-less entities in providers (login failures)
...
Closes : #19818
2023-04-20 21:19:41 +02:00
rmartinc
5a3b8ee577
Avoid adding post.logout.redirect.uris if already defined as client attributes
...
Closes https://github.com/keycloak/keycloak/issues/16992
2023-04-19 10:48:17 +02:00
Alexander Schwartz
8f4c721a7d
Fix half-initialized EMF for JPA Map Storage
...
Closes #19741
2023-04-17 09:58:54 +02:00
mposolda
1cbdf4d17e
Fix the issue with LDAP connectionUrl containing multiple hosts
...
Closes #17359
2023-04-16 17:41:22 +02:00
Michal Hajas
b730d861e7
Refactor map storage transaction initialization
...
* Refactor transaction to be enlisted in MapStorageProvider instead of area provider
* Make KeycloakTransaction methods optional for MapKeycloakTransaction
* Remove MapStorage interface that contained only createTransaction method
* Rename *MapStorage to *CrudOperations
* Adjust File store to new structure
* Rename MapKeycloakTransaction to MapStorage
* Rename getEnlistedTransaction to getMapStorage in AbstractMapProviderFactory
* Rename variables tx and transaction to store
* Add createMapStorageIfAbsent to JpaMapStorageProvider
* Update JavaDoc
Co-authored-by: Hynek Mlnarik <hmlnarik@redhat.com>
2023-04-12 11:21:14 +02:00
Martin Kanis
37af5fbffe
Introduce optimistic locking for HotRod storage
...
Closes #15402
2023-04-11 09:33:01 +02:00
Stefan Guilhen
ad3b264088
Introduce last modified time validation
...
- Also fixes commit/rollback logic to prevent deletion of wrong files on rollback
Closes #17491
Closes #17660
2023-04-06 14:50:46 +02:00
mposolda
554818f422
Rename jpa-changelog-22.0.0.xml
...
closes #19527
2023-04-04 19:21:14 +02:00
mposolda
4d8d6f8cd8
Preserve authentication flow IDs after import
...
closes #9564
2023-04-03 16:01:52 +02:00
vramik
5aafc99673
Remove em.refresh(realm)
call during realm removal in JpaRealmProvider
...
Closes #19430
2023-04-03 09:27:13 +02:00
Alexander Schwartz
9affc262bd
Consistent handling of enums in the database schema
...
Closes #19404
2023-03-30 12:14:43 +02:00
Michal Hajas
e49dfe534e
Fix missing migration when reading TERMS_AND_CONDITIONS required action in legacy store
...
Closes #17277
2023-03-29 16:43:01 +02:00
Michal Hajas
2a5b5c4a40
Fix stale client session is present in user session
...
Closes #17570
2023-03-28 08:32:31 +02:00
Michal Hajas
637c47ac0e
Fix NoActionHotRodTransactionWrapper using default exists implementation
...
Closes #19196
2023-03-28 08:29:50 +02:00
Alexander Schwartz
251f6151e8
Rework the Import SPI to be configurable via the Config API
...
Also rework the export/import CLI for Quarkus, so that runtime options are available.
Closes #17663
2023-03-24 15:28:55 -03:00
Pedro Hos
bd0a23a865
/users/count endpoint with search field has different behavior than /users query endpoint #17620
...
closes #17620
2023-03-24 13:43:47 +01:00
Michal Hajas
6d2177f2c8
Remove clientRole flag from HotRodRoleEntity ( #17655 )
...
Closes #17086
2023-03-21 09:31:54 +01:00
Alexander Schwartz
513bb809f3
Add a map storage global locking implementation for JPA
...
Closes #14734
2023-03-21 08:21:11 +01:00
Martin Kanis
5e7793b64d
Unexpected invalid_grant error on offline session refresh when client session is not in the cache
...
Closes #9959
Co-authored-by: Martin Kanis <mkanis@redhat.com>
Co-authored-by: Lex Cao <lexcao@foxmail.com>
2023-03-15 12:39:43 +01:00
Michal Hajas
9c2511e205
Store index data in memory instead of persistent store to make it consistent with cached data
...
Closes #15653
2023-03-13 14:27:41 +01:00
Michal Hajas
837c64de3d
Add support for pessimistic locking to HotRod
...
Closes #13273
2023-03-07 10:44:31 +01:00
Alexander Schwartz
f6f179eaca
Rework the export to use CLI options and property mappers
...
Also, adding the wiring to support Model tests for the export.
Closes #13613
2023-03-07 08:22:12 +01:00
Michal Hajas
465019bec4
Extract attachDevice outside of storage layer
...
Closes #17336
2023-03-03 17:58:34 +01:00
Jon Koops
972ebb9650
Use a valid SemVer format for the SNAPSHOT version ( #17334 )
...
* Use a valid SemVer format for the SNAPSHOT version
* Update pom.xml
* Update pom.xml
---------
Co-authored-by: Stian Thorgersen <stianst@gmail.com>
Co-authored-by: Stian Thorgersen <stian@redhat.com>
2023-03-03 11:11:44 +01:00
vramik
d923aa5d5d
Entity version is not updated when the entity is root entity
...
Closes #17339
2023-03-02 15:21:43 +01:00
Thomas Darimont
16efddc908
Fix NPE in MigrateTo21_0_0 when admin theme is not set explicitly ( #17249 )
...
Only update admin-console theme to keycloak.v2 if it is explicitly set to "keycloak" or "rh-sso".
Fixes #17248
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
Co-authored-by: Stian Thorgersen <stian@redhat.com>
2023-02-23 15:37:59 +00:00
Hynek Mlnarik
7d136c5cca
Generate map-like collection accessors
...
Along the way fixes also problem with field delegates which
applied manually-crafted methods like `MapUserEntity.removeCredential(id)`
to the delegate itself rather than to the underlying object.
Co-authored-By: Michal Hajas <mhajas@redhat.com>
Closes : #17223
2023-02-22 17:26:31 +01:00
Hynek Mlnarik
878debd2ab
Forbid changing ID
...
Closes : #16881
2023-02-22 17:19:22 +01:00