7752 Commits

Author SHA1 Message Date
Martin Kanis
a9a89005fa Can not get through SSO login if using a custom attribute with default value
Closes #44785

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2026-01-07 09:41:40 -03:00
forkimenjeckayang
c76676ebef
[OID4VCI] Make sure events are properly used in OID4VCI endpoints (#44946)
Closes: #44679


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2026-01-07 11:06:45 +01:00
Pedro Ruivo
695ee725a5
Admin UI: slow response time listing second user page
Fixes #44860

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-07 10:53:14 +01:00
Rathan Naik
2af7c843af Fix organization invitation redirect to respect account client base URL
When an organization's redirect URL is left empty, Keycloak currently defaults
to the account console URL, ignoring the account client's configured Home URL
(base URL). This fix checks the account client's base URL before falling back
to the default account console URL.

Changes:
- Added resolveAccountClientBaseUrl() helper method in OrganizationInvitationResource
- Added setBaseUrl() method to ClientAttributeUpdater test utility
- Added integration tests for the new behavior

Closes #45052

Signed-off-by: Rathan Naik <30756840+Rathan-Naik@users.noreply.github.com>
2026-01-05 08:58:27 -03:00
Alexander Schwartz
a6bf194487
Remove usage of kcSanitize() to avoid printing HTML (#44755)
Closes #44753


Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-05 10:45:32 +01:00
Ruchika Jha
60b369c622
Validate client session timeout and lifetime settings on realm settings edit
Closes #44910

Signed-off-by: Ruchika <Ruchika.Jha1@ibm.com>
Signed-off-by: Ryan Emerson <remerson@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Ryan Emerson <remerson@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-05 08:50:56 +00:00
Robin Meese
0d0d468f27
Add ability to delete offline sessions via account console
Closes #15502

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
2026-01-05 08:26:47 +01:00
Robin Meese
35ee49b5d4
Add logout event to UserSessionLimitsAuthenticator
Closes #44843

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-01 13:22:54 +00:00
Ricardo Noriega
ac557234a2
Fix typos in documentation (#45101)
Signed-off-by: Ricardo Noriega De Soto <rnoriega@redhat.com>
2026-01-01 12:13:52 +00:00
Robin Meese
0957572751
Add logout event to SessionResource
Closes #44842

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
2025-12-29 12:25:45 +00:00
Pedro Ruivo
04c0c874f9
Fix testsuite after migration to new testsuite (#45045)
Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2025-12-19 16:56:12 +01:00
Stian Thorgersen
78274ccc5d
Migrate parts of model package to new test framework (#45024)
Part of #44983

Signed-off-by: stianst <stianst@gmail.com>
2025-12-19 14:52:23 +01:00
Stephan Seifermann
aefecade5c
Client cert lookup provider compliant to RFC 9440 (#36161)
* Client cert lookup provider compliant to RFC 9440 (#20761)

Signed-off-by: Stephan Seifermann <seiferma@users.noreply.github.com>

* Release notes

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>

---------

Signed-off-by: Stephan Seifermann <seiferma@users.noreply.github.com>
Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Co-authored-by: Stephan Seifermann <seiferma@users.noreply.github.com>
Co-authored-by: Václav Muzikář <vmuzikar@redhat.com>
2025-12-19 12:38:54 +01:00
Vlasta Ramik
dc6f23146d
Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled (#45014)
Closes #43637

Signed-off-by: vramik <vramik@redhat.com>
2025-12-19 09:10:12 +00:00
rmartinc
7be37f1e0d Add webauthn for organization authenticator when org is selected
Closes #44735

Signed-off-by: rmartinc <rmartinc@redhat.com>
2025-12-19 08:45:10 +01:00
Martin Kanis
5b437f0a27
Cannot run arquillian testsuite with quarkus-embedded due to dependency conflict (#44991)
Closes #44990

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2025-12-18 16:17:34 +00:00
Stian Thorgersen
47c1afde5a
Migrate parts of model package to new test framework (#44988)
Part of #44983

Signed-off-by: stianst <stianst@gmail.com>
2025-12-18 16:48:58 +01:00
mposolda
ff1274c07a Mandatory claims are not enforced for OID4VCI
closes #44796

Signed-off-by: mposolda <mposolda@gmail.com>
2025-12-18 16:04:13 +01:00
forkimenjeckayang
f5a3086027
Use correct parameter for the getCredentialOfferPreflight method (#44931)
Closes #44742

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-17 18:41:57 +01:00
Pascal Knüppel
b2778a6792
[OID4VCI] Add mapper for mapping unmanaged attributes (#44828)
closes #44780


Signed-off-by: Pascal Knüppel <pascal.knueppel@governikus.de>
2025-12-17 18:39:00 +01:00
Lukas Hanusovsky
92849ef5d3
Move AdminClientTest to the new testsuite (#44705)
* Moving files to the new test suite

Signed-off-by: Simon Vacek <simonvacky@email.cz>

* Move AdminClientTest to the new testsuite

Part of: #35040

Signed-off-by: Simon Vacek <simonvacky@email.cz>
Co-authored: Lukas Hanusovsky <lhanusov@redhat.com>

* Refactoring of ManagedCertificates

* Fix compatiblity issue with ManagedCertificates dependency

Signed-off-by: stianst <stianst@gmail.com>

* Fixing trustStrategy for SSLContext truststore.

Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

* Fix FIPS

Signed-off-by: stianst <stianst@gmail.com>

---------

Signed-off-by: Simon Vacek <simonvacky@email.cz>
Signed-off-by: stianst <stianst@gmail.com>
Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
Co-authored-by: Simon Vacek <simonvacky@email.cz>
Co-authored-by: stianst <stianst@gmail.com>
2025-12-17 14:31:22 +00:00
forkimenjeckayang
ca617d9711
[OID4VCI]: Use Keycloak time utility for OID4VC related timestamps (#44871)
Closes: #44235


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-17 14:58:01 +01:00
Martin Kanis
012cefb654 The existence of an organization attribute called id is not validated
Closes #44522

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2025-12-17 08:05:32 -03:00
Pedro Ruivo
ba495d1ab1
Remote Infinispan should return count per client only for the current realm (#44948)
Closes #44577

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2025-12-17 07:40:49 +01:00
Vlasta Ramik
ab546c9184
Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP (#44945)
Closes #43973

Signed-off-by: vramik <vramik@redhat.com>
2025-12-16 14:58:53 -05:00
Palpable
94ee6d81fb
[OID4VCI] Realign naming of attribute configuring algorithms for credential (#44765)
Closes #44621


Signed-off-by: Vitalisn4 <ngamvitalisyuh@gmail.com>
Signed-off-by: mposolda <mposolda@gmail.com>
Signed-off-by: Ingrid Kamga <Ingrid.Kamga@adorsys.com>
Co-authored-by: Marek Posolda <mposolda@gmail.com>
Co-authored-by: Ingrid Kamga <Ingrid.Kamga@adorsys.com>
2025-12-16 14:46:17 +01:00
Awambeng Rodrick
a1bffa3ddc Add spec-compliant jwt vc issuer well-known endpoint
- expose /.well-known/jwt-vc-issuer/realms/{realm} and keep legacy route with deprecation headers
- build consumer metadata URL per draft-ietf-oauth-sd-jwt-vc-13 and add realm-path coverage
- add integration test for new path plus deprecation headers on legacy endpoint

Closes #44256

Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
Signed-off-by: Awambeng <awambengrodrick@gmail.com>
2025-12-16 13:46:06 +01:00
forkimenjeckayang
2f7045d7dd
Remove deferred credential endpoint from OID4VC metadata (#44907)
Closes #44779

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-16 12:50:12 +01:00
Lukas Hanusovsky
e8c6a7b98d
[Test Framework] Migrate initial WebAuthn setup + WebAuthnRegisterAndLoginTest. (#44016)
Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
2025-12-15 15:01:42 +01:00
Stian Thorgersen
ab9c6e36ee
Remove legacy/jakarta Undertow as we only need one, and upgrade to the latest to fix CVEs (#44901)
Closes #44814

Signed-off-by: stianst <stianst@gmail.com>
2025-12-15 10:39:19 +01:00
Awambeng
af8e905774
refactor(oid4vc): remove notification ID handling and related endpoint (#44844)
Closes #44802


Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
2025-12-12 14:38:01 +01:00
Stian Thorgersen
421abedaa4
Remove log4j 1.x from Arquillian testsuite (#44827)
Closes #44555

Signed-off-by: stianst <stianst@gmail.com>
2025-12-11 11:31:11 +00:00
Stian Thorgersen
2f1628d1a9
Remove log4j 1.x from testsuite/model
Closes #44554

Signed-off-by: stianst <stianst@gmail.com>
2025-12-11 10:23:03 +01:00
Stian Thorgersen
ed69f65a9c
Remove jpa-performance
Closes #44812

Signed-off-by: stianst <stianst@gmail.com>
2025-12-10 23:16:47 +00:00
Stian Thorgersen
7eb3b693b2
Remove log4j 1.x from testsuite/utils
Closes #44557

Signed-off-by: stianst <stianst@gmail.com>
2025-12-10 20:08:03 +00:00
forkimenjeckayang
be22a4bd62
[OID4VCI] Fix OID4VC wallet interoperability issues (#44682)
closes #44736


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-10 12:08:01 +01:00
Marek Posolda
f641269ac1
CredentialRequest with credentialIdentifier does not work when creden… (#44794)
closes #44793


Signed-off-by: mposolda <mposolda@gmail.com>
2025-12-10 12:02:52 +01:00
Christian Glasmachers
921b10ee80
Login failure cache: Evict entries after the configured failure reset time
Closes #44801

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
Co-authored-by: Christian Glasmachers <Christian.Glasmachers-extern@deutschebahn.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Pedro Ruivo <pruivo@users.noreply.github.com>
2025-12-10 11:20:19 +01:00
rmartinc
43c1a169e4 Manage service accounts when updating a client using registration
Closes #44257

Signed-off-by: rmartinc <rmartinc@redhat.com>
2025-12-09 12:11:11 +01:00
mposolda
3e001a378f Credential offer endpoint has parameter user_id, but expects username
closes #44642

Signed-off-by: mposolda <mposolda@gmail.com>
2025-12-08 10:42:35 +01:00
Pascal Knüppel
46e5979b17
[OID4VCI] Handle key_attestation_required in metadata endpoint (#44471)
fixes #43801


Signed-off-by: Pascal Knüppel <pascal.knueppel@governikus.de>
Signed-off-by: Pascal Knüppel <captain.p.goldfish@gmx.de>
Signed-off-by: Captain-P-Goldfish <captain.p.goldfish@gmx.de>
Co-authored-by: Ingrid Kamga <xingridkamga@gmail.com>
2025-12-05 16:00:32 +01:00
Sebastian Schuster
b5178a2bec
Added section on recommended isolation level to db guides
Closes #44611

Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-12-05 14:48:31 +01:00
Martin Bartoš
52bf0face3
ModelTests are broken after consolidating config logic
Closes #44700

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2025-12-05 11:27:18 +00:00
forkimenjeckayang
4dd68c0316
[OID4VCI] Conformance Test Fixes (#44439)
closes #44659


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-04 09:03:38 +01:00
Ricardo Martin
f91363d12d
Improve Public Key Management for JWTAuthorizationGrant identity provider
Closes #44243

Signed-off-by: rmartinc <rmartinc@redhat.com>
2025-12-03 11:45:34 +01:00
Pascal Knüppel
9b870d3d8a
Fix ClassCastException on mixing AddressMapper with ClaimsMapper (#44457)
closes #44455


Signed-off-by: Pascal Knüppel <pascal.knueppel@governikus.de>
Signed-off-by: Captain-P-Goldfish <captain.p.goldfish@gmx.de>
2025-12-01 14:55:44 +01:00
Giuseppe Graziano
2b4855ff97
Executor for checking claims in JWT assertions (#44537)
Closes #4443


Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
2025-12-01 11:07:42 +01:00
Pedro Igor
9abe18e86e
Manual sync not executed because of the last sync time
Closes #44552

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2025-11-28 19:45:17 +01:00
Pedro Ruivo
b35dd72392
User session deleted events for invalid sessions
Closes #44513

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2025-11-28 15:43:59 +00:00
Sebastian Łaskawiec
aa789dd023 Logout confirmation
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>
2025-11-28 14:24:32 +01:00