7748 Commits

Author SHA1 Message Date
Alexander Schwartz
a6bf194487
Remove usage of kcSanitize() to avoid printing HTML (#44755)
Closes #44753


Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-05 10:45:32 +01:00
Ruchika Jha
60b369c622
Validate client session timeout and lifetime settings on realm settings edit
Closes #44910

Signed-off-by: Ruchika <Ruchika.Jha1@ibm.com>
Signed-off-by: Ryan Emerson <remerson@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Ryan Emerson <remerson@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-05 08:50:56 +00:00
Robin Meese
0d0d468f27
Add ability to delete offline sessions via account console
Closes #15502

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
2026-01-05 08:26:47 +01:00
Robin Meese
35ee49b5d4
Add logout event to UserSessionLimitsAuthenticator
Closes #44843

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-01-01 13:22:54 +00:00
Ricardo Noriega
ac557234a2
Fix typos in documentation (#45101)
Signed-off-by: Ricardo Noriega De Soto <rnoriega@redhat.com>
2026-01-01 12:13:52 +00:00
Robin Meese
0957572751
Add logout event to SessionResource
Closes #44842

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
2025-12-29 12:25:45 +00:00
Pedro Ruivo
04c0c874f9
Fix testsuite after migration to new testsuite (#45045)
Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2025-12-19 16:56:12 +01:00
Stian Thorgersen
78274ccc5d
Migrate parts of model package to new test framework (#45024)
Part of #44983

Signed-off-by: stianst <stianst@gmail.com>
2025-12-19 14:52:23 +01:00
Stephan Seifermann
aefecade5c
Client cert lookup provider compliant to RFC 9440 (#36161)
* Client cert lookup provider compliant to RFC 9440 (#20761)

Signed-off-by: Stephan Seifermann <seiferma@users.noreply.github.com>

* Release notes

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>

---------

Signed-off-by: Stephan Seifermann <seiferma@users.noreply.github.com>
Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Co-authored-by: Stephan Seifermann <seiferma@users.noreply.github.com>
Co-authored-by: Václav Muzikář <vmuzikar@redhat.com>
2025-12-19 12:38:54 +01:00
Vlasta Ramik
dc6f23146d
Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled (#45014)
Closes #43637

Signed-off-by: vramik <vramik@redhat.com>
2025-12-19 09:10:12 +00:00
rmartinc
7be37f1e0d Add webauthn for organization authenticator when org is selected
Closes #44735

Signed-off-by: rmartinc <rmartinc@redhat.com>
2025-12-19 08:45:10 +01:00
Martin Kanis
5b437f0a27
Cannot run arquillian testsuite with quarkus-embedded due to dependency conflict (#44991)
Closes #44990

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2025-12-18 16:17:34 +00:00
Stian Thorgersen
47c1afde5a
Migrate parts of model package to new test framework (#44988)
Part of #44983

Signed-off-by: stianst <stianst@gmail.com>
2025-12-18 16:48:58 +01:00
mposolda
ff1274c07a Mandatory claims are not enforced for OID4VCI
closes #44796

Signed-off-by: mposolda <mposolda@gmail.com>
2025-12-18 16:04:13 +01:00
forkimenjeckayang
f5a3086027
Use correct parameter for the getCredentialOfferPreflight method (#44931)
Closes #44742

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-17 18:41:57 +01:00
Pascal Knüppel
b2778a6792
[OID4VCI] Add mapper for mapping unmanaged attributes (#44828)
closes #44780


Signed-off-by: Pascal Knüppel <pascal.knueppel@governikus.de>
2025-12-17 18:39:00 +01:00
Lukas Hanusovsky
92849ef5d3
Move AdminClientTest to the new testsuite (#44705)
* Moving files to the new test suite

Signed-off-by: Simon Vacek <simonvacky@email.cz>

* Move AdminClientTest to the new testsuite

Part of: #35040

Signed-off-by: Simon Vacek <simonvacky@email.cz>
Co-authored: Lukas Hanusovsky <lhanusov@redhat.com>

* Refactoring of ManagedCertificates

* Fix compatiblity issue with ManagedCertificates dependency

Signed-off-by: stianst <stianst@gmail.com>

* Fixing trustStrategy for SSLContext truststore.

Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>

* Fix FIPS

Signed-off-by: stianst <stianst@gmail.com>

---------

Signed-off-by: Simon Vacek <simonvacky@email.cz>
Signed-off-by: stianst <stianst@gmail.com>
Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
Co-authored-by: Simon Vacek <simonvacky@email.cz>
Co-authored-by: stianst <stianst@gmail.com>
2025-12-17 14:31:22 +00:00
forkimenjeckayang
ca617d9711
[OID4VCI]: Use Keycloak time utility for OID4VC related timestamps (#44871)
Closes: #44235


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-17 14:58:01 +01:00
Martin Kanis
012cefb654 The existence of an organization attribute called id is not validated
Closes #44522

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2025-12-17 08:05:32 -03:00
Pedro Ruivo
ba495d1ab1
Remote Infinispan should return count per client only for the current realm (#44948)
Closes #44577

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2025-12-17 07:40:49 +01:00
Vlasta Ramik
ab546c9184
Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP (#44945)
Closes #43973

Signed-off-by: vramik <vramik@redhat.com>
2025-12-16 14:58:53 -05:00
Palpable
94ee6d81fb
[OID4VCI] Realign naming of attribute configuring algorithms for credential (#44765)
Closes #44621


Signed-off-by: Vitalisn4 <ngamvitalisyuh@gmail.com>
Signed-off-by: mposolda <mposolda@gmail.com>
Signed-off-by: Ingrid Kamga <Ingrid.Kamga@adorsys.com>
Co-authored-by: Marek Posolda <mposolda@gmail.com>
Co-authored-by: Ingrid Kamga <Ingrid.Kamga@adorsys.com>
2025-12-16 14:46:17 +01:00
Awambeng Rodrick
a1bffa3ddc Add spec-compliant jwt vc issuer well-known endpoint
- expose /.well-known/jwt-vc-issuer/realms/{realm} and keep legacy route with deprecation headers
- build consumer metadata URL per draft-ietf-oauth-sd-jwt-vc-13 and add realm-path coverage
- add integration test for new path plus deprecation headers on legacy endpoint

Closes #44256

Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
Signed-off-by: Awambeng <awambengrodrick@gmail.com>
2025-12-16 13:46:06 +01:00
forkimenjeckayang
2f7045d7dd
Remove deferred credential endpoint from OID4VC metadata (#44907)
Closes #44779

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-16 12:50:12 +01:00
Lukas Hanusovsky
e8c6a7b98d
[Test Framework] Migrate initial WebAuthn setup + WebAuthnRegisterAndLoginTest. (#44016)
Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
2025-12-15 15:01:42 +01:00
Stian Thorgersen
ab9c6e36ee
Remove legacy/jakarta Undertow as we only need one, and upgrade to the latest to fix CVEs (#44901)
Closes #44814

Signed-off-by: stianst <stianst@gmail.com>
2025-12-15 10:39:19 +01:00
Awambeng
af8e905774
refactor(oid4vc): remove notification ID handling and related endpoint (#44844)
Closes #44802


Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
2025-12-12 14:38:01 +01:00
Stian Thorgersen
421abedaa4
Remove log4j 1.x from Arquillian testsuite (#44827)
Closes #44555

Signed-off-by: stianst <stianst@gmail.com>
2025-12-11 11:31:11 +00:00
Stian Thorgersen
2f1628d1a9
Remove log4j 1.x from testsuite/model
Closes #44554

Signed-off-by: stianst <stianst@gmail.com>
2025-12-11 10:23:03 +01:00
Stian Thorgersen
ed69f65a9c
Remove jpa-performance
Closes #44812

Signed-off-by: stianst <stianst@gmail.com>
2025-12-10 23:16:47 +00:00
Stian Thorgersen
7eb3b693b2
Remove log4j 1.x from testsuite/utils
Closes #44557

Signed-off-by: stianst <stianst@gmail.com>
2025-12-10 20:08:03 +00:00
forkimenjeckayang
be22a4bd62
[OID4VCI] Fix OID4VC wallet interoperability issues (#44682)
closes #44736


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-10 12:08:01 +01:00
Marek Posolda
f641269ac1
CredentialRequest with credentialIdentifier does not work when creden… (#44794)
closes #44793


Signed-off-by: mposolda <mposolda@gmail.com>
2025-12-10 12:02:52 +01:00
Christian Glasmachers
921b10ee80
Login failure cache: Evict entries after the configured failure reset time
Closes #44801

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
Co-authored-by: Christian Glasmachers <Christian.Glasmachers-extern@deutschebahn.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Pedro Ruivo <pruivo@users.noreply.github.com>
2025-12-10 11:20:19 +01:00
rmartinc
43c1a169e4 Manage service accounts when updating a client using registration
Closes #44257

Signed-off-by: rmartinc <rmartinc@redhat.com>
2025-12-09 12:11:11 +01:00
mposolda
3e001a378f Credential offer endpoint has parameter user_id, but expects username
closes #44642

Signed-off-by: mposolda <mposolda@gmail.com>
2025-12-08 10:42:35 +01:00
Pascal Knüppel
46e5979b17
[OID4VCI] Handle key_attestation_required in metadata endpoint (#44471)
fixes #43801


Signed-off-by: Pascal Knüppel <pascal.knueppel@governikus.de>
Signed-off-by: Pascal Knüppel <captain.p.goldfish@gmx.de>
Signed-off-by: Captain-P-Goldfish <captain.p.goldfish@gmx.de>
Co-authored-by: Ingrid Kamga <xingridkamga@gmail.com>
2025-12-05 16:00:32 +01:00
Sebastian Schuster
b5178a2bec
Added section on recommended isolation level to db guides
Closes #44611

Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-12-05 14:48:31 +01:00
Martin Bartoš
52bf0face3
ModelTests are broken after consolidating config logic
Closes #44700

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2025-12-05 11:27:18 +00:00
forkimenjeckayang
4dd68c0316
[OID4VCI] Conformance Test Fixes (#44439)
closes #44659


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
2025-12-04 09:03:38 +01:00
Ricardo Martin
f91363d12d
Improve Public Key Management for JWTAuthorizationGrant identity provider
Closes #44243

Signed-off-by: rmartinc <rmartinc@redhat.com>
2025-12-03 11:45:34 +01:00
Pascal Knüppel
9b870d3d8a
Fix ClassCastException on mixing AddressMapper with ClaimsMapper (#44457)
closes #44455


Signed-off-by: Pascal Knüppel <pascal.knueppel@governikus.de>
Signed-off-by: Captain-P-Goldfish <captain.p.goldfish@gmx.de>
2025-12-01 14:55:44 +01:00
Giuseppe Graziano
2b4855ff97
Executor for checking claims in JWT assertions (#44537)
Closes #4443


Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
2025-12-01 11:07:42 +01:00
Pedro Igor
9abe18e86e
Manual sync not executed because of the last sync time
Closes #44552

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2025-11-28 19:45:17 +01:00
Pedro Ruivo
b35dd72392
User session deleted events for invalid sessions
Closes #44513

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2025-11-28 15:43:59 +00:00
Sebastian Łaskawiec
aa789dd023 Logout confirmation
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>
2025-11-28 14:24:32 +01:00
stianst
f6676ccd76 Migrate i18n package to new testsuite
Closes #44520

Signed-off-by: stianst <stianst@gmail.com>
2025-11-28 08:56:11 -03:00
Pedro Ruivo
3ed15e740a
Add new option to schedule user session expiration
Closes #44068

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Ryan Emerson <remerson@ibm.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Ryan Emerson <remerson@ibm.com>
2025-11-27 23:01:32 +01:00
Thomas Diesler
54bf9206b2
[OID4VCI] Credential Offer must be created by Issuer not Holder (#44255)
closes #44116


Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
2025-11-27 16:07:10 +01:00
Alexander Schwartz
39d1fa2825
Escape passkeys descriptions and labels depending on the context
Closes #44387

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-11-27 11:16:21 +01:00