Commit graph

9956 commits

Author SHA1 Message Date
mposolda
9a19e95b60 KEYCLOAK-5710 Change cache-server to use backups based caches 2017-10-24 11:52:08 +02:00
Stian Thorgersen
f0bbcbf0fd KEYCLOAK-5487 (#4603) 2017-10-24 10:49:08 +02:00
Stan Silvert
330f2acc29 KEYCLOAK-5732: Freemarker pages using ?html (#4607) 2017-10-23 16:35:45 -04:00
Pavel Drozd
4010e5e247 Merge pull request #4588 from tkyjovsk/KEYCLOAK-5711
KEYCLOAK-5711 Adapter test module for Wildfly has compilation error
2017-10-23 22:27:31 +02:00
Stan Silvert
574fd42534 KEYCLOAK-5681: Upgrade AngularJS for Admin Console (#4571) 2017-10-23 12:03:46 -04:00
Stan Silvert
9083e5fe5c KEYCLOAK-5298: Enable autoescaping in Freemarker (#4561)
* KEYCLOAK-5298: Enable autoescaping in Freemarker

* Fix several of the failing tests.

* Fix broken tests in integration-deprecated

* Fix last failing test.
2017-10-23 12:03:00 -04:00
Pavel Drozd
1eb2d894e5 Merge pull request #4593 from vmuzikar/ssl-fix
KEYCLOAK-5719 fix auth server ssl with base testsuite
2017-10-23 16:39:22 +02:00
Stian Thorgersen
9b75b603e3 KEYCLOAK-5234 (#4585) 2017-10-23 16:13:22 +02:00
Pavel Drozd
20d0fa1b4e Merge pull request #4528 from RaiSaurabh/test
KEYCLOAK-5623: Fix to support the URL handler for the file loading.
2017-10-23 12:52:10 +02:00
saurabhrai
6dd8592434 KEYCLOAK-5623: Updated to code to check the profile configuration to support Jboss Fuse adapter. Read from profile resource. 2017-10-23 14:17:18 +05:30
Pavel Drozd
aaf25ad4f0 Merge pull request #4592 from vramik/KEYCLOAK-5705
KEYCLOAK-5705 add missing dependency to module.xml for mssql
2017-10-23 09:56:01 +02:00
Bill Burke
73ba06b26b Merge pull request #4590 from patriot1burke/master
KEYCLOAK-5698
2017-10-20 14:58:07 -04:00
Bill Burke
92245e3fc8 fixes 2017-10-20 09:55:37 -04:00
vmuzikar
1dd2a90e20 KEYCLOAK-5719 fix auth server ssl with base testsuite 2017-10-20 14:10:06 +02:00
vramik
25d785df02 KEYCLOAK-5705 add missing dependency to module.xml for mssql 2017-10-20 12:56:51 +02:00
Hynek Mlnařík
60d8236f05 Merge pull request #4584 from hmlnarik/KEYCLOAK-5707-Have-travis-run-cross-dc-tests-when-appropriate
KEYCLOAK-5707 Have travis run cross-dc tests when appropriate
2017-10-20 11:06:06 +02:00
Bill Burke
54ebc21880 KEYCLOAK-5698 2017-10-19 19:38:56 -04:00
Tomas Kyjovsky
bd706418c9 KEYCLOAK-5711 Adapter test module for Wildfly has compilation error 2017-10-19 19:41:31 +02:00
Bill Burke
0371a562d9 Merge pull request #4574 from patriot1burke/master
KEYCLOAK-5701
2017-10-19 10:33:10 -04:00
Hynek Mlnarik
3248557897 KEYCLOAK-5707 Have travis run cross-dc tests when appropriate 2017-10-19 13:29:26 +02:00
Pedro Igor
00ea849cb9 Merge pull request #4575 from pedroigor/KEYCLOAK-5703
[KEYCLOAK-5703] - Improving exception handling and parsing server response
2017-10-19 09:20:35 -02:00
Hynek Mlnařík
0fbbe52ea7 Merge pull request #4581 from hmlnarik/KEYCLOAK-5700-Add-support-for-jarless-server-distribution
KEYCLOAK-5700 Documentation for jarless server distribution
2017-10-19 09:45:13 +02:00
Stian Thorgersen
5421c862e0 KEYCLOAK-5551 (#4579) 2017-10-19 09:23:31 +02:00
Stian Thorgersen
d9ffc4fa21 KEYCLOAK-5225 (#4577)
KEYCLOAK-5225 fix test

Fix
2017-10-19 08:23:16 +02:00
Stian Thorgersen
fea4c54adc KEYCLOAK-5280 (#4576) 2017-10-19 08:02:23 +02:00
Hynek Mlnarik
8e5a6f9bf2 KEYCLOAK-5700 Documentation for jarless server distribution 2017-10-19 07:47:15 +02:00
Wyvie
988d660083 [KEYCLOAK-3837] added session and account linking spring boot tests (#4564) 2017-10-19 06:29:59 +02:00
Pedro Igor
4071dd7734 [KEYCLOAK-5703] - Improving exception handling and parsing server response 2017-10-18 20:27:21 -02:00
Bill Burke
8faa6f1f4d KEYCLOAK-5701 2017-10-18 18:20:50 -04:00
Pedro Igor
19f54111ec Merge pull request #4573 from pedroigor/KEYCLOAK-4550
[KEYCLOAK-4550] - Test invalid configuration for user policy
2017-10-18 19:37:29 -02:00
Pedro Igor
cedc095a9c [KEYCLOAK-4550] - Test invalid configuration for user policy 2017-10-18 18:42:55 -02:00
Hynek Mlnařík
4c2ddfdf54 Merge pull request #4568 from hmlnarik/KEYCLOAK-5688-Externalizer-for-entities-shared-across-DC
KEYCLOAK-5688 Externalizer for entities shared across dc
2017-10-18 22:19:27 +02:00
Bill Burke
0fb99a0098 Merge pull request #4569 from patriot1burke/master
KEYCLOAK-4328
2017-10-18 10:49:52 -04:00
Hynek Mlnarik
6d18ba4b32 KEYCLOAK-5688 Add externalizers for session entities
and remove unused events
2017-10-18 16:04:57 +02:00
Bill Burke
649bca7618 KEYCLOAK-4328 2017-10-18 09:37:17 -04:00
Hynek Mlnarik
d01be82b35 KEYCLOAK-5700 Add option to build jarless Wildfly distro
Use via the following maven command:

mvn clean install -Pdistribution -Dkeycloak.provisioning.xml=server-provisioning-devel.xml
2017-10-18 15:14:58 +02:00
Thomas Darimont
3103e0fd0a KEYCLOAK-5244 Add BlacklistPasswordPolicyProvider (#4370)
* KEYCLOAK-5244 Add BlacklistPasswordPolicyProvider

This introduces a new PasswordPolicy which can refer to
a named predefined password-blacklist to avoid users
choosing too easy to guess passwords.

The BlacklistPasswordPolicyProvider supports built-in as
well as custom blacklists.
built-in blacklists use the form `default/filename`
and custom ones `custom/filename`, where filename
is the name of the found blacklist-filename.

I'd propose to use some of the freely available password blacklists
from the [SecLists](https://github.com/danielmiessler/SecLists/tree/master/Passwords) project.

For testing purposes one can download the password blacklist
```
wget -O 10_million_password_list_top_1000000.txt https://github.com/danielmiessler/SecLists/blob/master/Passwords/10_million_password_list_top_1000000.txt?raw=true
```
to /data/keycloak/blacklists/

Custom password policies can be configured with the SPI
configuration mechanism via jboss-cli:
```
/subsystem=keycloak-server/spi=password-policy:add()
/subsystem=keycloak-server/spi=password-policy/provider=passwordBlacklist:add(enabled=true)
/subsystem=keycloak-server/spi=password-policy/provider=passwordBlacklist:write-attribute(name=properties.blacklistsFolderUri, value=file:///data/keycloak/blacklists/)
```

Password blacklist is stored in a TreeSet.

* KEYCLOAK-5244 Encode PasswordBlacklist as a BloomFilter

We now use a dynamically sized BloomFilter with a
false positive probability of 1% as a backing store
for PasswordBlacklists.

BloomFilter implementation is provided by google-guava
which is available in wildfly.

Password blacklist files are now resolved against
the ${jboss.server.data.dir}/password-blacklists.

This can be overridden via system property, or SPI config.
See JavaDoc of BlacklistPasswordPolicyProviderFactory for details.

Revised implementation to be more extensible, e.g. it could be
possible to use other stores like databases etc.

Moved FileSystem specific methods to FileBasesPasswordBlacklistPolicy.

The PasswordBlacklistProvider uses the guava version 20.0
shipped with wildfly. Unfortunately the arquillian testsuite
transitively depends on guava 23.0 via the selenium-3.5.1
dependency. Hence we need to use version 23.0 for tests but 20.0
for the policy provider to avoid NoClassDefFoundErrors in the
server-dist.

Configure password blacklist folder for tests

* KEYCLOAK-5244 Configure jboss.server.data.dir for test servers

* KEYCLOAK-5244 Translate blacklisted message in base/login
2017-10-17 20:41:44 +02:00
Hynek Mlnařík
fe76b2428b Merge pull request #4563 from hmlnarik/KEYCLOAK-5656-Transport-factory-should-not-limit-to-a-single-DC-3
KEYCLOAK-5656 Use standard infinispan remote-store
2017-10-17 09:39:01 +02:00
Pavel Drozd
2a818947c2 Merge pull request #4565 from vramik/KEYCLOAK-5674
KEYCLOAK-5674 updated migration scripts
2017-10-17 08:23:16 +02:00
Pavel Drozd
83b4279ce1 Merge pull request #4555 from vramik/KEYCLOAK-5673
KEYCLOAK-5673 add support for testing config from prod 2.5.x
2017-10-17 07:43:40 +02:00
Pavel Drozd
9c16a58d52 Merge pull request #4554 from vramik/KEYCLOAK-5672
KEYCLOAK-5672 rewrite server-config-migration module to use offline mode
2017-10-17 07:42:29 +02:00
vramik
cb2bd0fe1a KEYCLOAK-5672 rewrite server-config-migration module to use offline mode 2017-10-16 22:51:59 +02:00
vramik
a42e0d6a31 KEYCLOAK-5674 updated migration scripts 2017-10-16 22:36:40 +02:00
Hynek Mlnarik
056ba75a72 KEYCLOAK-5656 Use standard infinispan remote-store 2017-10-16 21:49:42 +02:00
Bruno Oliveira da Silva
b6ab2852c2 Remove unused imports (#4558) 2017-10-16 14:23:42 +02:00
Bruno Oliveira da Silva
9cbc335b68 Update the readme with a reference on how to report vulnerabilities (#4541) 2017-10-16 12:27:11 +02:00
Gabriel Lavoie
e2f5ac60cf KEYCLOAK-5499: Use authentication token type rather than token source detection to identify interactive and non-interactive authentications. (#4488)
- access_token URL parameter wasn't interpreted correctly as a non-interactive authentication.
2017-10-16 09:38:05 +02:00
Sjoerd Cranen
cb43e3d763 KEYCLOAK-5191 Prevent exception in KeycloakAuthenticationFailureHandler (#4319)
* KEYCLOAK-5191 Don't attempt to send 401 when response is already committed

* KEYCLOAK-5191 Defend against configuration errors by preventing 2xx response after authentication failure
2017-10-16 09:34:58 +02:00
Bill Burke
31dccc9a5e Merge pull request #4509 from TeliaSoneraNorge/KEYCLOAK-5032
KEYCLOAK-5032 Forward request parameters to another IdP
2017-10-13 18:47:05 -04:00
Bill Burke
c66ce3a209 Merge pull request #4559 from micedre/KEYCLOAK-4052bis
KEYCLOAK-4052 - add an option to validate Password Policy for ldap user storage
2017-10-13 18:44:57 -04:00