Denis
23bfaef4bb
KEYCLOAK-15535 Account Log of user login with realm not available details when update profile
2021-03-04 08:06:36 +01:00
Yang Xie
78754d1127
KEYCLOAK-17259 Add a method to check if the introspection request has duplicate parameters
2021-03-03 16:23:27 +01:00
Pedro Igor
0f30b3118a
[KEYCLOAK-16676] - Client attributes should not be stored if null or empty
2021-03-03 15:37:05 +01:00
Pedro Igor
40efbb0f9c
[KEYCLOAK-13942] - Invalidate pre-defined paths when paths are invalidated
2021-03-02 15:01:42 +01:00
Takashi Norimatsu
882f5ffea4
KEYCLOAK-15533 Client Policy : Extends Policy Interface to Migrate Client Registration Policies
...
Co-authored-by: Hryhorii Hevorkian <hhe@adorsys.com.ua>
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
2021-03-02 09:26:04 +01:00
i7a7467
b83064b142
KEYCLOAK-16679 Add algorithm settings for client assertion signature in OIDC identity broker
2021-03-01 18:11:25 +01:00
Takashi Norimatsu
c4bf8ecdf0
KEYCLOAK-16880 Client Policy - Condition : Negative Logic Support
2021-03-01 14:27:39 +01:00
mposolda
41dc94fead
KEYCLOAK-14483 Broker state param fix
2021-02-24 19:07:58 -03:00
mposolda
6f409d088a
KEYCLOAK-15239 Reset Password Success Message not shown when Kerberos is Enabled
2021-02-23 16:15:50 -03:00
Pedro Igor
dbc6514bfc
[KEYCLOAK-17206] - Avoid removing attributes when updating user and profile
2021-02-23 08:41:41 +01:00
Juan Manuel Rodriguez Alvarado
6255ebe6b5
[KEYCLOAK-16536] Implement Audit Events for Authorization Services requests
2021-02-22 17:28:59 -03:00
mposolda
ed8d5a257f
KEYCLOAK-16517 Make sure that just real clients with standardFlow or implicitFlow enabled are considered for redirectUri during logout
2021-02-22 14:30:32 +01:00
mposolda
0058011265
KEYCLOAK-16006 User should not be required to re-authenticate after revoking consent to an application
2021-02-22 14:29:42 +01:00
Pedro Igor
1dc0b005fe
[KEYCLOAK-17087] - X509 OCSP Validation Not Checking Intermediate CAs
2021-02-22 13:50:19 +01:00
Lukas Hanusovsky
4a2830bc2e
KEYCLOAK-15849 : auth-remote-server exclude -> removed duplicated annotation, fixed @Test(timeout) bug -> replaced by lambda expression.
2021-02-22 13:40:47 +01:00
Pedro Igor
9356843c6c
[KEYCLOAK-16521] - Fixing secret for non-confidential clients
2021-02-19 08:38:49 +01:00
Torsten Roemer
750f5fdb0a
KEYCLOAK-14577 OIDCIdentityProvider incorrectly sets firstName and lastName in BrokeredIdentityContext
2021-02-18 19:50:27 +01:00
Torsten Roemer
00ee6bb9fa
KEYCLOAK-14577 OIDCIdentityProvider incorrectly sets firstName and lastName in BrokeredIdentityContext
2021-02-18 19:50:27 +01:00
rmartinc
056b52fbbe
KEYCLOAK-16800 userinfo fails with 500 Internal Server Error for service account token
2021-02-18 19:37:52 +01:00
Pedro Igor
431f137c37
[KEYCLOAK-17123] - Avoid validation and updates for read-only attributes during updates
2021-02-17 17:57:46 +01:00
stefvdwel
b97f5eb128
Added PermissionTicket count test.
2021-02-17 09:40:19 -03:00
Pedro Igor
2593c3dbc4
[KEYCLOAK-15893] - Incorrect resource match is returned for some cases when using wildcard in uri
2021-02-17 12:51:26 +01:00
mposolda
80bf0b6bad
KEYCLOAK-16708 Unexpected exceptions during client authentication
2021-02-12 18:27:54 +01:00
Pedro Igor
ca2a761d4b
[KEYCLOAK-16886] - Updating user account removes attributes
2021-02-12 12:01:50 -03:00
Michito Okai
33bb1fda38
KEYCLOAK-16931 Authorization Server Metadata of
...
introspection_endpoint_auth_methods_supported and
introspection_endpoint_auth_signing_alg_values_supported
2021-02-11 14:53:49 +01:00
Pedro Igor
7a4733acc9
[KEYCLOAK-14034] - Adding tests for matching uris once updated
2021-02-11 09:44:43 -03:00
mposolda
456cdc51f2
KEYCLOAK-15719 CORS headers missing on userinfo error response
2021-02-11 13:37:42 +01:00
diodfr
cb12fed96e
KEYCLOAK-4544 Detect existing user before granting user autolink
2021-02-11 11:06:49 +01:00
Lukas Hanusovsky
223d0ea456
KEYCLOAK-16625 : Testsuite -> auth.server.remote: adding keystore file to a build directory.
2021-02-09 15:22:43 +01:00
Pedro Igor
f6c3ec5d9e
[KEYCLOAK-14366] - Missing check for iss claim in JWT validation on Client Authentication (Token Endpoint)
2021-02-09 13:54:06 +01:00
Pedro Igor
ab9a38ec27
[KEYCLOAK-13115] - Unable to add a role to a user if username query matches multiple acounts
2021-02-09 13:49:25 +01:00
Pedro Igor
eb37a1ed69
[KEYCLOAK-17031] - ClientInvalidationClusterTest failing on Quarkus due to unreliable comparison
2021-02-05 16:09:27 +01:00
mposolda
f4b5942c6c
KEYCLOAK-16755 ClearExpiredUserSessions optimization. Rely on infinispan expiration rather than Keycloak own background task.
2021-02-04 08:49:42 +01:00
Yang Xie
cffe24f815
KECLOAK-16009 Add a method to check if the token request has duplicate parameters
2021-02-03 16:10:41 +01:00
Florian Apolloner
eeec82dea3
KEYCLOAK-16656 Only set execution authenticator for form flows.
2021-01-29 17:19:15 +01:00
Martin Kanis
8432513daa
KEYCLOAK-16908 Refactor UserSessionPersisterProvider
2021-01-29 09:29:00 +01:00
Pedro Igor
922d7da3ae
[KEYCLOAK-16497] - AuthzClient.create() fails when env variables are used in auth-server-url
2021-01-28 12:07:58 -03:00
Hynek Mlnarik
60e4bd622f
KEYCLOAK-16828 Fix HttpClient failures and close HttpResponses
2021-01-28 08:38:34 +01:00
rmartinc
f3a4991b6a
KEYCLOAK-15975 NPE in DefaultThemeManager.loadTheme() if theme directory is absent
2021-01-27 22:05:19 +01:00
Pedro Igor
0c501f8302
[KEYCLOAK-16837] - Authz client still relying on refresh tokens when doing client credentials
2021-01-27 12:23:32 -03:00
mposolda
99a70267d9
KEYCLOAK-16801 Improve performance of ClearExpiredEvents background task
2021-01-27 09:57:46 +01:00
Takashi Norimatsu
b89edabcfc
KEYCLOAK-16889 Client Policy : Refactor Test Class
2021-01-27 09:06:08 +01:00
Martin Kanis
9f580e3ed8
KEYCLOAK-15695 Streamification cleanup
2021-01-20 14:39:53 +01:00
Thomas Darimont
6315fe5d22
KEYCLOAK-16464 Test mapping of enabled and emailVerified user model attribute to LDAP attributes
2021-01-20 09:24:06 +01:00
Takashi Norimatsu
bcf313f321
KEYCLOAK-16858 Client Policy - Improper retainAll operation in Client Scope Condition and other minor bugs
2021-01-20 09:10:21 +01:00
Martin Bartoš
9df7fdbc55
KEYCLOAK-14718 Adding test case for User Client Role Mapper
2021-01-19 17:49:36 +01:00
Michal Hajas
ba8e2fef6b
KEYCLOAK-15524 Cleanup user related interfaces
2021-01-18 16:56:10 +01:00
mposolda
dae4a3eaf2
KEYCLOAK-16468 Support for deny list of metadata attributes not updateable by account REST and admin REST
...
(cherry picked from commit 79db549c9d561b8d5efe3596370190c4da47e4e1)
(cherry picked from commit bf4401cddd5d3b0033820b1cb4904bd1c8b56db9)
2021-01-18 13:17:51 +01:00
mposolda
eac3329d22
KEYCLOAK-14019 Improvements for request_uri parameter
...
(cherry picked from commit da38b36297a5bd9890f7df031696b516268d6cff)
2021-01-18 13:05:09 +01:00
Pedro Igor
c631013031
[KEYCLOAK-16515] - Scope permissions not added to result if previous permission is granted
2021-01-14 17:08:05 +01:00
Takashi Norimatsu
5f445ec18e
KEYCLOAK-14200 Client Policy - Executor : Enforce Holder-of-Key Token
...
Co-authored-by: Hryhorii Hevorkian <hhe@adorsys.com.ua>
2021-01-12 11:21:41 +01:00
Takashi Norimatsu
f423c0dc51
KEYCLOAK-16249 Client Policy - Condition : Client - Any Client
2021-01-08 17:29:50 +01:00
vramik
1402d021de
KEYCLOAK-14846 Default roles processing
2021-01-08 13:55:48 +01:00
Takashi Norimatsu
05dfac75ca
KEYCLOAK-14202 Client Policy - Executor : Enforce secure signature algorithm for Signed JWT client authentication
...
Co-authored-by: Andrii Murashkin <amu@adorsys.com.ua>
2021-01-06 08:58:20 +01:00
Thomas Darimont
1a7600e356
KEYCLOAK-13923 Support PKCE for OIDC based Identity Providers ( #7381 )
...
* KEYCLOAK-13923 - Support PKCE for Identity Provider
We now support usage of PKCE for OIDC based Identity Providers.
* KEYCLOAK-13923 Warn if PKCE information cannot be found code-to-token request in OIDCIdentityProvider
* KEYCLOAK-13923 Pull up PKCE handling from OIDC to OAuth IdentityProvider infrastructure
* KEYCLOAK-13923 Adding test for PKCE support for OAuth Identity providers
* KEYCLOAK-13923 Use URI from KeycloakContext instead of HttpRequest
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
2021-01-05 10:59:59 -03:00
mposolda
d4a36d0d9c
KEYCLOAK-16350 invalid_scope error response should be displayed for openid-connect/auth
2021-01-05 12:55:53 +01:00
vramik
dfa27b9f0f
KEYCLOAK-14856 fix migration, add ssl for migration server
2021-01-05 11:05:18 +01:00
keycloak-bot
75be33ccad
Set version to 13.0.0-SNAPSHOT
2020-12-16 17:31:55 +01:00
Stefan Guilhen
d6422e415c
[KEYCLOAK-16508] Complement methods for accessing user sessions with Stream variants
2020-12-15 19:52:31 +01:00
Takashi Norimatsu
edabbc9449
KEYCLOAK-14203 Client Policy - Executor : Enforce HTTPS URIs
2020-12-15 09:31:20 +01:00
Martin Bartoš
24f1a9c5c4
KEYCLOAK-16583 Ignore tests which directly use WebAuthn Chrome testing feature
2020-12-14 16:39:32 +01:00
Martin Bartoš
cfc035ee42
KEYCLOAK-15066 Internal Server error when calling random idp endpoint
2020-12-14 16:37:53 +01:00
Cédric Couralet
f4abc86a66
KEYCLOAK-16112 don't remove username attribute
2020-12-14 15:46:25 +01:00
Takashi Norimatsu
200b53ed1e
KEYCLOAK-14192 Client Policy - Condition : Author of a client - User Role
2020-12-14 15:37:05 +01:00
Michal Hajas
8e376aef51
KEYCLOAK-15847 Add MapUserProvider
2020-12-10 08:57:53 +01:00
Martin Kanis
3ddedc49f5
KEYCLOAK-11417 Internal server error on front channel logout with expired session
2020-12-09 14:45:04 +01:00
Martin Bartoš
873a69305f
KEYCLOAK-15264 Import realm using directory provider twice with IGNORE_EXISTING will cause NPE for clientId
2020-12-08 11:28:07 +01:00
Hynek Mlnarik
8c0c542f09
KEYCLOAK-16489 Add ability to run model tests with LDAP
2020-12-07 20:54:06 +01:00
Martin Kanis
f6be378eca
KEYCLOAK-14556 Authentication session map store
2020-12-07 20:48:59 +01:00
Stefan Guilhen
edef93cd49
[KEYCLOAK-16232] Streamify the UserCredentialStore and UserCredentialManager interfaces
2020-12-07 19:48:35 +01:00
Stefan Guilhen
73d0bb34c4
[KEYCLOAK-16232] Replace usages of deprecated collection-based methods with the respective stream variants
2020-12-07 19:48:35 +01:00
Takashi Norimatsu
7da5a71314
KEYCLOAK-14191 Client Policy - Condition : Author of a client - User Group
2020-12-03 17:52:06 +01:00
Ian
be4c99dfe5
KEYCLOAK-15287 Ability to add custom claims to the AccessTokenResponse
2020-12-03 17:28:03 +01:00
Peter Zaoral
c8a2f82a50
KEYCLOAK-14138 Upgrade OTP login screen
...
* edited related css and ftl theme resources
* added tile component
* fixed IE11 compatibility
* fixed affected tests
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2020-12-03 16:00:36 +01:00
Takashi Norimatsu
a51e0cc484
KEYCLOAK-14197 Client Policy - Condition : Client - Client Host
2020-12-02 09:05:42 +01:00
vramik
cd9e01af90
KEYCLOAK-16502 Migration of DELETE_ACCOUNT role
2020-12-01 13:10:20 +01:00
Peter Zaoral
ad940a861a
KEYCLOAK-14137 Upgrade Authentication selector screen
...
* edited related css and ftl theme resources
* added IE11 compatibility support
* fixed affected tests
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2020-11-27 08:40:06 +01:00
Jan Lieskovsky
833bf98643
[KEYCLOAK-15692] Upgrade to Wildfly "21.0.1.Final"
...
Base fixes:
* [KEYCLOAK-15780] Upgrade Keycloak to Wildfly 21.0.0.Beta1 / Wildfly Core 13.0.0.Beta6
* [KEYCLOAK-16031] Upgrade Keycloak to Wildfly 21.0.0.Final / Wildfly Core 13.0.1.Final
* [KEYCLOAK-16442] Upgrade Keycloak to Wildfly 21.0.1.Final / Wildfly Core 13.0.3.Final
Other (dependent) fixes:
* [KEYCLOAK-15408] Deprecate former Wildfly and Wildfly Core versions in Arquillian's
testsuite pom.xml file as part of the upgrade script
* [KEYCLOAK-15442] Update the version of 'jboss-parent' as part of the Wildfly upgrade
script if necessary
* [KEYCLOAK-15474] Add --verbose and --force options to the Wildfly upgrade automated script
* [KEYCLOAK-15649] Update "urn:jboss:domain:infinispan:10.0" version as part of the Wildfly
upgrade automated script
* [KEYCLOAK-15652] Wildfly upgrade automated script - Align Python artifact version
comparsion algorithm with the Maven / Java one
Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
2020-11-26 09:25:29 +01:00
Hynek Mlnarik
5c2122d36f
KEYCLOAK-16444 Initialize JAXP components consistently
2020-11-25 14:20:19 +01:00
zak905
4f330f4a57
KEYCLOAK-953: add allowing user to delete his own account feature
2020-11-24 15:50:07 +01:00
Stan Silvert
0afd55f32c
KEYCLOAK-14547: Make New Account Console the default.
2020-11-23 20:56:05 +01:00
Takashi Norimatsu
5dd5b5bedf
KEYCLOAK-16392 Client Policy - Condition : NPE without any initial configuration
2020-11-23 12:07:28 +01:00
st
a7666d4ccf
KEYCLOAK-11699 add support for 127.0.0.1 for native app
2020-11-20 11:03:29 +01:00
Douglas Palmer
43e075afa5
[KEYCLOAK-14352] JavaScript injection vulnerability of Realm registration REST API
2020-11-18 10:48:11 -03:00
Martin Bartos
ab347df5ee
KEYCLOAK-14915 Upgrade registration screen to PF4
2020-11-18 10:54:17 +01:00
Takashi Norimatsu
9ce2e9b1f7
KEYCLOAK-14193 Client Policy - Condition : Client - Client Access Type
2020-11-18 09:49:22 +01:00
Hynek Mlnarik
29e3d89f3a
KEYCLOAK-16297 Fix HttpClient stale connections
2020-11-16 14:59:00 +01:00
Martin Bartoš
59aa31084e
KEYCLOAK-16143 Login form expected, but registraion form is displayed
2020-11-13 21:36:51 +01:00
Michal Hajas
a766a1dd16
KEYCLOAK-16074 Fix check3pCookiesSupported message callback
2020-11-13 16:01:50 -03:00
Takashi Norimatsu
21c7af1c53
KEYCLOAK-14207 Client Policy - Executor : Enforce more secure client signature algorithm when client registration
2020-11-13 09:24:59 +01:00
Takashi Norimatsu
244a1b2382
KEYCLOAK-14196 Client Policy - Condition : Client - Client Scope
2020-11-12 08:40:28 +01:00
vmuzikar
01be601dbd
KEYCLOAK-14306 OIDC redirect_uri allows dangerous schemes resulting in potential XSS
...
(cherry picked from commit e86bec81744707f270230b5da40e02a7aba17830)
Conflicts:
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ClientTest.java
services/src/main/java/org/keycloak/validation/DefaultClientValidationProvider.java
2020-11-12 08:21:54 +01:00
Takashi Norimatsu
e35a4bcefc
KEYCLOAK-14206 Client Policy - Executor : Enforce more secure state and nonce treatment for preventing CSRF
2020-11-11 21:11:34 +01:00
Hynek Mlnarik
030a077e99
KEYCLOAK-16157 Fix Unexpected I/O error message
2020-11-11 11:12:52 +01:00
Pedro Igor
852c4a57ff
[KEYCLOAK-14468] - Scope permission sometimes not removed when removing scopes
2020-11-11 08:44:28 +01:00
niwde
c69f92831b
[KEYCLOAK-16215] Typo in EventConfigTest
2020-11-10 13:54:39 -03:00
Martin Kanis
d9029b06b9
KEYCLOAK-15889 Streamification of ProtocolMappers
2020-11-10 16:40:34 +01:00
Takashi Norimatsu
a0b1710735
KEYCLOAK-14198 Client Policy - Condition : Client - Client IP
2020-11-10 15:37:26 +01:00
Stefan Guilhen
aa46735173
[KEYCLOAK-15200] Complement methods for accessing users with Stream variants
2020-11-10 15:13:11 +01:00
Takashi Norimatsu
a63814da67
KEYCLOAK-14201 Client Policy - Executor : Enforce Proof Key for Code Exchange (PKCE)
2020-11-09 08:18:05 +01:00
Thomas Darimont
de20830412
KEYCLOAK-9551 KEYCLOAK-16159 Make refresh_token generation for client_credentials optional. Support for revocation of access tokens.
...
Co-authored-by: mposolda <mposolda@gmail.com>
2020-11-06 09:15:34 +01:00
vmuzikar
2df62369c3
KEYCLOAK-15295 User can manage resources with just "view-profile" role using new Account Console
...
(cherry picked from commit 1b063825755d9f5aa13e612757e8ef7299430761)
2020-11-06 08:55:57 +01:00
stianst
6b2e1cbc5f
KEYCLOAK-16167 Enable Account REST API by default
2020-11-06 08:06:03 +01:00
Takashi Norimatsu
6dc136dfc0
KEYCLOAK-14199 Client Policy - Executor : Enforce more secure client authentication method when client registration
2020-11-05 20:42:49 +01:00
Martin Bartos
7522d5ac74
KEYCLOAK-15841 Upgrade rest of the minor forms to PF4
2020-11-05 17:58:41 +01:00
Hynek Mlnarik
7b8575fa1a
KEYCLOAK-16090 Work around LDAPUserLoginTest false failures
2020-11-03 08:38:54 +01:00
Christoph Leistert
e131de9574
KEYCLOAK-14855 Added realm-specific localization texts which affect texts in every part of the UI (admin console / login page / personal info page / email templates). Also new API endpoints and a new UI screen to manage the realm-specific localization texts were introduced.
...
Co-authored-by: Daniel Fesenmeyer <daniel.fesenmeyer@bosch.io>
2020-10-30 08:02:43 -03:00
vramik
785f2e78bc
KEYCLOAK-14977 create MapRoleProvider
2020-10-30 08:15:22 +01:00
Johannes Knutsen
23c575c236
KEYCLOAK-15399: Wrong token type in token response. bearer vs Bearer
2020-10-28 10:38:22 -03:00
Pedro Igor
24f90ca6cb
[KEYCLOAK-15406] - Grant access when evaluating user-managed permission for the owner
2020-10-28 09:59:24 -03:00
Martin Bartos
a8df7d88a1
[KEYCLOAK-14139] Upgrade login screen to PF4
2020-10-27 20:24:07 +01:00
Hynek Mlnarik
267f1797d4
KEYCLOAK-15735 Fix LDAPSamlIdPInitiatedVaryingLetterCaseTest failures on few DBs
2020-10-23 15:15:03 +02:00
Hynek Mlnarik
e80538c60c
KEYCLOAK-15921 Fix auth server URL
2020-10-23 15:14:01 +02:00
Pedro Igor
b95ca30ec2
[KEYCLOAK-14255] - Minor fixes and improvements
2020-10-23 10:39:21 +02:00
Daniel Fesenmeyer
de8d2eafa3
KEYCLOAK-14781 Extend Admin REST API with search by federated identity
...
- Add parameters idpAlias and idpUserId to the resource /{realm}/users and allow it to be combined with the other search parameters like username, email and so on
- Add attribute "federatedIdentities" to UserEntity to allow joining on this field
- extend integration test "UserTest"
2020-10-22 08:51:26 +02:00
Sven-Torben Janus
850d3e7fef
KEYCLOAK-15511 OTP registration during login with LDAP read-only
...
When LDAP user federation is configured in read-only mode, it is not
possible to set required actions for users from LDAP.
Keycloak credential model allows for registering OTP devices when LDAP
ist configured with "Import Users" flag enabled. Registering OTP devices
needs to be done via the account management console and works as
expecetd. However, it fails, if a user has to register aN OTP device
during login (i.e. within the authentication flow), because the OTP Form
Authenticator tries to enforce OTP registration via setting the
corresponding required action for the user. That fails, because the user
is read-only.
To work around this, the required action is set on the authentication
session instead.
2020-10-21 17:00:11 +02:00
mposolda
7891daef73
KEYCLOAK-15998 Keycloak OIDC adapter broken when Keycloak server is on http
2020-10-21 08:36:08 +02:00
mhajas
4556e858ad
KEYCLOAK-15522 Use AbstractStorageManager in UserStorageManager
2020-10-15 20:41:13 +02:00
Sven-Torben Janus
eb002c7ecd
KEYCLOAK-3365 Extend test case
2020-10-15 08:43:31 +02:00
Sven-Torben Janus
5918094840
KEYCLOAK-3365 Add test case
2020-10-15 08:43:31 +02:00
mhajas
d266165f63
KEYCLOAK-14871 Whitelist RefreshableKeycloakSecurityContext for KeycloakPrincipal serialization
2020-10-14 16:00:39 +02:00
Martin Kanis
086f7b4696
KEYCLOAK-15450 Complement methods for accessing realms with Stream variants
2020-10-14 08:16:49 +02:00
Hynek Mlnarik
4541a1b250
KEYCLOAK-15907 Fix new host in SAML adapter cannot restore session
2020-10-12 13:23:03 +02:00
testn
269a72d672
KEYCLOAK-15184: Use static inner class where possible
2020-10-09 23:37:08 +02:00
Luca Leonardo Scorcia
f274ec447b
KEYCLOAK-15697 Make the Service Provider Entity ID user configurable
2020-10-09 22:04:02 +02:00
mposolda
ff05072c16
KEYCLOAK-15770 Skip creating session for docker protocol authentication
2020-10-09 07:53:26 +02:00
mposolda
d269af1b70
KEYCLOAK-15830 Remove authentication session after failed directGrant authentication
2020-10-07 18:13:21 +02:00
vmuzikar
bb7ce62cd5
KEYCLOAK-15332 Missing CORS headers in some endpoints in Account REST API
2020-10-07 09:07:55 -03:00
mhajas
540516c6a9
KEYCLOAK-15734 Exclude tests with testingClient in remote environment
2020-10-06 20:26:24 +02:00
dashaylan
65ecfc960a
Combine UserInfo KcOidcBrokerConfiguration with OidcUserInfoClaimToRoleMapperTest
2020-10-06 08:44:02 +02:00
dashaylan
787d44be78
Reduce code duplication and test count
2020-10-06 08:44:02 +02:00
dashaylan
0d6da99844
Add UserInfo check fix and associated tests.
2020-10-06 08:44:02 +02:00
Markus Till
72f73f153a
UserProfile M1
2020-10-05 09:59:44 -03:00
Michito Okai
eac3341241
KEYCLOAK-15779 Authorization Server Metadata for the URL of the
...
authorization server's JWK Set [JWK] document
2020-10-02 11:18:31 +02:00
Thomas Darimont
12576e339d
KEYCLOAK-15146 Add support for searching users by emailVerified status
...
We now allow to search for users by their emailVerified status.
This enables users to easily find users and deal with incomplete user accounts.
2020-09-29 08:28:59 -03:00
vmuzikar
fbe18e67c3
KEYCLOAK-15721 KeycloakPromise sometimes doesn't work
2020-09-28 15:57:46 -03:00
Takashi Norimatsu
6596811d5d
KEYCLOAK-14204 FAPI-RW Client Policy - Executor : Enforce Request Object satisfying high security level
2020-09-25 08:31:14 +02:00
mhajas
e4078933f8
KEYCLOAK-14828 Disable DTD for SAML XML parser
...
(cherry picked from commit 37de7de78b2ae0eebee97fe917642bb849325f86)
2020-09-24 13:35:21 +02:00
Pedro Igor
76dede0f1e
[KEYCLOAK-14221] - Allow to map subject to userinfo response
2020-09-23 14:33:14 +02:00
vmuzikar
bca73fd04a
KEYCLOAK-15158 Javascript adapter init() is throwing a promise error after upgrade to 11
2020-09-22 10:56:46 -03:00
Frode Ingebrigtsen
0a0b7da53e
KEYCLOAK-15429 Add CORS origin on permission request with invalid access token
2020-09-22 08:56:21 -03:00
Denis
50210c4d9b
KEYCLOAK-14161 Regression on custom registration process
2020-09-21 20:23:39 +02:00
mhajas
12bc84322a
KEYCLOAK-14974 Map group storage provider
2020-09-21 15:56:32 +02:00
testn
2cd03569d6
KEYCLOAK-15238: Fix potential resource leak from not closing Stream/Reader
2020-09-21 13:05:03 +02:00
vmuzikar
790b549cf9
KEYCLOAK-15262 Logout all sessions after password change
2020-09-18 20:09:40 -03:00
mhajas
b75ad2fbd8
KEYCLOAK-15259 Avoid using "null" Origin header as a valid value
2020-09-17 23:21:49 -07:00
mhajas
f7e0af438d
KEYCLOAK-14232 Add Referrer-Policy: no-referrer to each response from Keycloak
...
(cherry picked from commit 0b49640231abc6e465542bd2608e1c908c079ced)
2020-09-17 23:21:49 -07:00
Pedro Igor
0978d78a48
[KEYCLOAK-14255] - Initial changes to configuration
2020-09-16 20:03:52 +02:00
Luca Leonardo Scorcia
10077b1efe
KEYCLOAK-15485 Add option to enable SAML SP metadata signature
2020-09-16 16:40:45 +02:00
Martin Kanis
5d5e56dde3
KEYCLOAK-15199 Complement methods for accessing roles with Stream variants
2020-09-16 16:29:51 +02:00
Benjamin Weimer
f874e9a43c
KEYCLOAK-9874 include realm and client roles in user info response
2020-09-16 10:01:02 +02:00
Takashi Norimatsu
b670734eec
KEYCLOAK-14205 FAPI-RW Client Policy - Executor : Enforce Response Type of OIDC Hybrid Flow
2020-09-14 20:58:25 +02:00
Hynek Mlnarik
a05066d567
KEYCLOAK-15477 Fix permission evaluation logic
2020-09-14 20:53:46 +02:00
vmuzikar
a9a719b88c
KEYCLOAK-15270 Account REST API doesn't verify audience
2020-09-14 08:43:09 -03:00
Miquel Simon
2572b1464b
KEYCLOAK-15395. Removed totp/remove (DELETE) and credentials/password (GET, POST) endpoints.
2020-09-10 18:03:03 -03:00
Takashi Norimatsu
af2f18449b
KEYCLOAK-14195 FAPI-RW Client Policy - Condition : Client - Client Role
2020-09-10 18:34:19 +02:00
Clement Cureau
b19fe5c01b
Finegrain admin as fallback and added some tests
2020-09-10 12:26:55 -03:00
Sebastian Laskawiec
e01159a943
KEYCLOAK-14767 OpenShift Review Endpoint audience fix
2020-09-09 11:57:24 -03:00
Takashi Norimatsu
cbb79f0430
KEYCLOAK-15448 FAPI-RW : Error Response on OIDC private_key_jwt Client Authentication Error (400 error=invalid_client)
2020-09-09 11:14:21 +02:00
Benjamin Weimer
b2934e8dd0
KEYCLOAK-15327 backchannel logout invalidate offline session even if there is no corresponding active session found
2020-09-08 11:17:20 -03:00
Martin Kanis
4e9bdd44f3
KEYCLOAK-14901 Replace deprecated ClientProvider related methods across Keycloak
2020-09-07 13:11:55 +02:00
stianst
76f7fbb984
KEYCLOAK-14548 Add support for cached gzip encoding of resources
2020-09-07 00:58:47 -07:00
Martin Bartos
e34ff6cd9c
[KEYCLOAK-14326] Identity Provider force sync is not working
2020-09-07 09:42:40 +02:00
Takashi Norimatsu
1d8230d438
KEYCLOAK-14190 Client Policy - Condition : The way of creating/updating a client
2020-09-04 09:54:55 +02:00
Luca Leonardo Scorcia
67b2d5ffdd
KEYCLOAK-14961 SAML Client: Add ability to request specific AuthnContexts to remote IdPs
2020-09-03 21:25:36 +02:00
Hynek Mlnarik
1c4a2db8e1
KEYCLOAK-14510 Properly close Response object
2020-09-03 11:23:05 +02:00
Konstantinos Georgilakis
1fa93db1b4
KEYCLOAK-14304 Enhance SAML Identity Provider Metadata processing
2020-09-02 20:43:09 +02:00
Takashi Norimatsu
b93a6ed19f
KEYCLOAK-14919 Dynamic registration - Scope ignored
2020-09-02 13:59:22 +02:00
Takashi Norimatsu
107a429238
KEYCLOAK-15236 FAPI-RW : Error Response on OAuth 2.0 Mutual TLS Client Authentication Error (400 error=invalid_client)
2020-09-02 09:31:20 +02:00
mhajas
3928a49c77
KEYCLOAK-14816 Reset brute-force-detection data for the user after a successful password grant type flow
2020-09-01 21:45:17 +02:00
Hynek Mlnarik
583fa07bc4
KEYCLOAK-11029 Support modification of broker username / ID for identity provider linking
2020-09-01 20:40:38 +02:00
testn
0362d3a430
KEYCLOAK-15113: Move away from deprecated Promise.success()/error()
2020-09-01 14:26:44 -04:00
mhajas
bdccfef513
KEYCLOAK-14973 Create GroupStorageManager
2020-09-01 10:21:39 +02:00
Martin Bartos
9c847ab176
[KEYCLOAK-14432] Unhandled NPE in identity broker auth response
2020-08-31 14:14:42 +02:00
Martin Kanis
d59a74c364
KEYCLOAK-15102 Complement methods for accessing groups with Stream variants
2020-08-28 20:56:10 +02:00
Thomas Darimont
df94cefbc1
KEYCLOAK-12729 Revise password policy not-email tests
...
- Added missing cleanup to RegisterTest
- Revised test-setup for AccountFormServiceTest
2020-08-21 14:55:07 +02:00
Thomas Darimont
0f967b7acb
KEYCLOAK-12729 Add password policy not-email
...
Added test cases and initial translations
2020-08-21 14:55:07 +02:00
mposolda
bd48d7914d
KEYCLOAK-15139 Backwards compatibility for LDAP Read-only mode with IMPORT_USERS enabled
2020-08-20 14:05:21 +02:00
Hynek Mlnarik
6231b7c904
KEYCLOAK-15207 Fix map storage test failures
2020-08-20 07:53:54 +02:00
Pedro Igor
cb57c58b4b
[KEYCLOAK-14730] - Consent not working when using federation storage and client is displayed on consent screen
2020-08-19 10:08:21 +02:00
mhajas
ae39760a62
KEYCLOAK-14972 Add independent GroupProvider interface
2020-08-13 21:13:12 +02:00
Benjamin Weimer
fdcfa6e13e
KEYCLOAK-15156 backchannel logout offline session handling
2020-08-13 08:09:59 -03:00
David Hellwig
ddc2c25951
KEYCLOAK-2940 - draft - Backchannel Logout ( #7272 )
...
* KEYCLOAK-2940 Backchannel Logout
Co-authored-by: Benjamin Weimer <external.Benjamin.Weimer@bosch-si.com>
Co-authored-by: David Hellwig <hed4be@bosch.com>
2020-08-12 09:07:58 -03:00
Sebastian Paetzold
4ff34c1be9
KEYCLOAK-14890 Improve null handling in case of missing NameId
2020-08-06 10:45:22 -03:00
vmuzikar
b68d06f91c
KEYCLOAK-13127 Update Account Console to Account REST API v1
2020-08-04 18:43:23 -03:00
vramik
6b00633c47
KEYCLOAK-14812 Create RoleStorageManager
2020-07-31 15:11:25 -03:00
vramik
bfa21c912c
KEYCLOAK-14811 Create RoleProvider and make it independent of ClientProvider and RealmProvider
2020-07-31 15:11:25 -03:00
rmartinc
32bf50e037
KEYCLOAK-14336: LDAP group membership is not visible under "Users in Role" tab for users imported from LDAP
2020-07-30 16:19:22 +02:00
Dillon Sellars
25bb2e3ba2
KEYCLOAK-14529 Signed and Encrypted ID Token Support : RSA-OAEP-256 Key Management Algorithm
2020-07-30 15:20:51 +02:00
vramik
7f979ffbcf
KEYCLOAK-14889 Create test for clientStorageProviderTimeout
2020-07-30 08:42:51 -03:00
Yoshiyuki Tabata
cd76ed0d74
KEYCLOAK-14289 OAuth Authorization Server Metadata for Token Revocation
2020-07-29 11:41:56 +02:00
Martin Idel
97400827d2
KEYCLOAK-14870: Fix bug where user is incorrectly imported
...
Bug: SerializedBrokeredIdentityContext was changed to mirror
UserModel changes. However, when creating the user in LDAP,
the username must be provided first (everything else can
be handled via attributes).
2020-07-29 11:33:41 +02:00
Takashi Norimatsu
0191f91850
KEYCLOAK-14380 Support Requesting Claims using the claims Request Parameter
2020-07-29 09:53:28 +02:00
mposolda
c4fca5895f
KEYCLOAK-14892 NullPointerException when group mappings for LDAP users are accessed
2020-07-28 14:45:06 +02:00
Martin Idel
330a3d8ff5
KEYCLOAK-14904 Fix AccountRestService
...
- custom attributes in UserModel are removed during update
- this can break caching (doesn't break if user is written
to database)
- also ensure that we don't accidentally change username
and/or firstName/lastName through attributes
2020-07-28 10:03:14 +02:00
Martin Idel
bf411d7567
KEYCLOAK-14869: Fix nullpointer exception in FullNameLDAPStorageMapper
...
Setting an attribute should be possible with a list
containing no elements or a null list
This can happen e.g. when creating users via idps
using a UserAttributeStatementMapper.
Fix this unprotected access in other classes too
2020-07-28 09:54:37 +02:00
Lorent Lempereur
e82fe7d9e3
KEYCLOAK-13950 SAML2 Identity Provider - Send Subject in SAML requests
2020-07-24 21:41:57 +02:00
mhajas
74988a3f21
KEYCLOAK-14826 Fix non-ssl auth-server tests failures
2020-07-23 14:20:19 +02:00
keycloak-bot
afff0a5109
Set version to 12.0.0-SNAPSHOT
2020-07-22 14:36:15 +02:00
Hynek Mlnarik
8fae2997c9
KEYCLOAK-14553 Improve logging
2020-07-22 00:08:15 +02:00
Hynek Mlnarik
c566b46e8f
KEYCLOAK-14549 Make ClientProvider independent of RealmProvider
...
Co-Authored-By: vramik <vramik@redhat.com>
2020-07-22 00:08:15 +02:00
Hynek Mlnarik
ac0011ab6f
KEYCLOAK-14553 Client map store
...
Co-Authored-By: vramik <vramik@redhat.com>
2020-07-22 00:08:15 +02:00
Martin Kanis
c5d5423cd3
KEYCLOAK-12265 Move KerberosEmbeddedServer to testsuite
2020-07-21 18:27:09 +02:00
vmuzikar
316f9f46e2
KEYCLOAK-14825 Make adapter tests running with FF to test cookies
2020-07-21 10:25:19 -03:00
Luca Leonardo Scorcia
9204402514
KEYCLOAK-14820 Import the NameIDPolicyFormat attribute from SAML IDP metadata descriptors
2020-07-21 12:23:25 +02:00
Takashi Norimatsu
e0fbfa722e
KEYCLOAK-14189 Client Policy : Basics
2020-07-21 07:50:08 +02:00
Douglas Palmer
6d5495141d
[KEYCLOAK-14611] Incorrect error message shown on duplicated email registration
2020-07-20 18:17:54 -03:00
Jan Lieskovsky
969b09f530
[KEYCLOAK-13692] Upgrade to Wildfly "20.0.1.Final" and Infinispan "10.1.8.Final"
...
Co-authored-by: Jan Lieskovsky <jlieskov@redhat.com>
Co-authored-by: Marek Posolda <mposolda@redhat.com>
2020-07-20 22:15:08 +02:00
Luca Leonardo Scorcia
46bf139cb4
KEYCLOAK-14741 Minor SAML specs compliance improvements
2020-07-20 21:08:12 +02:00
mhajas
93149d6b47
KEYCLOAK-14234 Adjust Adapter testsuite to work with app/auth.server.host including TLS configured
2020-07-20 11:22:16 +02:00
Thomas Vitale
4cd5ace800
KEYCLOAK-9321 Remove invalid token_introspection_endpoint
...
The discovery document is advertizing both token_introspection_endpoint
and introspection_endpoint. The former has been removed as it is not
defined by OAuth2/OIDC.
2020-07-17 11:41:28 +02:00
Erik Jan de Wit
ace64c1f0c
KEYCLOAK-12249 added test to test that time is localized
2020-07-15 14:57:38 -04:00
Pedro Igor
582046bbfe
[KEYCLOAK-13141] - Fixing filter
2020-07-15 11:00:55 -03:00
Luca Leonardo Scorcia
f8a4f66d6c
KEYCLOAK-13698 - SAML Client - Add certificate info to signature
...
Adds the X509Data tag to the XML Document signature in AuthnRequests
2020-07-10 23:06:37 +02:00
vmuzikar
7087c081f0
KEYCLOAK-14023 Instagram User Endpoint change
...
Co-authored-by: Jean-Baptiste PIN <jibet.pin@gmail.com>
2020-07-10 17:36:51 -03:00
Pedro Igor
1db1deb066
[KEYCLOAK-13141] - Supporting re-augmentation
2020-07-10 11:04:46 -03:00
Pavel Drozd
48e4432e9d
KEYCLOAK-14508 - Exclude SessionNotOnOrAfterTest from remote tests
2020-07-10 14:22:11 +02:00
Luca Leonardo Scorcia
d6934c64fd
Refactor SAML metadata generation to use the SAMLMetadataWriter class
2020-07-09 09:39:35 +02:00
Pedro Igor
9c4da9b3ce
[KEYCLOAK-14147] - Request filter refactoring
...
Co-authored-by: Stian Thorgersen <stian@redhat.com>
Co-authored-by: Martin Kanis <mkanis@redhat.com>
2020-07-07 11:26:12 -03:00
kurisumakise2011
738f24aa38
[KEYCLOAK-14570] Resolve nullpointer issue in controller
...
Some ProviderFactory returns null as properties instead of
Collections.emptyList() and it leads to NPE.
Fix it with using Optional.ofNullable(...).orElse(Collections.emptyList())
2020-07-07 07:46:26 +02:00
Douglas Palmer
9369c7cf4d
Add filter by name to applications endpoint
2020-07-03 15:35:38 -03:00
Martin Idel
8fe25948f7
KEYCLOAK-13959 Add AdvancedAttribute mapper for SAML to allow regexes
2020-07-03 18:19:35 +02:00
Plamen Kostov
914b226d11
[KEYCLOAK-14282] Create additional filtering for GET /users endpoint for enabled/disabled users
2020-07-03 09:07:42 -03:00
Axel Messinese
f30395d535
KEYCLOAK-12687 Add briefRepresentation queryParams to get roles 'composite' endpoints
2020-07-03 09:41:53 +02:00
Bartosz Siemieńczuk
e2040f5d13
KEYCLOAK-14006 Allow administrator to add additional fields to be fetched with Facebook profile request
2020-07-01 18:27:04 -03:00
Eric Rodrigues Pires
de9a0a0a4a
[KEYCLOAK-13044] Fix owner name representations of UMA tickets for client-owned resources
2020-07-01 18:15:22 -03:00
vmuzikar
dc6f7d0547
KEYCLOAK-14635 Saml tests are failing with invalid redirect urls
2020-07-01 13:46:43 +02:00
vmuzikar
001fe9eb11
KEYCLOAK-13206 Session Status iframe cannot access cookies when 3rd party cookies are blocked
...
Co-authored-by: mhajas <mhajas@redhat.com>
2020-06-30 17:11:20 -03:00
Douglas Palmer
5e44bb781b
[KEYCLOAK-14344] Cannot revoke offline access for an app if the app doesn't require consent
2020-06-26 14:56:08 -04:00
Martin Idel
05b6ef8327
KEYCLOAK-14536 Migrate UserModel fields to attributes
...
- In order to make lastName/firstName/email/username field
configurable in profile
we need to store it as an attribute
- Keep database as is for now (no impact on performance, schema)
- Keep field names and getters and setters (no impact on FTL files)
Fix tests with logic changes
- PolicyEvaluationTest: We need to take new user attributes into account
- UserTest: We need to take into account new user attributes
Potential impact on users:
- When subclassing UserModel, consistency issues may occur since one can
now set e.g. username via setSingleAttribute also
- When using PolicyEvaluations, the number of attributes has changed
2020-06-25 14:50:57 +02:00
Pedro Igor
337a751aaa
[KEYCLOAK-11330] - Clustering tests for GA
2020-06-24 17:23:45 +02:00
Douglas Palmer
1434f14663
[KEYCLOAK-14346] Base URL for applications is broken
2020-06-23 15:26:07 -03:00
vramik
1b988cc12e
KEYCLOAK-14516 app-server-eap6 tests fails due to compilation error
2020-06-22 13:43:11 +02:00
Hiroyuki Wada
f73b51818b
KEYCLOAK-14113 Support for exchanging to SAML 2.0 token
2020-06-19 22:08:42 +02:00
Dirk Weinhardt
08dca9e89f
KEYCLOAK-13205 Apply locale resolution strategy to admin console.
2020-06-19 10:27:13 -04:00
Peter Skopek
5f78a09db1
KEYCLOAK-13029 kcadm composite role creation fails
2020-06-18 16:37:02 +02:00
vmuzikar
662f7fbccd
KEYCLOAK-14497 Compilation error in UsernameTemplateMapperTest
2020-06-18 09:15:07 -03:00
Martin Bartos
ec9bf6206e
[KEYCLOAK-13202] Reset password redirects to account client
2020-06-18 13:08:36 +02:00
Erik Jan de Wit
c20766f2d7
KEYCLOAK-14140 added more test cases
...
Co-authored-by: vmuzikar <vmuzikar@redhat.com>
2020-06-17 13:56:11 -04:00
Thomas Darimont
92ab9c08ae
KEYCLOAK-8100 Expose sub claim in OIDC IdentityBroker Mappers
...
We now expose the claims "sub" for use in Identity Broker mappers.
Previously claims directly mapped to `JsonWebToken` fields were not
accessible for mappings.
2020-06-17 12:56:08 -03:00
Pedro Igor
d331091c5e
[KEYCLOAK-11330] - Quarkus tests
2020-06-17 17:20:55 +02:00
vmuzikar
d71e81ed5e
KEYCLOAK-14235 Support for running broker tests with different hostnames for auth server and IdP
2020-06-17 14:13:00 +02:00
Pedro Igor
a8bad5b9bb
[KEYCLOAK-11330] - Quarkus clustering tests
2020-06-16 10:07:24 -03:00
vramik
c403aa49f7
KEYCLOAK-14087 migration from 9.0.3
2020-06-15 14:47:13 +02:00
mhajas
5d1d75db40
KEYCLOAK-14103 Add Warn message for possibly missing SameSite configuration
2020-06-15 14:45:57 +02:00
Jan Lieskovsky
df7d85b38d
[KEYCLOAK-14358] Enable StartTLS LDAP tests
...
Thanks to KEYCLOAK-14343 Use Truststore SPI StartTLS bug fix
they will work with Truststore SPI used by auth server Wildfly too
Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
2020-06-11 18:07:53 +02:00
Tero Saarni
3c82f523ff
[KEYCLOAK-14343] Truststore SPI support for LDAP with StartTLS
...
Signed-off-by: Tero Saarni <tero.saarni@est.tech>
Co-authored-by: Jan Lieskovsky <jlieskov@redhat.com>
2020-06-11 18:07:53 +02:00
Pedro Igor
e16f30d31f
[KEYCLOAK-2343] - Allow exact user search by user attributes
...
Co-authored-by: Hynek Mlnařík <hmlnarik@users.noreply.github.com>
2020-06-10 12:02:50 -03:00
vramik
d63b3ceca4
KEYCLOAK-14141 0 downtime upgrade test
2020-06-10 12:45:34 +02:00
Pedro Igor
6ccde288a3
[KEYCLOAK-11330] - SSL Support
2020-06-09 08:43:52 +02:00
vmuzikar
b192ac4ea7
KEYCLOAK-14233 Support for generating SSL keystore before running testsuite
...
Move profile for app server to base
2020-06-08 10:51:54 -03:00
Douglas Palmer
33863ba161
KEYCLOAK-10162 Usage of ObjectInputStream without checking the object types
...
Co-authored-by: mposolda <mposolda@gmail.com>
2020-06-08 13:12:08 +02:00
Yoshiyuki Tabata
f03ee2ec98
KEYCLOAK-14145 OIDC support for Client "offline" session lifespan
2020-06-04 14:24:52 +02:00
Denis
8d6f8d0465
EYCLOAK-12741 Add name and description edit functionality to Authentication and Execution Flows
2020-06-04 08:08:52 +02:00
Alfredo Boullosa
2ddfc94495
KEYCLOAK-14115 Add a refresh to avoid failure
2020-06-03 20:13:08 -04:00
Pedro Igor
357982adf6
[KEYCLOAK-11330] - Initial changes to get testsuite working for Quarkus
2020-06-03 09:57:24 -03:00
Jan Lieskovsky
a121f77ea4
[KEYCLOAK-12305] [Testsuite] Check LDAP federated user (in)valid
...
login(s) using various authentication methods, bind credential
types, and connection encryption mechanisms
The tests cover various possible combinations of the following:
* Authentication method: Anonymous or Simple (default),
* Bind credential: Secret (default) or Vault,
* Connection encryption: Plaintext (default), SSL, or startTLS
Also, ignore the StartTLS LDAP tests for now till KEYCLOAK-14343
& KEYCLOAK-14354 are corrected (due these issues they aren't
working with auth server Wildfly). They will be re-enabled later
via KEYCLOAK-14358 once possible
Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
2020-06-02 14:44:17 +02:00
Pedro Igor
e8dc10b4a1
[KEYCLOAK-11330] - Properly handling POST formdata and UriInfo
2020-06-02 09:36:40 +02:00
stianst
90b29b0e31
KEYCLOAK-14107 Admin page content blocked on v10.0.0 due to content security policy
2020-05-29 13:57:38 +02:00
Benjamin Weimer
4265fdcab2
KEYCLOAK-14318 Client Empty Root URL and relative Base URL is valid
2020-05-29 11:21:28 +02:00
vmuzikar
f8dce7fc3e
KEYCLOAK-13819 SAML brokering with POST binding is broken by new SameSite policies
2020-05-28 13:37:56 +02:00
Thomas Darimont
e825ec24cb
KEYCLOAK-9635 Add AccessTokenHash to IDToken for OIDC Auth Code flow
...
Revised tests
2020-05-27 07:34:05 +02:00
Thomas Darimont
5a337d0376
KEYCLOAK-9635 Add AccessTokenHash to IDToken for OIDC Auth Code flow
...
Added missing test
2020-05-27 07:34:05 +02:00
Torsten Juergeleit
6005503a3d
Namespace support to group-ldap-mapper
...
Previously, Keycloak did only support syncing groups from LDAP federation provider as top-level KC groups.
This approach has some limitations:
- If using multiple group mappers then there’s no way to isolate the KC groups synched by each group mapper.
- If the option "Drop non-existing groups during sync” is activated then all KC groups (including the manually created ones) are deleted.
- There’s no way to inherit roles from a parent KC group.
This patch introduces support to specify a prefix for the resulting group path, which effectively serves as a namespace for a group.
A path prefix can be specified via the newly introduced `Groups Path` config option on the mapper. This groups path defaults to `/` for top-level groups.
This also enables to have multiple `group-ldap-mapper`'s which can manage groups within their own namespace.
An `group-ldap-mapper` with a `Group Path` configured as `/Applications/App1` will only manage groups under that path. Other groups, either manually created or managed by other `group-ldap-mapper` are not affected.
2020-05-26 17:37:29 +02:00
Hynek Mlnarik
7deb89caab
KEYCLOAK-10729 Do not serialize SAML signature
2020-05-25 15:38:17 +02:00
vmuzikar
e873c70374
KEYCLOAK-14236 Support for custom Firefox preferences
2020-05-22 09:24:41 -03:00
cachescrubber
3382682115
KEYCLOAK-10927 - Implement LDAPv3 Password Modify Extended Operation … ( #6962 )
...
* KEYCLOAK-10927 - Implement LDAPv3 Password Modify Extended Operation (RFC-3062).
* KEYCLOAK-10927 - Introduce getLDAPSupportedExtensions(). Use result instead of configuration.
Co-authored-by: Lars Uffmann <lars.uffmann@vitroconnect.de>
Co-authored-by: Kevin Kappen <kevin.kappen@vitroconnect.de>
Co-authored-by: mposolda <mposolda@gmail.com>
2020-05-20 21:04:45 +02:00
Denis
8c7b69fc9e
KEYCLOAK-13748 Create automated test for scenario with alternative subflow for credential reset
2020-05-20 14:06:53 +02:00
Stan Silvert
13d0491ff3
KEYCLOAK-14038: Re-allow special characters for Roles only
2020-05-20 07:53:23 -04:00
Takashi Norimatsu
c057b994e7
KEYCLOAK-13104 Signed and Encrypted ID Token Support : AES 192bit and 256bit key support
2020-05-20 09:01:59 +02:00
mhajas
4b8c7dd7d7
KEYCLOAK-14048 Allow clock skew when testing refresh token actual expiration time
2020-05-20 08:12:54 +02:00
Takashi Norimatsu
be0ba79daa
KEYCLOAK-7997 Implement Client Registration Metadata based on Mutual TLS
2020-05-19 17:00:41 +02:00
mposolda
12d965abf3
KEYCLOAK-13047 LDAP no-import fixes. Avoid lost updates - dont allow update attributes, which are not mapped to LDAP
2020-05-19 16:58:25 +02:00
Martin Kanis
6f43b58ccf
KEYCLOAK-14074 filterIdentityProviders compares providerId instead of alias
2020-05-19 09:46:21 +02:00
Thomas Darimont
6211fa90e0
KEYCLOAK-10932 Honor given_name and family_name in OIDC brokering
...
Previously firstname and lastname were derived from the name claim.
We now use direct mappings to extract firstname and lastname from
given_name and family_name claims.
Added test to KcOidcFirstBrokerLoginTest
Marked org.keycloak.broker.provider.BrokeredIdentityContext#setName
as deprecated to avoid breaking existing integrations.
2020-05-19 09:10:43 +02:00
Álvaro Gómez Giménez
666832d1be
KEYCLOAK-13066 Include resourceType in ScopePermissionRepresentation
2020-05-12 17:11:35 -03:00
Sven-Torben Janus
82d3251ab4
Remove *-imports
2020-05-12 20:50:18 +02:00
Sven-Torben Janus
fcb0e450a0
KEYCLOAK-13817 Return local user from LDAPStorageProvider
2020-05-12 20:50:18 +02:00
Yoshiyuki Tabata
f7d00fc2e9
KEYCLOAK-13844 "exp" claim should not be "0" when using offline token
2020-05-12 16:14:37 +02:00
stianst
49db2c13a5
KEYCLOAK-8141 Fix issue where attribute values are duplicated if updates to user are done in parallell
2020-05-12 09:06:44 +02:00
Pedro Igor
44c49d69a7
[KEYCLOAK-13071] - AuthorizationTokenService swallows Exceptions thrown by KeycloakIdentity
2020-05-08 09:21:37 +02:00
Takashi Norimatsu
3716bd96ad
KEYCLOAK-14093 Specify Signature Algorithm in Signed JWT with Client Secret
2020-05-07 11:28:39 +02:00
Takashi Norimatsu
0d0617d44a
KEYCLOAK-13720 Specify Signature Algorithm in Signed JWT Client Authentication
2020-05-05 17:43:00 +02:00
rmartinc
f0852fd362
KEYCLOAK-13823: "Dir" Full export/import: On import, service account roles and authorization info are not imported
2020-05-05 17:05:56 +02:00
Vanrar68
85feda3beb
KEYCLOAK-13998 ConditionalRoleAuthenticator doesn't work with composite roles
2020-05-05 08:39:04 +02:00
Martin Bartos
7ebdca48d3
[KEYCLOAK-13572] Doesn't observe After events due to assume check
2020-05-04 17:31:44 +02:00
Michael Riedmann
66c7ec6b08
[KEYCLOAK-13995] added test for clientUpdate with ProtocolMappers
2020-05-04 17:13:57 +02:00
Erik Jan de Wit
435815249b
KEYCLOAK-12783 changed to base account url for new console
2020-05-04 07:16:15 -04:00
Hynek Mlnarik
32f13016fa
KEYCLOAK-12874 Align Destination field existence check with spec
2020-05-04 09:19:44 +02:00
Martin Kanis
aa309b96a8
KEYCLOAK-13682 NPE when refreshing token after enabling consent
2020-04-30 08:46:21 +02:00
keycloak-bot
ae20b7d3cd
Set version to 11.0.0-SNAPSHOT
2020-04-29 12:57:55 +02:00
Yoshiyuki Tabata
874642fe9e
KEYCLOAK-12406 Add "Client Session Max" and "Client Session Idle" for OIDC
2020-04-28 15:34:25 +02:00
stianst
5b017e930d
KEYCLOAK-13128 Security Headers SPI and response filter
2020-04-28 15:28:24 +02:00
Yoshiyuki Tabata
b40c12c712
KEYCLOAK-5325 Provide OAuth token revocation capability
2020-04-28 15:25:22 +02:00
Erik Jan de Wit
ab2d1546b4
fix merge errors
2020-04-27 09:09:31 -04:00
Erik Jan de Wit
7580be8708
KEYCLOAK-13121 added the basic functionality
2020-04-27 09:09:31 -04:00
Stefan Guilhen
da1138a8d2
[KEYCLOAK-13005] Make sure the master URL is used if the consumer POST or REDIRECT URL is an empty string
...
- Fixes issue where admin console sets an empty string when the consumer POST or REDIRECT URL is deleted
2020-04-27 14:25:03 +02:00
Pedro Igor
44b489b571
[KEYCLOAK-13656] - Deny request if requested scope is not associated to resource or any typed resources
2020-04-27 08:39:38 +02:00
Pedro Igor
dacbe22d53
[KEYCLOAK-9896] - Authorization Scope modified improperly when updating Resource
2020-04-27 08:38:55 +02:00
Martin Idel
7e8018c7ca
KEYCLOAK-11862 Add Sync mode option
...
- Store in config map in database and model
- Expose the field in the OIDC-IDP
- Write logic for import, force and legacy mode
- Show how mappers can be updated keeping correct legacy mode
- Show how mappers that work correctly don't have to be modified
- Log an error if sync mode is not supported
Fix updateBrokeredUser method for all mappers
- Allow updating of username (UsernameTemplateMapper)
- Delete UserAttributeStatementMapper: mapper isn't even registered
Was actually rejected but never cleaned up: https://github.com/keycloak/keycloak/pull/4513
The mapper won't work as specified and it's not easy to tests here
- Fixup json mapper
- Fix ExternalKeycloakRoleToRoleMapper:
Bug: delete cannot work - just delete it. Don't fix it in legacy mode
Rework mapper tests
- Fix old tests for Identity Broker:
Old tests did not work at all:
They tested that if you take a realm and assign the role,
this role is then assigned to the user in that realm,
which has nothing to do with identity brokering
Simplify logic in OidcClaimToRoleMapperTests
- Add SyncMode tests to most mappers
Added tests for UsernameTemplateMapper
Added tests to all RoleMappers
Add test for json attribute mapper (Github as example)
- Extract common test setup(s)
- Extend admin console tests for sync mode
Signed-off-by: Martin Idel <external.Martin.Idel@bosch.io>
2020-04-24 15:54:32 +02:00