entry : BrowserSecurityHeaders.defaultHeaders.entrySet()) {
- String headerName = BrowserSecurityHeaders.headerAttributeMap.get(entry.getKey());
- String headerValue = response.getHeaderString(headerName);
- if (entry.getValue().isEmpty()) {
+ for (BrowserSecurityHeaders header : BrowserSecurityHeaders.values()) {
+ String headerValue = response.getHeaderString(header.getHeaderName());
+ String expectedValue = header.getDefaultValue();
+ if (expectedValue.isEmpty()) {
Assert.assertNull(headerValue);
} else {
Assert.assertNotNull(headerValue);
- Assert.assertThat(headerValue, is(equalTo(entry.getValue())));
+ Assert.assertThat(headerValue, is(equalTo(expectedValue)));
}
}
response.close();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java
index dbb4b510469d..50d643c3b012 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java
@@ -18,6 +18,7 @@
package org.keycloak.testsuite.forms;
+import org.hamcrest.Matchers;
import org.jboss.arquillian.graphene.page.Page;
import org.junit.Assert;
import org.junit.Before;
@@ -52,13 +53,17 @@
import org.keycloak.testsuite.util.MailUtils;
import org.keycloak.testsuite.util.URLUtils;
import org.keycloak.testsuite.util.UserBuilder;
+import org.openqa.selenium.By;
+import org.openqa.selenium.WebElement;
import javax.mail.internet.MimeMessage;
import java.util.Arrays;
import java.util.List;
import java.util.regex.Pattern;
+import java.util.stream.Collectors;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThat;
import static org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude.AuthServer.REMOTE;
/**
@@ -434,8 +439,8 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
pageSource = driver.getPageSource();
// Check if OTP credential with empty label was created successfully
- final String emptyOtpLabelPresentInAuthenticatorTable = "(?s)| ";
- Assert.assertTrue(Pattern.compile(emptyOtpLabelPresentInAuthenticatorTable).matcher(pageSource).find());
+ assertThat(driver.findElements(By.className("provider")).stream()
+ .map(WebElement::getText).collect(Collectors.toList()), Matchers.hasItem(""));
accountTotpPage.removeTotp();
// Logout
@@ -473,11 +478,9 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
accountTotpPage.open();
Assert.assertTrue(accountTotpPage.isCurrent());
- // Get the updated Account TOTP page source post OTP credential creation
- pageSource = driver.getPageSource();
-
// Check if OTP credential with empty label was created successfully
- Assert.assertTrue(Pattern.compile(emptyOtpLabelPresentInAuthenticatorTable).matcher(pageSource).find());
+ assertThat(driver.findElements(By.className("provider")).stream()
+ .map(WebElement::getText).collect(Collectors.toList()), Matchers.hasItem(""));;
// Logout
oauth.openLogout();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java
index 28729ecb0474..2471a1bad48a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java
@@ -18,6 +18,8 @@
import org.keycloak.testsuite.AssertEvents;
import org.keycloak.testsuite.admin.ApiUtil;
import org.keycloak.testsuite.arquillian.SuiteContext;
+import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude;
+import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude.AuthServer;
import org.keycloak.testsuite.auth.page.account.Applications;
import org.keycloak.testsuite.auth.page.login.OAuthGrant;
import org.keycloak.testsuite.auth.page.login.UpdatePassword;
@@ -47,16 +49,11 @@
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertThat;
import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude;
-import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude.AuthServer;
-
-import static org.junit.Assume.assumeFalse;
+import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST;
import static org.keycloak.testsuite.util.URLAssert.assertCurrentUrlDoesntStartWith;
import static org.keycloak.testsuite.util.URLAssert.assertCurrentUrlStartsWith;
import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST;
/**
* @author mhajas
@@ -65,6 +62,7 @@
public class JavascriptAdapterTest extends AbstractJavascriptTest {
private String testAppUrl;
+ private String testAppWithInitInHeadUrl;
protected JavascriptTestExecutor testExecutor;
private static int TIME_SKEW_TOLERANCE = 3;
@@ -90,7 +88,9 @@ protected RealmRepresentation updateRealm(RealmBuilder builder) {
@Before
public void setDefaultEnvironment() {
- testAppUrl = authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/index.html";
+ String testAppRootUrl = authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL;
+ testAppUrl = testAppRootUrl + "/index.html";
+ testAppWithInitInHeadUrl = testAppRootUrl + "/init-in-head.html";
jsDriverTestRealmLoginPage.setAuthRealm(REALM_NAME);
oAuthGrantPage.setAuthRealm(REALM_NAME);
@@ -101,10 +101,8 @@ public void setDefaultEnvironment() {
events.poll();
jsDriver.manage().deleteAllCookies();
- jsDriver.navigate().to(testAppUrl);
+ navigateToTestApp(testAppUrl);
- waitUntilElement(outputArea).is().present();
- assertCurrentUrlStartsWith(testAppUrl, jsDriver);
testExecutor = JavascriptTestExecutor.create(jsDriver, jsDriverTestRealmLoginPage);
jsDriver.manage().deleteAllCookies();
@@ -121,6 +119,14 @@ protected JSObjectBuilder defaultArguments() {
}
private void assertOnTestAppUrl(WebDriver jsDriver, Object output, WebElement events) {
+ assertOnTestAppUrl(jsDriver, output, events, testAppUrl);
+ }
+
+ private void assertOnTestAppWithInitInHeadUrl(WebDriver jsDriver, Object output, WebElement events) {
+ assertOnTestAppUrl(jsDriver, output, events, testAppWithInitInHeadUrl);
+ }
+
+ private void assertOnTestAppUrl(WebDriver jsDriver, Object output, WebElement events, String testAppUrl) {
waitForPageToLoad();
assertCurrentUrlStartsWith(testAppUrl, jsDriver);
}
@@ -748,7 +754,24 @@ public void testAIAFromJavascriptAdapterCancelled() {
});
}
+ @Test
+ // KEYCLOAK-15158
+ public void testInitInHead() {
+ navigateToTestApp(testAppWithInitInHeadUrl);
+
+ testExecutor.validateOutputField(this::assertInitNotAuth)
+ .login(this::assertOnLoginPage)
+ .loginForm(testUser, this::assertOnTestAppWithInitInHeadUrl)
+ .validateOutputField(this::assertInitAuth);
+ }
+
protected void assertAdapterIsLoggedIn(WebDriver driver1, Object output, WebElement events) {
assertTrue(testExecutor.isLoggedIn());
}
+
+ protected void navigateToTestApp(final String testAppUrl) {
+ jsDriver.navigate().to(testAppUrl);
+ waitUntilElement(outputArea).is().present();
+ assertCurrentUrlStartsWith(testAppUrl, jsDriver);
+ }
}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/BadRealmTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/BadRealmTest.java
new file mode 100644
index 000000000000..76b1f963b471
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/BadRealmTest.java
@@ -0,0 +1,42 @@
+package org.keycloak.testsuite.model;
+
+import org.junit.Test;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.services.managers.RealmManager;
+import org.keycloak.testsuite.AbstractKeycloakTest;
+import org.keycloak.testsuite.arquillian.annotation.ModelTest;
+import org.keycloak.utils.ReservedCharValidator;
+
+import java.util.List;
+
+import static org.junit.Assert.fail;
+
+public class BadRealmTest extends AbstractKeycloakTest {
+ private String name = "MyRealm";
+ private String id = "MyId";
+ private String script = "";
+
+ public void addTestRealms(List testRealms) {
+ }
+
+ @Test
+ @ModelTest
+ public void testBadRealmName(KeycloakSession session) {
+ RealmManager manager = new RealmManager(session);
+ try {
+ manager.createRealm(id, name + script);
+ fail();
+ } catch (ReservedCharValidator.ReservedCharException ex) {}
+ }
+
+ @Test
+ @ModelTest
+ public void testBadRealmId(KeycloakSession session) {
+ RealmManager manager = new RealmManager(session);
+ try {
+ manager.createRealm(id + script, name);
+ fail();
+ } catch (ReservedCharValidator.ReservedCharException ex) {}
+ }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java
index c9f7e464b63a..32a05d75c9b4 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java
@@ -130,9 +130,9 @@ public void checkIframe() throws IOException {
assertTrue(s.contains("function getCookie()"));
assertEquals("CP=\"This is not a P3P policy!\"", response.getFirstHeader("P3P").getValue());
- assertNull(response.getFirstHeader(BrowserSecurityHeaders.X_FRAME_OPTIONS));
- assertEquals("frame-src 'self'; object-src 'none';", response.getFirstHeader(BrowserSecurityHeaders.CONTENT_SECURITY_POLICY).getValue());
- assertEquals("none", response.getFirstHeader(BrowserSecurityHeaders.X_ROBOTS_TAG).getValue());
+ assertNull(response.getFirstHeader(BrowserSecurityHeaders.X_FRAME_OPTIONS.getHeaderName()));
+ assertEquals("frame-src 'self'; object-src 'none';", response.getFirstHeader(BrowserSecurityHeaders.CONTENT_SECURITY_POLICY.getHeaderName()).getValue());
+ assertEquals("none", response.getFirstHeader(BrowserSecurityHeaders.X_ROBOTS_TAG.getHeaderName()).getValue());
response.close();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/SamlXMLAttacksTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/SamlXMLAttacksTest.java
new file mode 100644
index 000000000000..a7b50a120030
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/SamlXMLAttacksTest.java
@@ -0,0 +1,67 @@
+package org.keycloak.testsuite.saml;
+
+import org.apache.http.NameValuePair;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.message.BasicNameValuePair;
+import org.junit.Test;
+import org.keycloak.saml.common.constants.GeneralConstants;
+import org.keycloak.saml.processing.web.util.PostBindingUtil;
+
+import java.io.UnsupportedEncodingException;
+import java.util.LinkedList;
+import java.util.List;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.junit.Assert.assertThat;
+import static org.keycloak.testsuite.util.Matchers.bodyHC;
+
+public class SamlXMLAttacksTest extends AbstractSamlTest {
+
+ @Test(timeout = 4000)
+ public void testXMLBombAttackResistance() throws Exception {
+
+ String bombDoctype = "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "" +
+ "]>";
+
+ String samlAuthnRequest = "" +
+ "" + SAML_CLIENT_ID_SALES_POST + "&lol9;" +
+ "";
+
+ try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
+ HttpPost post = new HttpPost(getAuthServerSamlEndpoint(REALM_NAME));
+
+ List parameters = new LinkedList<>();
+ String encoded = PostBindingUtil.base64Encode(bombDoctype + samlAuthnRequest);
+ parameters.add(new BasicNameValuePair(GeneralConstants.SAML_REQUEST_KEY, encoded));
+
+ UrlEncodedFormEntity formEntity;
+ try {
+ formEntity = new UrlEncodedFormEntity(parameters, "UTF-8");
+ } catch (UnsupportedEncodingException e) {
+ throw new RuntimeException(e);
+ }
+
+ post.setEntity(formEntity);
+
+ try (CloseableHttpResponse response = client.execute(post)) {
+ assertThat(response, bodyHC(containsString("Invalid Request")));
+ }
+ }
+ }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/DefaultHostnameTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/DefaultHostnameTest.java
index 00deb766723c..c60a0aafd4f1 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/DefaultHostnameTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/DefaultHostnameTest.java
@@ -255,7 +255,7 @@ private void assertAdminPage(String realm, String expectedFrontendUrl, String ex
assertTrue(indexPage.contains("consoleBaseUrl = '" + new URI(expectedAdminUrl).getPath() +"/admin/" + realm + "/console/'"));
assertTrue(indexPage.contains("resourceUrl = '" + new URI(expectedAdminUrl).getPath() +"/resources/"));
- String cspHeader = response.getFirstHeader(BrowserSecurityHeaders.CONTENT_SECURITY_POLICY);
+ String cspHeader = response.getFirstHeader(BrowserSecurityHeaders.CONTENT_SECURITY_POLICY.getHeaderName());
if (expectedFrontendUrl.equalsIgnoreCase(expectedAdminUrl)) {
assertEquals("frame-src 'self'; frame-ancestors 'self'; object-src 'none';", cspHeader);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/demorealm.json b/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/demorealm.json
index 6af989d114a6..5f331ea7448b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/demorealm.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/demorealm.json
@@ -151,6 +151,17 @@
"secret": "password",
"directAccessGrantsEnabled": true
},
+ {
+ "clientId": "serialization-servlet",
+ "enabled": true,
+ "adminUrl": "/serialization-servlet",
+ "baseUrl": "/serialization-servlet",
+ "redirectUris": [
+ "/serialization-servlet/*"
+ ],
+ "secret": "password",
+ "directAccessGrantsEnabled": true
+ },
{
"clientId": "customer-portal-subsystem",
"enabled": true,
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/serialization-servlet/WEB-INF/keycloak.json b/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/serialization-servlet/WEB-INF/keycloak.json
new file mode 100644
index 000000000000..d861ea9e661a
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/serialization-servlet/WEB-INF/keycloak.json
@@ -0,0 +1,10 @@
+{
+ "realm": "demo",
+ "resource": "serialization-servlet",
+ "auth-server-url": "http://localhost:8180/auth",
+ "ssl-required" : "external",
+ "expose-token": true,
+ "credentials": {
+ "secret": "password"
+ }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/serialization-servlet/WEB-INF/web.xml b/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/serialization-servlet/WEB-INF/web.xml
new file mode 100644
index 000000000000..e9b6913cf3cf
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/adapter-test/serialization-servlet/WEB-INF/web.xml
@@ -0,0 +1,76 @@
+
+
+
+
+
+ serialization-servlet
+
+
+ Servlet
+ org.keycloak.testsuite.adapter.servlet.SerializationServlet
+
+
+ Error Servlet
+ org.keycloak.testsuite.adapter.servlet.ErrorServlet
+
+
+
+ Servlet
+ /*
+
+
+
+ Error Servlet
+ /error.html
+
+
+
+
+ Users
+ /*
+
+
+ user
+
+
+
+
+ Errors
+ /error.html
+
+
+
+
+ KEYCLOAK
+ demo
+
+ /error.html
+ /error.html
+
+
+
+
+ admin
+
+
+ user
+
+
diff --git a/testsuite/integration-arquillian/tests/other/adapters/jboss/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/jboss/pom.xml
index cfed2a3b8c19..b2ebfde10141 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/jboss/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/jboss/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-jboss
diff --git a/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/eap/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/eap/pom.xml
index 788bd858dbd0..cd2450628fb8 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/eap/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/eap/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-jboss-relative
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-relative-eap
diff --git a/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/pom.xml
index a5353b02e598..75ab2c4d74b3 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-jboss
- 11.0.0-SNAPSHOT
+ 11.0.3
pom
diff --git a/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/wildfly/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/wildfly/pom.xml
index 1b9f67df4d78..17ab2795015d 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/wildfly/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/jboss/relative/wildfly/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-jboss-relative
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-relative-wildfly
diff --git a/testsuite/integration-arquillian/tests/other/adapters/jboss/remote/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/jboss/remote/pom.xml
index eb69d87b8fea..c04e8638a019 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/jboss/remote/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/jboss/remote/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-jboss
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-remote
diff --git a/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse61/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse61/pom.xml
index 9721466d3532..ff3337b97f96 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse61/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse61/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-karaf
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-fuse61
diff --git a/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse62/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse62/pom.xml
index 79b9aebb1165..3d48db225e20 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse62/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/karaf/fuse62/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-karaf
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-fuse62
diff --git a/testsuite/integration-arquillian/tests/other/adapters/karaf/karaf3/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/karaf/karaf3/pom.xml
index 4f4c9cd77485..cb275536699a 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/karaf/karaf3/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/karaf/karaf3/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-karaf
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-karaf3
diff --git a/testsuite/integration-arquillian/tests/other/adapters/karaf/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/karaf/pom.xml
index 62a19faf1982..260097307107 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/karaf/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/karaf/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-karaf
diff --git a/testsuite/integration-arquillian/tests/other/adapters/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/pom.xml
index 6d1b60acfe20..ec948f4dd70a 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-other
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters
diff --git a/testsuite/integration-arquillian/tests/other/adapters/was/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/was/pom.xml
index bba3ac2d5c6a..e3e304ec79cf 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/was/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/was/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-was
diff --git a/testsuite/integration-arquillian/tests/other/adapters/was/was8/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/was/was8/pom.xml
index fae14d32c0be..d7e09b2af14e 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/was/was8/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/was/was8/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-was
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-was8
diff --git a/testsuite/integration-arquillian/tests/other/adapters/wls/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/wls/pom.xml
index a23025811937..dbe388550c86 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/wls/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/wls/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-wls
diff --git a/testsuite/integration-arquillian/tests/other/adapters/wls/wls12/pom.xml b/testsuite/integration-arquillian/tests/other/adapters/wls/wls12/pom.xml
index ac77dd3c8c0c..b016b8373c4c 100644
--- a/testsuite/integration-arquillian/tests/other/adapters/wls/wls12/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/adapters/wls/wls12/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-adapters-wls
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-adapters-wls12
diff --git a/testsuite/integration-arquillian/tests/other/base-ui/pom.xml b/testsuite/integration-arquillian/tests/other/base-ui/pom.xml
index 252ec2012c71..83dd48e32c58 100644
--- a/testsuite/integration-arquillian/tests/other/base-ui/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/base-ui/pom.xml
@@ -22,7 +22,7 @@
integration-arquillian-tests-other
org.keycloak.testsuite
- 11.0.0-SNAPSHOT
+ 11.0.3
4.0.0
diff --git a/testsuite/integration-arquillian/tests/other/clean-start/pom.xml b/testsuite/integration-arquillian/tests/other/clean-start/pom.xml
index 9c5c0d3f8018..d11ced98a2b3 100644
--- a/testsuite/integration-arquillian/tests/other/clean-start/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/clean-start/pom.xml
@@ -23,7 +23,7 @@
org.keycloak.testsuite
integration-arquillian-tests-other
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-smoke-clean-start
diff --git a/testsuite/integration-arquillian/tests/other/console/pom.xml b/testsuite/integration-arquillian/tests/other/console/pom.xml
index 20a5f19ae634..78f4c5bc7ad6 100644
--- a/testsuite/integration-arquillian/tests/other/console/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/console/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-other
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-console
diff --git a/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml b/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml
index b1d59b288603..d93dbea81fd7 100644
--- a/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-other
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-jpa-performance
diff --git a/testsuite/integration-arquillian/tests/other/mod_auth_mellon/pom.xml b/testsuite/integration-arquillian/tests/other/mod_auth_mellon/pom.xml
index e5075565984b..0982c62ea8c7 100644
--- a/testsuite/integration-arquillian/tests/other/mod_auth_mellon/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/mod_auth_mellon/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-other
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-other-mod_auth_mellon
diff --git a/testsuite/integration-arquillian/tests/other/pom.xml b/testsuite/integration-arquillian/tests/other/pom.xml
index 356895a7718b..3b7b3b957773 100644
--- a/testsuite/integration-arquillian/tests/other/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests
- 11.0.0-SNAPSHOT
+ 11.0.3
integration-arquillian-tests-other
diff --git a/testsuite/integration-arquillian/tests/other/server-config-migration/pom.xml b/testsuite/integration-arquillian/tests/other/server-config-migration/pom.xml
index 7eb6416c47b8..1dd2842f9368 100644
--- a/testsuite/integration-arquillian/tests/other/server-config-migration/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/server-config-migration/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian-tests-other
- 11.0.0-SNAPSHOT
+ 11.0.3
../pom.xml
diff --git a/testsuite/integration-arquillian/tests/other/springboot-tests/pom.xml b/testsuite/integration-arquillian/tests/other/springboot-tests/pom.xml
index fa46afa2fe1c..30feeb87aacf 100644
--- a/testsuite/integration-arquillian/tests/other/springboot-tests/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/springboot-tests/pom.xml
@@ -5,7 +5,7 @@
integration-arquillian-tests-other
org.keycloak.testsuite
- 11.0.0-SNAPSHOT
+ 11.0.3
4.0.0
diff --git a/testsuite/integration-arquillian/tests/other/sssd/pom.xml b/testsuite/integration-arquillian/tests/other/sssd/pom.xml
index 8e6f14379f4e..cb608a92a60c 100644
--- a/testsuite/integration-arquillian/tests/other/sssd/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/sssd/pom.xml
@@ -5,7 +5,7 @@
integration-arquillian-tests-other
org.keycloak.testsuite
- 11.0.0-SNAPSHOT
+ 11.0.3
4.0.0
diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml
index 156c6789b782..d1326666ad6a 100755
--- a/testsuite/integration-arquillian/tests/pom.xml
+++ b/testsuite/integration-arquillian/tests/pom.xml
@@ -24,7 +24,7 @@
org.keycloak.testsuite
integration-arquillian
- 11.0.0-SNAPSHOT
+ 11.0.3
pom
diff --git a/testsuite/integration-arquillian/util/pom.xml b/testsuite/integration-arquillian/util/pom.xml
index 5f901c7763b4..e070aa14b0d8 100644
--- a/testsuite/integration-arquillian/util/pom.xml
+++ b/testsuite/integration-arquillian/util/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian
- 11.0.0-SNAPSHOT
+ 11.0.3
4.0.0
diff --git a/testsuite/performance/infinispan/pom.xml b/testsuite/performance/infinispan/pom.xml
index a5d72e0bf978..45a68657e6bf 100644
--- a/testsuite/performance/infinispan/pom.xml
+++ b/testsuite/performance/infinispan/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
performance
- 11.0.0-SNAPSHOT
+ 11.0.3
../pom.xml
4.0.0
diff --git a/testsuite/performance/keycloak/pom.xml b/testsuite/performance/keycloak/pom.xml
index 923483e9eebe..a056ec5a7449 100644
--- a/testsuite/performance/keycloak/pom.xml
+++ b/testsuite/performance/keycloak/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
performance
- 11.0.0-SNAPSHOT
+ 11.0.3
../pom.xml
4.0.0
diff --git a/testsuite/performance/load-balancer/wildfly-modcluster/pom.xml b/testsuite/performance/load-balancer/wildfly-modcluster/pom.xml
index bd46fb06c491..fc9c9af2f0be 100644
--- a/testsuite/performance/load-balancer/wildfly-modcluster/pom.xml
+++ b/testsuite/performance/load-balancer/wildfly-modcluster/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
performance
- 11.0.0-SNAPSHOT
+ 11.0.3
../../pom.xml
4.0.0
diff --git a/testsuite/performance/pom.xml b/testsuite/performance/pom.xml
index dec5944f3df2..68967e3ccc29 100644
--- a/testsuite/performance/pom.xml
+++ b/testsuite/performance/pom.xml
@@ -21,7 +21,7 @@
keycloak-testsuite-pom
org.keycloak
- 11.0.0-SNAPSHOT
+ 11.0.3
../pom.xml
4.0.0
diff --git a/testsuite/performance/tests/pom.xml b/testsuite/performance/tests/pom.xml
index cb6ab2d0fde0..f80c9f4952a9 100644
--- a/testsuite/performance/tests/pom.xml
+++ b/testsuite/performance/tests/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
performance
- 11.0.0-SNAPSHOT
+ 11.0.3
../pom.xml
4.0.0
diff --git a/testsuite/pom.xml b/testsuite/pom.xml
index 05a1cfacdf19..a7c4b788171a 100755
--- a/testsuite/pom.xml
+++ b/testsuite/pom.xml
@@ -21,7 +21,7 @@
keycloak-parent
org.keycloak
- 11.0.0-SNAPSHOT
+ 11.0.3
../pom.xml
4.0.0
diff --git a/testsuite/utils/pom.xml b/testsuite/utils/pom.xml
index f42f02ce9617..da8123983c66 100755
--- a/testsuite/utils/pom.xml
+++ b/testsuite/utils/pom.xml
@@ -21,7 +21,7 @@
keycloak-testsuite-pom
org.keycloak
- 11.0.0-SNAPSHOT
+ 11.0.3
4.0.0
diff --git a/themes/pom.xml b/themes/pom.xml
index 3adba182bd14..471814aa71d4 100755
--- a/themes/pom.xml
+++ b/themes/pom.xml
@@ -4,7 +4,7 @@
keycloak-parent
org.keycloak
- 11.0.0-SNAPSHOT
+ 11.0.3
4.0.0
diff --git a/themes/src/main/resources-product/theme/rh-sso/welcome/resources/favicon.ico b/themes/src/main/resources-product/theme/rh-sso/welcome/resources/favicon.ico
deleted file mode 100644
index 11c5cd26196c..000000000000
Binary files a/themes/src/main/resources-product/theme/rh-sso/welcome/resources/favicon.ico and /dev/null differ
diff --git a/themes/src/main/resources/theme/base/account/template.ftl b/themes/src/main/resources/theme/base/account/template.ftl
index b7f2be319a4b..6f08eefc5149 100644
--- a/themes/src/main/resources/theme/base/account/template.ftl
+++ b/themes/src/main/resources/theme/base/account/template.ftl
@@ -7,7 +7,7 @@
${msg("accountManagementTitle")}
-
+
<#if properties.stylesCommon?has_content>
<#list properties.stylesCommon?split(' ') as style>
diff --git a/themes/src/main/resources/theme/base/admin/index.ftl b/themes/src/main/resources/theme/base/admin/index.ftl
index 8281828adcbe..da1e6654d434 100755
--- a/themes/src/main/resources/theme/base/admin/index.ftl
+++ b/themes/src/main/resources/theme/base/admin/index.ftl
@@ -8,7 +8,7 @@
-
+
<#if properties.stylesCommon?has_content>
<#list properties.stylesCommon?split(' ') as style>
diff --git a/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties b/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
index 12b6a6324dfe..5004f0172494 100644
--- a/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
+++ b/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
@@ -1174,6 +1174,12 @@ otp-token-period=OTP Token Period
otp-token-period.tooltip=How many seconds should an OTP token be valid? Defaults to 30 seconds.
otp-supported-applications=Supported Applications
otp-supported-applications.tooltip=Applications that are known to work with the current OTP policy
+loa-level=Level of Authentication
+loa-level.tooltip=Sets the Level of Authentication to the specified value.
+loa-store-in-user-session=Store LOA in user session
+loa-store-in-user-session.tooltip=Additionally stores the LOA in the user session.
+loa-condition-level=Level of Authentication
+loa-condition-level.tooltip=If this level of authentication is reached the condition evaluates to false.
table-of-password-policies=Table of Password Policies
add-policy.placeholder=Add policy...
policy-type=Policy Type
@@ -1723,6 +1729,9 @@ subjectdn-tooltip=A regular expression for validating Subject DN in the Client C
pkce-code-challenge-method=Proof Key for Code Exchange Code Challenge Method
pkce-code-challenge-method.tooltip=Choose which code challenge method for PKCE is used. If not specified, keycloak does not applies PKCE to a client unless the client sends an authorization request with appropriate code challenge and code exchange method.
+acr-loa-map=ACR To LOA Mapping
+acr-loa-map.tooltip=Define which ACR (Authentication Context Class Reference) value is mapped to which LOA (Level of Authentication). The ACR can be any value, whereas the LOA must be numeric.
+
key-not-allowed-here=Key '{{character}}' is not allowed here.
# KEYCLOAK-10927 Implement LDAPv3 Password Modify Extended Operation
diff --git a/themes/src/main/resources/theme/base/admin/messages/messages_en.properties b/themes/src/main/resources/theme/base/admin/messages/messages_en.properties
index 6a870247dd0b..c9bf2ecb291f 100644
--- a/themes/src/main/resources/theme/base/admin/messages/messages_en.properties
+++ b/themes/src/main/resources/theme/base/admin/messages/messages_en.properties
@@ -22,6 +22,13 @@ ldapErrorMissingGroupsPathGroup=Groups path group does not exist - please create
clientRedirectURIsFragmentError=Redirect URIs must not contain an URI fragment
clientRootURLFragmentError=Root URL must not contain an URL fragment
+clientRootURLIllegalSchemeError=Root URL uses an illegal scheme
+clientBaseURLIllegalSchemeError=Base URL uses an illegal scheme
+clientRedirectURIsIllegalSchemeError=A redirect URI uses an illegal scheme
+clientBaseURLInvalid=Base URL is not a valid URL
+clientRootURLInvalid=Root URL is not a valid URL
+clientRedirectURIsInvalid=A redirect URI is not a valid URI
+
pairwiseMalformedClientRedirectURI=Client contained an invalid redirect URI.
pairwiseClientRedirectURIsMissingHost=Client redirect URIs must contain a valid host component.
diff --git a/themes/src/main/resources/theme/base/admin/resources/js/controllers/clients.js b/themes/src/main/resources/theme/base/admin/resources/js/controllers/clients.js
index b06ee78de1be..259bc2966b57 100755
--- a/themes/src/main/resources/theme/base/admin/resources/js/controllers/clients.js
+++ b/themes/src/main/resources/theme/base/admin/resources/js/controllers/clients.js
@@ -1290,6 +1290,11 @@ module.controller('ClientDetailCtrl', function($scope, realm, client, flows, $ro
$scope.displayOnConsentScreen = false;
}
}
+ try {
+ $scope.acrLoaMap = JSON.parse($scope.client.attributes["acr.loa.map"] || "{}");
+ } catch (e) {
+ $scope.acrLoaMap = {};
+ }
}
if (!$scope.create) {
@@ -1411,6 +1416,24 @@ module.controller('ClientDetailCtrl', function($scope, realm, client, flows, $ro
$scope.clientEdit.attributes['pkce.code.challenge.method'] = $scope.pkceCodeChallengeMethod;
};
+ $scope.$watch('newAcr', function() {
+ $scope.changed = isChanged();
+ }, true);
+ $scope.$watch('newLoa', function() {
+ $scope.changed = isChanged();
+ }, true);
+ $scope.deleteAcrLoaMapping = function(acr) {
+ delete $scope.acrLoaMap[acr];
+ $scope.changed = true;
+ }
+ $scope.addAcrLoaMapping = function() {
+ if ($scope.newLoa.match(/^[0-9]+$/)) {
+ $scope.acrLoaMap[$scope.newAcr] = $scope.newLoa;
+ $scope.newAcr = $scope.newLoa = "";
+ $scope.changed = true;
+ }
+ }
+
$scope.$watch(function() {
return $location.path();
}, function() {
@@ -1427,6 +1450,9 @@ module.controller('ClientDetailCtrl', function($scope, realm, client, flows, $ro
if ($scope.newWebOrigin && $scope.newWebOrigin.length > 0) {
return true;
}
+ if ($scope.newAcr && $scope.newAcr.length > 0 && $scope.newLoa && $scope.newLoa.length > 0) {
+ return true;
+ }
return false;
}
@@ -1539,6 +1565,10 @@ module.controller('ClientDetailCtrl', function($scope, realm, client, flows, $ro
$scope.addWebOrigin();
}
+ if ($scope.newAcr && $scope.newAcr.length > 0 && $scope.newLoa && $scope.newLoa.length > 0) {
+ $scope.addAcrLoaMapping();
+ }
+
if ($scope.samlServerSignature == true) {
$scope.clientEdit.attributes["saml.server.signature"] = "true";
} else {
@@ -1618,6 +1648,8 @@ module.controller('ClientDetailCtrl', function($scope, realm, client, flows, $ro
$scope.clientEdit.attributes["display.on.consent.screen"] = "false";
}
+ $scope.clientEdit.attributes["acr.loa.map"] = JSON.stringify($scope.acrLoaMap);
+
$scope.clientEdit.protocol = $scope.protocol;
$scope.clientEdit.attributes['saml.signature.algorithm'] = $scope.signatureAlgorithm;
$scope.clientEdit.attributes['saml_name_id_format'] = $scope.nameIdFormat;
diff --git a/themes/src/main/resources/theme/base/admin/resources/partials/client-detail.html b/themes/src/main/resources/theme/base/admin/resources/partials/client-detail.html
index c2130d2a1821..5068d1be206e 100755
--- a/themes/src/main/resources/theme/base/admin/resources/partials/client-detail.html
+++ b/themes/src/main/resources/theme/base/admin/resources/partials/client-detail.html
@@ -636,6 +636,27 @@
{{:: 'pkce-code-challenge-method.tooltip' | translate}}
+
+
|