mirror of
https://github.com/keycloak/keycloak.git
synced 2026-01-09 23:12:06 -03:30
987ce19b45
Ensures that the client_id and client_secret are URL-encoded before being Base64-encoded for the Basic Auth header, following RFC 6749. This fixes authentication failures when the client_id contains special characters. Closes #26374 Closes #43022 Signed-off-by: rpjicond <ronaldopaulino32@hotmail.com> Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com> Co-authored-by: rpjicond <ronaldopaulino32@hotmail.com> Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com> Co-authored-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>
42 lines
2.0 KiB
Plaintext
42 lines
2.0 KiB
Plaintext
// ------------------------ Breaking changes ------------------------ //
|
|
== Breaking changes
|
|
|
|
// ------------------------ Notable changes ------------------------ //
|
|
== Notable changes
|
|
|
|
Notable changes may include internal behavior changes that prevent common misconfigurations, bugs that are fixed, or changes to simplify running {project_name}.
|
|
|
|
=== `log-console-color` will automatically enable if supported by the terminal
|
|
|
|
The `log-console-color` previously defaulted to `false`, but it will now instead check if the terminal supports color.
|
|
|
|
You may still explicitly disable color support by setting the option to `false`.
|
|
|
|
=== User sessions created with "Remember Me" are no longer valid if "Remember Me" is disabled for the realm
|
|
|
|
When the "Remember Me" option is disabled in the realm settings, all user sessions previously created with the "Remember Me" flag are now considered invalid.
|
|
Users will be required to log in again, and any associated refresh tokens will no longer be usable.
|
|
User sessions created without selecting "Remember Me" are not affected.
|
|
|
|
=== Correct encoding for OpenID Connect client credentials when acting as a broker
|
|
|
|
In a scenario where {project_name} acts as a broker and connects via OpenID Connect to another identity provider, it now sends the client credentials via basic authentication in the correct encoding as specified in RFC6749.
|
|
|
|
This prevents problems with client IDs or passwords that contain, for example, a colon or a percentage sign.
|
|
|
|
To revert to the old behavior, change the client authentication to *Client secret sent as HTTP Basic authentication without URL encoding (deprecated)* (`client_secret_basic_unencoded`).
|
|
|
|
|
|
// ------------------------ Deprecated features ------------------------ //
|
|
== Deprecated features
|
|
|
|
The following sections provide details on deprecated features.
|
|
|
|
// ------------------------ Removed features ------------------------ //
|
|
== Removed features
|
|
|
|
The following features have been removed from this release.
|
|
|
|
=== <TODO>
|
|
|