requestParams, boolean isResponseTypeParameterRequired) {
+ super(keycloakSession);
this.requestParams = requestParams;
this.isResponseTypeParameterRequired = isResponseTypeParameterRequired;
}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestObjectParser.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestObjectParser.java
index 584230fba67f..c9ea65134b6c 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestObjectParser.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestObjectParser.java
@@ -41,6 +41,7 @@ public class AuthzEndpointRequestObjectParser extends AuthzEndpointRequestParser
private final JsonNode requestParams;
public AuthzEndpointRequestObjectParser(KeycloakSession session, String requestObject, ClientModel client) {
+ super(session);
this.requestParams = session.tokens().decodeClientJWT(requestObject, client, createRequestObjectValidator(session), JsonNode.class);
if (this.requestParams == null) {
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParser.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParser.java
index 8f696ea0ba7a..ab7c87c2e82e 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParser.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParser.java
@@ -19,15 +19,41 @@
import org.jboss.logging.Logger;
import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
import org.keycloak.constants.AdapterConstants;
import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.services.ErrorResponseException;
+
+import jakarta.ws.rs.core.Response;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
/**
+ * This endpoint parser supports, per default, up to
+ * {@value #DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_MUMBER} parameters with each
+ * having a total size of {@value #DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_SIZE}. If
+ * there are more authentication request parameters, or a parameter has a size
+ * than allowed, those parameters are silently ignored.
+ *
+ * You can toggle the behavior by setting a realm specific attribute
+ * ({@code additionalReqParamsFailFast}) that enables the fail-fast principle.
+ * Any request parameter in violation of the configuration results in an
+ * error response, e.g.,
+ *
+ * - for a Pushed Authorization Request (PAR) this results in a JSON response.
+ * - For openid/auth in an error page with an "Back to Application" button using the client's base URL. (if valid) as redirect target.
+ *
+ *
+ *
+ * Additionally a realm specific attribute ({@code additionalReqParamMaxOverallSize}) can be configured
+ * that sets the maximum of size of all parameters combined. If not provided, {@link Integer#MAX_VALUE} will be used.
+ *
+ * @author Manuel Schallar
* @author Marek Posolda
*/
public abstract class AuthzEndpointRequestParser {
@@ -35,22 +61,54 @@ public abstract class AuthzEndpointRequestParser {
private static final Logger logger = Logger.getLogger(AuthzEndpointRequestParser.class);
/**
- * Max number of additional req params copied into client session note to prevent DoS attacks
- *
+ * Default value for {@link #additionalReqParamsMaxNumber} if case no realm property is set.
*/
- public static final int ADDITIONAL_REQ_PARAMS_MAX_MUMBER = 5;
+ public static final int DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_MUMBER = 10;
+
+ /**
+ * Max number of additional request parameters copied into client session note to prevent DoS attacks.
+ */
+ protected final int additionalReqParamsMaxNumber;
+
+ /**
+ * Default value for {@link #additionalReqParamsMaxSize} if case no realm property is set.
+ */
+ public static final int DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_SIZE = 2000;
+
+ /**
+ * Max size of additional request parameters value copied into client session note to prevent DoS attacks.
+ */
+ protected final int additionalReqParamsMaxSize;
+
+ /**
+ * Default value for {@link #additionalReqParamsFailFast} in case no realm property is set.
+ */
+ private static final boolean DEFAULT_ADDITIONAL_REQ_PARAMS_FAIL_FAST = false;
+
/**
- * Max size of additional req param value copied into client session note to prevent DoS attacks - params with longer value are ignored
- *
+ * Whether the fail-fast strategy should be enforced. If false all additional request parameters
+ * that to not meet the configuration are silently ignored. If true an exception will be raised.
*/
- public static final int ADDITIONAL_REQ_PARAMS_MAX_SIZE = 2000;
+ protected final boolean additionalReqParamsFailFast;
+
+ /**
+ * Default value for {@link #additionalReqParamsMaxOverallSize} in case no realm property is set.
+ *
+ */
+ private static final int DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_OVERALL_SIZE = Integer.MAX_VALUE;
+
+ /**
+ * Max size of all additional request parameters value copied into client session note to prevent DoS attacks.
+ */
+ protected final int additionalReqParamsMaxOverallSize;
public static final String AUTHZ_REQUEST_OBJECT = "ParsedRequestObject";
public static final String AUTHZ_REQUEST_OBJECT_ENCRYPTED = "EncryptedRequestObject";
/** Set of known protocol GET params not to be stored into additionalReqParams} */
public static final Set KNOWN_REQ_PARAMS = new HashSet<>();
+ public static final Set ADDITIONAL_REQ_PARAMS_MAX_SIZE_IGNORE = new HashSet<>();
static {
KNOWN_REQ_PARAMS.add(OIDCLoginProtocol.CLIENT_ID_PARAM);
KNOWN_REQ_PARAMS.add(OIDCLoginProtocol.RESPONSE_TYPE_PARAM);
@@ -73,8 +131,25 @@ public abstract class AuthzEndpointRequestParser {
// https://tools.ietf.org/html/rfc7636#section-6.1
KNOWN_REQ_PARAMS.add(OIDCLoginProtocol.CODE_CHALLENGE_PARAM);
KNOWN_REQ_PARAMS.add(OIDCLoginProtocol.CODE_CHALLENGE_METHOD_PARAM);
+
+ // Ignore "hash" parameter for param size check, because more than 4 hashes get filtered by this check.
+ ADDITIONAL_REQ_PARAMS_MAX_SIZE_IGNORE.add("hash");
+ ADDITIONAL_REQ_PARAMS_MAX_SIZE_IGNORE.add("dtbs");
+
+ // Those are not OAuth/OIDC parameters, but they should never be added to the additionalRequestParameters
+ KNOWN_REQ_PARAMS.add(OAuth2Constants.CLIENT_ASSERTION_TYPE);
+ KNOWN_REQ_PARAMS.add(OAuth2Constants.CLIENT_ASSERTION);
+ KNOWN_REQ_PARAMS.add(OAuth2Constants.CLIENT_SECRET);
}
+ protected AuthzEndpointRequestParser(KeycloakSession keycloakSession) {
+ RealmModel realm = keycloakSession.getContext().getRealm();
+ this.additionalReqParamsMaxNumber = realm.getAttribute("additionalReqParamsMaxNumber", DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_MUMBER);
+ this.additionalReqParamsMaxSize = realm.getAttribute("additionalReqParamsMaxSize", DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_SIZE);
+ this.additionalReqParamsFailFast = realm.getAttribute("additionalReqParamsFailFast", DEFAULT_ADDITIONAL_REQ_PARAMS_FAIL_FAST);
+ this.additionalReqParamsMaxOverallSize = realm.getAttribute("additionalReqParamsMaxOverallSize", DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_OVERALL_SIZE);
+ }
+
public void parseRequest(AuthorizationEndpointRequest request) {
String clientId = getParameter(OIDCLoginProtocol.CLIENT_ID_PARAM);
if (clientId != null && request.clientId != null && !request.clientId.equals(clientId)) {
@@ -120,23 +195,61 @@ protected void validateResponseTypeParameter(String responseTypeParameter, Autho
}
protected void extractAdditionalReqParams(Map additionalReqParams) {
+ int currentAdditionalReqParamMaxOverallSize = 0;
for (String paramName : keySet()) {
- if (!KNOWN_REQ_PARAMS.contains(paramName)) {
- String value = getParameter(paramName);
- if (value != null && value.trim().isEmpty()) {
- value = null;
- }
- if (value != null && value.length() <= ADDITIONAL_REQ_PARAMS_MAX_SIZE) {
- if (additionalReqParams.size() >= ADDITIONAL_REQ_PARAMS_MAX_MUMBER) {
- logger.debug("Maximal number of additional OIDC params (" + ADDITIONAL_REQ_PARAMS_MAX_MUMBER + ") exceeded, ignoring rest of them!");
- break;
- }
- additionalReqParams.put(paramName, value);
- } else {
- logger.debug("OIDC Additional param " + paramName + " ignored because value is empty or longer than " + ADDITIONAL_REQ_PARAMS_MAX_SIZE);
- }
+
+ if (KNOWN_REQ_PARAMS.contains(paramName)) {
+ logger.debugv("The additional OIDC param ''{0}'' is well known. Continue with the other additional parameters.", paramName);
+ continue;
+ }
+
+ final String value = getParameter(paramName);
+
+ if (value == null || value.trim().isEmpty()) {
+ logger.debugv("The additional OIDC param ''{0}'' ignored because it's value is null or blank.", paramName);
+ continue;
+ }
+
+ // Compare with ">=", as the currently processed parameter will be added at the END of this method.
+ if (additionalReqParams.size() >= additionalReqParamsMaxNumber) {
+
+ if (additionalReqParamsFailFast) {
+ logger.infov("The maximum number of allowed parameters ({0}) is exceeded.", additionalReqParamsMaxNumber);
+ throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "The maximum number of allowed parameters (" + additionalReqParamsMaxNumber + ") is exceeded.", Response.Status.BAD_REQUEST);
+ } else {
+ logger.debugv("The maximum number of allowed parameters ({0}) is exceeded.", additionalReqParamsMaxNumber);
+ break;
+ }
+
+ }
+
+ if (value.length() + currentAdditionalReqParamMaxOverallSize > additionalReqParamsMaxOverallSize) {
+
+ if (additionalReqParamsFailFast) {
+ logger.infov("The OIDC additional parameter '{0}''s size ({1}) exceeds the maximum allowed size of all parameters ({2}).", paramName, value.length(), additionalReqParamsMaxOverallSize);
+ throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "The OIDC additional parameter '" + paramName + "'s size (" + value.length() + ") exceeds the maximum allowed size of all parameters (" + additionalReqParamsMaxOverallSize + ").", Response.Status.BAD_REQUEST);
+ } else {
+ logger.debugv("The OIDC additional parameter '{0}''s size exceeds ({1}) the maximum allowed size of all parameters ({2}).", paramName, value.length(), additionalReqParamsMaxOverallSize);
+ break;
}
+ }
+
+ if (value.length() > additionalReqParamsMaxSize) {
+
+ if (additionalReqParamsFailFast) {
+ logger.infov("The OIDC additional parameter '{0}''s size is longer ({1}) than allowed ({2}).", paramName, value.length(), additionalReqParamsMaxSize);
+ throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "The OIDC additional parameter '" + paramName + "'s size is longer (" + value.length() + ") than allowed (" + additionalReqParamsMaxSize + ").", Response.Status.BAD_REQUEST);
+ } else {
+ logger.debugv("The OIDC additional parameter '{0}''s size is longer ({1}) than allowed ({2}).", paramName, value.length(), additionalReqParamsMaxSize);
+ break;
+ }
+
+ }
+
+ logger.debugv("Adding OIDC additional parameter ''{0}'' as additional parameter.", paramName);
+ currentAdditionalReqParamMaxOverallSize += value.length();
+ additionalReqParams.put(paramName, value);
}
}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java
index 882e3c7620a6..efafc320cecb 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java
@@ -25,10 +25,10 @@
import org.keycloak.OAuth2Constants;
import org.keycloak.OAuthErrorException;
import org.keycloak.common.Profile;
+import org.keycloak.events.Details;
import org.keycloak.events.Errors;
import org.keycloak.events.EventType;
import org.keycloak.models.AuthenticatedClientSessionModel;
-import org.keycloak.models.KeycloakSession;
import org.keycloak.models.UserSessionModel;
import org.keycloak.protocol.oidc.TokenManager;
import org.keycloak.representations.AccessTokenResponse;
@@ -65,6 +65,7 @@ public Response process(Context context) {
session.clientPolicy().triggerOnEvent(new TokenRefreshContext(formParams));
refreshToken = formParams.getFirst(OAuth2Constants.REFRESH_TOKEN);
} catch (ClientPolicyException cpe) {
+ event.detail(Details.REASON, cpe.getErrorDetail());
event.error(cpe.getError());
throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
}
@@ -91,13 +92,16 @@ public Response process(Context context) {
logger.trace(e.getMessage(), e);
// KEYCLOAK-6771 Certificate Bound Token
if (MtlsHoKTokenUtil.CERT_VERIFY_ERROR_DESC.equals(e.getDescription())) {
+ event.detail(Details.REASON, e.getDescription());
event.error(Errors.NOT_ALLOWED);
throw new CorsErrorResponseException(cors, e.getError(), e.getDescription(), Response.Status.UNAUTHORIZED);
} else {
+ event.detail(Details.REASON, e.getDescription());
event.error(Errors.INVALID_TOKEN);
throw new CorsErrorResponseException(cors, e.getError(), e.getDescription(), Response.Status.BAD_REQUEST);
}
} catch (ClientPolicyException cpe) {
+ event.detail(Details.REASON, cpe.getErrorDetail());
event.error(cpe.getError());
throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationCallbackEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationCallbackEndpoint.java
index 069052dc1472..31100afed75f 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationCallbackEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationCallbackEndpoint.java
@@ -56,6 +56,7 @@ public class BackchannelAuthenticationCallbackEndpoint extends AbstractCibaEndpo
private static final Logger logger = Logger.getLogger(BackchannelAuthenticationCallbackEndpoint.class);
private final HttpRequest httpRequest;
+ protected AuthenticationChannelResponse authenticationChannelResponse;
public BackchannelAuthenticationCallbackEndpoint(KeycloakSession session, EventBuilder event) {
super(session, event);
@@ -69,7 +70,8 @@ public BackchannelAuthenticationCallbackEndpoint(KeycloakSession session, EventB
@Produces(MediaType.APPLICATION_JSON)
public Response processAuthenticationChannelResult(AuthenticationChannelResponse response) {
event.event(EventType.LOGIN);
- BackchannelAuthCallbackContext ctx = verifyAuthenticationRequest(httpRequest.getHttpHeaders());
+ this.authenticationChannelResponse = response;
+ BackchannelAuthCallbackContext ctx = verifyAuthenticationRequest(getRawBearerToken());
AccessToken bearerToken = ctx.bearerToken;
OAuth2DeviceCodeModel deviceModel = ctx.deviceModel;
@@ -81,15 +83,21 @@ public Response processAuthenticationChannelResult(AuthenticationChannelResponse
Response.Status.BAD_REQUEST);
}
+ status = preApprove(response);
+
switch (status) {
case SUCCEED:
- approveRequest(bearerToken, response.getAdditionalParams());
+ approveRequest(bearerToken.getId(), response.getAdditionalParams());
break;
case CANCELLED:
case UNAUTHORIZED:
- denyRequest(bearerToken, status);
+ denyRequest(bearerToken.getId(), status);
break;
}
+
+ if (!postApprove(response)) {
+ denyRequest(bearerToken.getId(), status);
+ }
// Call the notification endpoint
ClientModel client = session.getContext().getClient();
@@ -101,8 +109,7 @@ public Response processAuthenticationChannelResult(AuthenticationChannelResponse
return Response.ok(MediaType.APPLICATION_JSON_TYPE).build();
}
- private BackchannelAuthCallbackContext verifyAuthenticationRequest(HttpHeaders headers) {
- String rawBearerToken = AppAuthManager.extractAuthorizationHeaderTokenOrReturnNull(headers);
+ protected BackchannelAuthCallbackContext verifyAuthenticationRequest(String rawBearerToken) {
if (rawBearerToken == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, "Invalid token", Response.Status.UNAUTHORIZED);
@@ -111,12 +118,7 @@ private BackchannelAuthCallbackContext verifyAuthenticationRequest(HttpHeaders h
AccessToken bearerToken;
try {
- bearerToken = TokenVerifier.createWithoutSignature(session.tokens().decode(rawBearerToken, AccessToken.class))
- .withDefaultChecks()
- .realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()))
- .checkActive(true)
- .audience(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()))
- .verify().getToken();
+ bearerToken = getTokenVerifier(rawBearerToken).verify().getToken();
} catch (Exception e) {
event.error(Errors.INVALID_TOKEN);
// authentication channel id format is invalid or it has already been used
@@ -152,26 +154,62 @@ private BackchannelAuthCallbackContext verifyAuthenticationRequest(HttpHeaders h
return new BackchannelAuthCallbackContext(bearerToken, deviceCode);
}
- private void cancelRequest(String authResultId) {
+ protected void cancelRequest(String authResultId) {
OAuth2DeviceCodeModel userCode = DeviceEndpoint.getDeviceByUserCode(session, realm, authResultId);
DeviceGrantType.removeDeviceByDeviceCode(session, userCode.getDeviceCode());
DeviceGrantType.removeDeviceByUserCode(session, realm, authResultId);
}
+
+ protected Status preApprove(AuthenticationChannelResponse response) {
+ return response.getStatus();
+ }
- private void approveRequest(AccessToken authReqId, Map additionalParams) {
- DeviceGrantType.approveUserCode(session, realm, authReqId.getId(), "fake", additionalParams);
+ protected void approveRequest(String authReqId, Map additionalParams) {
+ DeviceGrantType.approveUserCode(session, realm, authReqId, "fake", additionalParams);
+ }
+
+ protected boolean postApprove(AuthenticationChannelResponse response) {
+ return true;
}
- private void denyRequest(AccessToken authReqId, Status status) {
+ protected void denyRequest(String authReqId, Status status) {
if (CANCELLED.equals(status)) {
event.error(Errors.NOT_ALLOWED);
} else {
event.error(Errors.CONSENT_DENIED);
}
- DeviceGrantType.denyUserCode(session, realm, authReqId.getId());
+ DeviceGrantType.denyUserCode(session, realm, authReqId);
+ }
+
+ protected String getRawBearerToken() {
+ return AppAuthManager.extractAuthorizationHeaderTokenOrReturnNull(httpRequest.getHttpHeaders());
}
+ /**
+ * Returns a tokenverifier for {@link AccessToken}s with
+ * {@link TokenVerifier#withDefaultChecks()} with configured realmurl, isactive
+ * check an audience.
+ *
+ * @param rawBearerToken The raw bearer token. (required; must not be
+ * {@code null})
+ *
+ * @return The token verifier for {@link AccessToken}s. (never {@code null})
+ *
+ * @implNote Note that the token will only verified once
+ * {@link TokenVerifier#verify()} is called.
+ */
+ protected TokenVerifier getTokenVerifier(String rawBearerToken) {
+
+ return TokenVerifier
+ .createWithoutSignature(session.tokens().decode(rawBearerToken, AccessToken.class))
+ .withDefaultChecks()
+ .realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()))
+ .checkActive(true)
+ .audience(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
+
+ }
+
protected void sendClientNotificationRequest(ClientModel client, CibaConfig cibaConfig, OAuth2DeviceCodeModel deviceModel) {
String clientNotificationEndpoint = cibaConfig.getBackchannelClientNotificationEndpoint(client);
if (clientNotificationEndpoint == null) {
@@ -208,7 +246,7 @@ protected void sendClientNotificationRequest(ClientModel client, CibaConfig ciba
}
}
- private class BackchannelAuthCallbackContext {
+ protected static class BackchannelAuthCallbackContext {
private final AccessToken bearerToken;
private final OAuth2DeviceCodeModel deviceModel;
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java
index a2b80c520b17..799c528a0f53 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java
@@ -99,12 +99,12 @@ public Response processGrantRequest() {
UserModel user = request.getUser();
String infoUsedByAuthentication = resolver.getInfoUsedByAuthentication(user);
+ CibaConfig cibaPolicy = realm.getCibaPolicy();
+ int poolingInterval = cibaPolicy.getPoolingInterval();
- if (provider.requestAuthentication(request, infoUsedByAuthentication)) {
- CibaConfig cibaPolicy = realm.getCibaPolicy();
- int poolingInterval = cibaPolicy.getPoolingInterval();
+ storeAuthenticationRequest(request, cibaPolicy, authReqId);
- storeAuthenticationRequest(request, cibaPolicy, authReqId);
+ if (provider.requestAuthentication(request, infoUsedByAuthentication)) {
ObjectNode response = JsonSerialization.createObjectNode();
@@ -151,12 +151,19 @@ private void storeAuthenticationRequest(CIBAAuthenticationRequest request, CibaC
// To inform "expired_token" to the client, the lifespan of the cache provider is longer than device code
int lifespanSeconds = expiresIn + poolingInterval + 10;
+
+ this.store(userCode, deviceCode, lifespanSeconds);
+
+ }
+
+
+ protected void store(OAuth2DeviceUserCodeModel userCode, OAuth2DeviceCodeModel deviceCode, int lifespanSeconds) {
- SingleUseObjectProvider singleUseStore = session.singleUseObjects();
+ SingleUseObjectProvider singleUseStore = session.getProvider(SingleUseObjectProvider.class);
singleUseStore.put(deviceCode.serializeKey(), lifespanSeconds, deviceCode.toMap());
singleUseStore.put(userCode.serializeKey(), lifespanSeconds, userCode.serializeValue());
- }
+ }
private CIBAAuthenticationRequest authorizeClient(MultivaluedMap params) {
ClientModel client = null;
@@ -167,7 +174,7 @@ private CIBAAuthenticationRequest authorizeClient(MultivaluedMap
throw new ErrorResponseException(errorRep.getError(), errorRep.getErrorDescription(), Response.Status.UNAUTHORIZED);
}
BackchannelAuthenticationEndpointRequest endpointRequest = BackchannelAuthenticationEndpointRequestParserProcessor.parseRequest(event, session, client, params, realm.getCibaPolicy());
- UserModel user = resolveUser(endpointRequest, realm.getCibaPolicy().getAuthRequestedUserHint());
+ UserModel user = resolveUser(endpointRequest, getAuthRequestedUserHint());
CIBAAuthenticationRequest request = new CIBAAuthenticationRequest(session, user, client);
@@ -238,6 +245,10 @@ private CIBAAuthenticationRequest authorizeClient(MultivaluedMap
return request;
}
+ protected String getAuthRequestedUserHint() {
+ return realm.getCibaPolicy().getAuthRequestedUserHint();
+ }
+
protected void extractAdditionalParams(BackchannelAuthenticationEndpointRequest endpointRequest, CIBAAuthenticationRequest request) {
for (String paramName : endpointRequest.getAdditionalReqParams().keySet()) {
request.setOtherClaims(paramName, endpointRequest.getAdditionalReqParams().get(paramName));
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestBodyParser.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestBodyParser.java
index 767e2c278729..99f90d21bf46 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestBodyParser.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestBodyParser.java
@@ -18,6 +18,7 @@
package org.keycloak.protocol.oidc.grants.ciba.endpoints.request;
import jakarta.ws.rs.core.MultivaluedMap;
+import org.keycloak.models.KeycloakSession;
import java.util.Set;
@@ -32,7 +33,8 @@ class BackchannelAuthenticationEndpointRequestBodyParser extends BackchannelAuth
private String invalidRequestMessage = null;
- public BackchannelAuthenticationEndpointRequestBodyParser(MultivaluedMap requestParams) {
+ public BackchannelAuthenticationEndpointRequestBodyParser(KeycloakSession session, MultivaluedMap requestParams) {
+ super(session);
this.requestParams = requestParams;
}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParser.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParser.java
index 6d734d2f8069..c7badcd5bec5 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParser.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParser.java
@@ -20,7 +20,10 @@
import org.jboss.logging.Logger;
import org.keycloak.OAuth2Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser;
import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
import java.util.HashSet;
@@ -38,13 +41,13 @@ public abstract class BackchannelAuthenticationEndpointRequestParser {
* Max number of additional req params copied into client session note to prevent DoS attacks
*
*/
- public static final int ADDITIONAL_REQ_PARAMS_MAX_MUMBER = 5;
+ private final int additionalReqParamsMaxNumber;
/**
* Max size of additional req param value copied into client session note to prevent DoS attacks - params with longer value are ignored
*
*/
- public static final int ADDITIONAL_REQ_PARAMS_MAX_SIZE = 200;
+ private final int additionalReqParamsMaxSize;
public static final String CIBA_SIGNED_AUTHENTICATION_REQUEST = "ParsedSignedAuthenticationRequest";
@@ -77,6 +80,22 @@ public abstract class BackchannelAuthenticationEndpointRequestParser {
// if these are included in Backchannel Authentication Request's body part for "client_secret_post" client authentication
KNOWN_REQ_PARAMS.add(OAuth2Constants.CLIENT_ID);
KNOWN_REQ_PARAMS.add(OAuth2Constants.CLIENT_SECRET);
+
+ /* Ignore JTI as additional parameter.
+ *
+ * if not ignored it leads to a duplicate entry in the AUTH_REQ_ID JWE token
+ * (see BackchannelAuthenticationEndpoint:processGrantRequest) and due to
+ * deserialization to a wrong id in CibaGrantType:process
+ * which leads to an HTTP 400 response in the ciba token call.
+ */
+ KNOWN_REQ_PARAMS.add("jti");
+ KNOWN_REQ_PARAMS.add("hash");
+ }
+
+ BackchannelAuthenticationEndpointRequestParser(KeycloakSession keycloakSession) {
+ RealmModel realm = keycloakSession.getContext().getRealm();
+ this.additionalReqParamsMaxNumber = realm.getAttribute("additionalReqParamsMaxNumber", AuthzEndpointRequestParser.DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_MUMBER);
+ this.additionalReqParamsMaxSize = realm.getAttribute("additionalReqParamsMaxSize", AuthzEndpointRequestParser.DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_SIZE);
}
public void parseRequest(BackchannelAuthenticationEndpointRequest request) {
@@ -98,6 +117,8 @@ public void parseRequest(BackchannelAuthenticationEndpointRequest request) {
request.claims = replaceIfNotNull(request.claims, getParameter(OIDCLoginProtocol.CLAIMS_PARAM));
extractAdditionalReqParams(request.additionalReqParams);
+
+ request.additionalReqParams.put("hash", getParameter("hash"));
}
protected void extractAdditionalReqParams(Map additionalReqParams) {
@@ -107,14 +128,14 @@ protected void extractAdditionalReqParams(Map additionalReqParam
if (value != null && value.trim().isEmpty()) {
value = null;
}
- if (value != null && value.length() <= ADDITIONAL_REQ_PARAMS_MAX_SIZE) {
- if (additionalReqParams.size() >= ADDITIONAL_REQ_PARAMS_MAX_MUMBER) {
- logger.debug("Maximal number of additional OIDC CIBA params (" + ADDITIONAL_REQ_PARAMS_MAX_MUMBER + ") exceeded, ignoring rest of them!");
+ if (value != null && value.length() <= additionalReqParamsMaxSize) {
+ if (additionalReqParams.size() >= additionalReqParamsMaxNumber) {
+ logger.debug("Maximal number of additional OIDC CIBA params (" + additionalReqParamsMaxNumber + ") exceeded, ignoring rest of them!");
break;
}
additionalReqParams.put(paramName, value);
} else {
- logger.debug("OIDC CIBA Additional param " + paramName + " ignored because value is empty or longer than " + ADDITIONAL_REQ_PARAMS_MAX_SIZE);
+ logger.debug("OIDC CIBA Additional param " + paramName + " ignored because value is empty or longer than " + additionalReqParamsMaxSize);
}
}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParserProcessor.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParserProcessor.java
index 618db3569684..6e7ee64753cd 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParserProcessor.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointRequestParserProcessor.java
@@ -45,7 +45,7 @@ public static BackchannelAuthenticationEndpointRequest parseRequest(EventBuilder
try {
BackchannelAuthenticationEndpointRequest request = new BackchannelAuthenticationEndpointRequest();
- BackchannelAuthenticationEndpointRequestBodyParser parser = new BackchannelAuthenticationEndpointRequestBodyParser(requestParams);
+ BackchannelAuthenticationEndpointRequestBodyParser parser = new BackchannelAuthenticationEndpointRequestBodyParser(session, requestParams);
parser.parseRequest(request);
if (parser.getInvalidRequestMessage() != null) {
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointSignedRequestParser.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointSignedRequestParser.java
index 4baef290d406..1d86ea3203ec 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointSignedRequestParser.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/request/BackchannelAuthenticationEndpointSignedRequestParser.java
@@ -43,6 +43,7 @@ class BackchannelAuthenticationEndpointSignedRequestParser extends BackchannelAu
private final JsonNode requestParams;
public BackchannelAuthenticationEndpointSignedRequestParser(KeycloakSession session, String signedAuthReq, ClientModel client, CibaConfig config) throws Exception {
+ super(session);
JOSE jwt = JOSEParser.parse(signedAuthReq);
if (jwt instanceof JWE) {
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/SessionStateMapper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/SessionStateMapper.java
new file mode 100755
index 000000000000..ac4ac07a2c8f
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/SessionStateMapper.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oidc.mappers;
+
+import org.jboss.logging.Logger;
+
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.representations.IDToken;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author Giuseppe Graziano
+ */
+public class SessionStateMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper {
+
+
+ public static final String PROVIDER_ID = "oidc-session-state-mapper";
+
+ private static final Logger logger = Logger.getLogger(SessionStateMapper.class);
+
+ private static final List configProperties = new ArrayList<>();
+
+ static {
+ OIDCAttributeMapperHelper.addIncludeInTokensConfig(configProperties, SessionStateMapper.class);
+ }
+
+ public List getConfigProperties() {
+ return configProperties;
+ }
+
+ @Override
+ public String getId() {
+ return PROVIDER_ID;
+ }
+
+ @Override
+ public String getDisplayType() {
+ return "Session State (session_state)";
+ }
+
+ @Override
+ public String getDisplayCategory() {
+ return TOKEN_MAPPER_CATEGORY;
+ }
+
+ @Override
+ public String getHelpText() {
+ return "Add Session State (session_state) claim";
+ }
+
+ @Override
+ protected void setClaim(IDToken token, ProtocolMapperModel mappingModel, UserSessionModel userSession, KeycloakSession keycloakSession,
+ ClientSessionContext clientSessionCtx) {
+ if (userSession != null) {
+ token.getOtherClaims().put(IDToken.SESSION_STATE, userSession.getId());
+ }
+ }
+
+ public static ProtocolMapperModel create(String name, boolean accessToken, boolean idToken, boolean userInfo, boolean introspectionEndpoint) {
+ ProtocolMapperModel mapper = new ProtocolMapperModel();
+ mapper.setName(name);
+ mapper.setProtocolMapper(PROVIDER_ID);
+ mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+ Map config = new HashMap<>();
+ if (accessToken) config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+ if (idToken) config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
+ if (userInfo) config.put(OIDCAttributeMapperHelper.INCLUDE_IN_USERINFO, "true");
+ if (introspectionEndpoint) config.put(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION, "true");
+ mapper.setConfig(config);
+ return mapper;
+ }
+
+}
\ No newline at end of file
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/AuthzEndpointParParser.java b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/AuthzEndpointParParser.java
index 57882c408f3a..36b6f9fb5413 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/AuthzEndpointParParser.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/AuthzEndpointParParser.java
@@ -47,6 +47,7 @@ public class AuthzEndpointParParser extends AuthzEndpointRequestParser {
private String invalidRequestMessage = null;
public AuthzEndpointParParser(KeycloakSession session, ClientModel client, String requestUri) {
+ super(session);
this.session = session;
this.client = client;
SingleUseObjectProvider singleUseStore = session.singleUseObjects();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/ParEndpointRequestParserProcessor.java b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/ParEndpointRequestParserProcessor.java
index 1efdf24feef6..b10e2591e005 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/ParEndpointRequestParserProcessor.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/request/ParEndpointRequestParserProcessor.java
@@ -50,7 +50,7 @@ public static AuthorizationEndpointRequest parseRequest(EventBuilder event, Keyc
try {
AuthorizationEndpointRequest request = new AuthorizationEndpointRequest();
- AuthzEndpointQueryStringParser parser = new AuthzEndpointQueryStringParser(requestParams, false);
+ AuthzEndpointQueryStringParser parser = new AuthzEndpointQueryStringParser(session, requestParams, false);
parser.parseRequest(request);
if (parser.getInvalidRequestMessage() != null) {
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java b/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java
index cafebb9ff1e1..8611093622e4 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java
@@ -102,7 +102,7 @@ private static Map getAcrLoaMapForClientOnly(ClientModel client
try {
return JsonSerialization.readValue(map, new TypeReference>() {});
} catch (IOException e) {
- LOGGER.warnf("Invalid client configuration (ACR-LOA map) for client '%s'", client.getClientId());
+ LOGGER.warnf("Invalid client configuration (ACR-LOA map) for client '%s'. Error details: %s", client.getClientId(), e.getMessage());
return Collections.emptyMap();
}
}
@@ -119,7 +119,7 @@ public static Map getAcrLoaMap(RealmModel realm) {
try {
return JsonSerialization.readValue(map, new TypeReference>() {});
} catch (IOException e) {
- LOGGER.warn("Invalid realm configuration (ACR-LOA map)");
+ LOGGER.warnf("Invalid realm configuration (ACR-LOA map). Details: %s", e.getMessage());
return Collections.emptyMap();
}
}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java b/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
index e171d8da8951..de8fd84e0a56 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
@@ -18,8 +18,6 @@
package org.keycloak.protocol.oidc.utils;
import org.jboss.logging.Logger;
-import org.keycloak.common.util.Encode;
-import org.keycloak.common.util.KeycloakUriBuilder;
import org.keycloak.common.util.UriUtils;
import org.keycloak.models.ClientModel;
import org.keycloak.models.Constants;
@@ -34,6 +32,7 @@
import java.util.Collection;
import java.util.Set;
import java.util.TreeSet;
+import java.util.regex.Pattern;
import java.util.stream.Collectors;
/**
@@ -111,16 +110,13 @@ public static String verifyRedirectUri(KeycloakSession session, String rootUrl,
return null;
}
- // Make the validations against fully decoded and normalized redirect-url. This also allows wildcards (case when client configured "Valid redirect-urls" contain wildcards)
- String decodedRedirectUri = decodeRedirectUri(redirectUri);
- URI decodedRedirect = toUri(decodedRedirectUri);
- decodedRedirectUri = getNormalizedRedirectUri(decodedRedirect);
- if (decodedRedirectUri == null) return null;
+ // check if the passed URI allows wildcards
+ boolean allowWildcards = areWildcardsAllowed(originalRedirect);
- String r = decodedRedirectUri;
+ String r = redirectUri;
Set resolveValidRedirects = resolveValidRedirects(session, rootUrl, validRedirects);
- String valid = matchesRedirects(resolveValidRedirects, r, true);
+ String valid = matchesRedirects(resolveValidRedirects, r, allowWildcards);
if (valid == null && (r.startsWith(Constants.INSTALLED_APP_URL) || r.startsWith(Constants.INSTALLED_APP_LOOPBACK)) && r.indexOf(':', Constants.INSTALLED_APP_URL.length()) >= 0) {
int i = r.indexOf(':', Constants.INSTALLED_APP_URL.length());
@@ -135,15 +131,7 @@ public static String verifyRedirectUri(KeycloakSession session, String rootUrl,
r = sb.toString();
- valid = matchesRedirects(resolveValidRedirects, r, true);
- }
-
- // Return the original redirectUri, which can be partially encoded - for example http://localhost:8280/foo/bar%20bar%2092%2F72/3 . Just make sure it is normalized
- redirectUri = getNormalizedRedirectUri(originalRedirect);
-
- // We try to check validity also for original (encoded) redirectUrl, but just in case it exactly matches some "Valid Redirect URL" specified for client (not wildcards allowed)
- if (valid == null) {
- valid = matchesRedirects(resolveValidRedirects, redirectUri, false);
+ valid = matchesRedirects(resolveValidRedirects, r, allowWildcards);
}
if (valid != null && !originalRedirect.isAbsolute()) {
@@ -154,7 +142,7 @@ public static String verifyRedirectUri(KeycloakSession session, String rootUrl,
redirectUri = relativeToAbsoluteURI(session, rootUrl, redirectUri);
}
- String scheme = decodedRedirect.getScheme();
+ String scheme = originalRedirect.getScheme();
if (valid != null && scheme != null) {
// check the scheme is valid, it should be http(s) or explicitly allowed by the validation
if (!valid.startsWith(scheme + ":") && !"http".equalsIgnoreCase(scheme) && !"https".equalsIgnoreCase(scheme)) {
@@ -179,51 +167,22 @@ private static URI toUri(String redirectUri) {
try {
uri = URI.create(redirectUri);
} catch (IllegalArgumentException cause) {
- logger.debug("Invalid redirect uri", cause);
+ logger.debugf(cause, "Invalid redirect uri %s", redirectUri);
} catch (Exception cause) {
- logger.debug("Unexpected error when parsing redirect uri", cause);
+ logger.debugf(cause, "Unexpected error when parsing redirect uri %s", redirectUri);
}
}
return uri;
}
- private static String getNormalizedRedirectUri(URI uri) {
- String redirectUri = null;
- if (uri != null) {
- redirectUri = uri.normalize().toString();
- }
- return redirectUri;
- }
-
- // Decode redirectUri. Only path is decoded as other elements can be encoded in the original URL or cannot be encoded at all.
- // URL can be decoded multiple times (in case it was encoded multiple times, or some of it's parts were encoded multiple times)
- private static String decodeRedirectUri(String redirectUri) {
- if (redirectUri == null) return null;
- int MAX_DECODING_COUNT = 5; // Max count of attempts for decoding URL (in case it was encoded multiple times)
+ // any access to parent folder /../ is unsafe with or without encoding
+ private final static Pattern UNSAFE_PATH_PATTERN = Pattern.compile(
+ "(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}(/|%2[fF]|%5[cC]|\\\\)|(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}$");
- try {
- KeycloakUriBuilder uriBuilder = KeycloakUriBuilder.fromUri(redirectUri, false).preserveDefaultPort();
- if (uriBuilder.getPath() == null) {
- return redirectUri;
- }
- String encodedPath = uriBuilder.getPath();
- String decodedPath;
-
- for (int i = 0; i < MAX_DECODING_COUNT; i++) {
- decodedPath = Encode.decode(encodedPath);
- if (decodedPath.equals(encodedPath)) {
- // URL path is decoded. We can return it in the original redirect URI
- return uriBuilder.replacePath(decodedPath, false).buildAsString();
- } else {
- // Next attempt
- encodedPath = decodedPath;
- }
- }
- } catch (IllegalArgumentException iae) {
- logger.debugf("Illegal redirect URI used: %s, Details: %s", redirectUri, iae.getMessage());
- }
- logger.debugf("Was not able to decode redirect URI: %s", redirectUri);
- return null;
+ private static boolean areWildcardsAllowed(URI redirectUri) {
+ // wildcars are only allowed if no user-info and no unsafe pattern in path
+ return redirectUri.getRawUserInfo() == null
+ && (redirectUri.getRawPath() == null || !UNSAFE_PATH_PATTERN.matcher(redirectUri.getRawPath()).find());
}
private static String relativeToAbsoluteURI(KeycloakSession session, String rootUrl, String relative) {
@@ -240,24 +199,20 @@ private static String relativeToAbsoluteURI(KeycloakSession session, String root
return sb.toString();
}
- // removes the queryString, fragment and userInfo from the redirect
- // to avoid comparing this when wildcards are used
- private static String stripOffRedirectForWildcard(String redirect) {
- return KeycloakUriBuilder.fromUri(redirect, false)
- .preserveDefaultPort()
- .userInfo(null)
- .replaceQuery(null)
- .fragment(null)
- .buildAsString();
- }
-
// return the String that matched the redirect or null if not matched
private static String matchesRedirects(Set validRedirects, String redirect, boolean allowWildcards) {
logger.tracef("matchesRedirects: redirect URL to check: %s, allow wildcards: %b, Configured valid redirect URLs: %s", redirect, allowWildcards, validRedirects);
for (String validRedirect : validRedirects) {
- if (validRedirect.endsWith("*") && !validRedirect.contains("?") && allowWildcards) {
- // strip off the userInfo, query or fragment components - we don't check them when wildcards are effective
- String r = stripOffRedirectForWildcard(redirect);
+ if ("*".equals(validRedirect)) {
+ // the valid redirect * is a full wildcard for http(s) even if the redirect URI does not allow wildcards
+ return validRedirect;
+ } else if (validRedirect.endsWith("*") && !validRedirect.contains("?") && allowWildcards) {
+ // strip off the query or fragment components - we don't check them when wildcards are effective
+ int idx = redirect.indexOf('?');
+ if (idx == -1) {
+ idx = redirect.indexOf('#');
+ }
+ String r = idx == -1 ? redirect : redirect.substring(0, idx);
// strip off *
int length = validRedirect.length() - 1;
validRedirect = validRedirect.substring(0, length);
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientIdsCondition.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientIdsCondition.java
new file mode 100644
index 000000000000..ab3224bfee00
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientIdsCondition.java
@@ -0,0 +1,80 @@
+package org.keycloak.services.clientpolicy.condition;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.representations.idm.ClientPolicyConditionConfigurationRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyContext;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.services.clientpolicy.ClientPolicyVote;
+
+import java.util.List;
+
+public class ClientIdsCondition extends AbstractClientPolicyConditionProvider {
+
+ private static final Logger logger = Logger.getLogger(ClientIdsCondition.class);
+
+ public ClientIdsCondition(KeycloakSession session) {
+ super(session);
+ }
+
+ @Override public Class getConditionConfigurationClass() {
+ return ClientIdsCondition.Configuration.class;
+ }
+
+ @Override public String getProviderId() {
+ return ClientIdsConditionFactory.PROVIDER_ID;
+ }
+
+ @Override public ClientPolicyVote applyPolicy(ClientPolicyContext context) throws ClientPolicyException {
+ switch (context.getEvent()) {
+ case AUTHORIZATION_REQUEST:
+ case TOKEN_REQUEST:
+ case TOKEN_REFRESH:
+ case TOKEN_REVOKE:
+ case TOKEN_INTROSPECT:
+ case USERINFO_REQUEST:
+ case LOGOUT_REQUEST:
+ if (clientIdMatched(session.getContext().getClient()))
+ return ClientPolicyVote.YES;
+ return ClientPolicyVote.NO;
+ default:
+ return ClientPolicyVote.ABSTAIN;
+ }
+ }
+
+ private boolean clientIdMatched(ClientModel client) {
+ if (client == null || client.getClientId() == null)
+ return false;
+
+ List configuredClientIds = configuration.getClientIds();
+
+ if (configuredClientIds == null)
+ return false;
+
+ String clientId = client.getClientId();
+
+ for (String configuredClientId : configuredClientIds) {
+ if (clientId.equals(configuredClientId)) {
+ return true;
+ }
+ }
+
+ return false;
+
+ }
+
+ public static class Configuration extends ClientPolicyConditionConfigurationRepresentation {
+
+ protected List clientIds;
+
+ public List getClientIds() {
+ return clientIds;
+ }
+
+ public void setClientIds(List clientIds) {
+ this.clientIds = clientIds;
+ }
+ }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientIdsConditionFactory.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientIdsConditionFactory.java
new file mode 100644
index 000000000000..e1eab4e4e942
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientIdsConditionFactory.java
@@ -0,0 +1,52 @@
+package org.keycloak.services.clientpolicy.condition;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+public class ClientIdsConditionFactory implements ClientPolicyConditionProviderFactory {
+
+ public static final String PROVIDER_ID = "client-ids";
+ public static final String CLIENT_IDS = "clientIds";
+
+ private static final List configProperties = new ArrayList();
+
+ static {
+ ProviderConfigProperty property;
+ property = new ProviderConfigProperty(CLIENT_IDS, PROVIDER_ID + ".label", PROVIDER_ID + "-condition.tooltip",
+ ProviderConfigProperty.MULTIVALUED_STRING_TYPE, null);
+ configProperties.add(property);
+ }
+
+ @Override public ClientPolicyConditionProvider create(KeycloakSession session) {
+ return new ClientIdsCondition(session);
+ }
+
+ @Override public void init(Config.Scope config) {
+ }
+
+ @Override public void postInit(KeycloakSessionFactory factory) {
+ }
+
+ @Override public void close() {
+ }
+
+ @Override public String getId() {
+ return PROVIDER_ID;
+ }
+
+ @Override public String getHelpText() {
+ return "The condition checks whether one of the specified client ids matches the client-id of the client to determine whether the policy is applied.";
+ }
+
+ @Override public List getConfigProperties() {
+ return configProperties;
+ }
+
+}
+
+
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/executor/RegexRedirectUriExecutor.java b/services/src/main/java/org/keycloak/services/clientpolicy/executor/RegexRedirectUriExecutor.java
new file mode 100644
index 000000000000..b918dd07f8b1
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/executor/RegexRedirectUriExecutor.java
@@ -0,0 +1,83 @@
+package org.keycloak.services.clientpolicy.executor;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.jboss.logging.Logger;
+import org.keycloak.representations.idm.ClientPolicyExecutorConfigurationRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyContext;
+import org.keycloak.services.clientpolicy.ClientPolicyEvent;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.services.clientpolicy.context.AuthorizationRequestContext;
+
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.keycloak.OAuthErrorException.INVALID_REDIRECT_URI;
+import static org.keycloak.services.clientpolicy.executor.RegexRedirectUriExecutorFactory.REGEX_PATTERNS_CONFIG_FIELD;
+
+public class RegexRedirectUriExecutor
+ implements ClientPolicyExecutorProvider {
+
+ private static final Logger logger = Logger.getLogger(RegexRedirectUriExecutor.class);
+
+ private Configuration configuration;
+
+ public RegexRedirectUriExecutor() {
+ }
+
+ public void setupConfiguration(Configuration config) {
+ this.configuration = config;
+ }
+
+ public Class getExecutorConfigurationClass() {
+ return Configuration.class;
+ }
+
+ public String getProviderId() {
+ return "regex-redirect-uri";
+ }
+
+ public void executeOnEvent(ClientPolicyContext context) throws ClientPolicyException {
+ if (context.getEvent().equals(ClientPolicyEvent.AUTHORIZATION_REQUEST)) {
+ this.checkRedirectUri(((AuthorizationRequestContext) context).getRedirectUri());
+ }
+ }
+
+ private void checkRedirectUri(String redirectUri) throws ClientPolicyException {
+ if (redirectUri != null && !redirectUri.isEmpty()) {
+ logger.tracev("Redirect URI = {0}", redirectUri);
+
+ List patterns = this.configuration.getRedirectUriRegexPatterns();
+
+ for (String pattern : patterns) {
+ Pattern regexPattern = Pattern.compile(pattern);
+ Matcher matcher = regexPattern.matcher(redirectUri);
+ if (matcher.matches()) {
+ return;
+ }
+ }
+
+ throw new ClientPolicyException(INVALID_REDIRECT_URI, "Invalid redirect_uri");
+
+ } else {
+ throw new ClientPolicyException(INVALID_REDIRECT_URI, "no redirect_uri specified.");
+ }
+ }
+
+ public static class Configuration extends ClientPolicyExecutorConfigurationRepresentation {
+ @JsonProperty(REGEX_PATTERNS_CONFIG_FIELD)
+ protected List redirectUriRegexPatterns;
+
+ public Configuration() {
+ }
+
+ public List getRedirectUriRegexPatterns() {
+ return redirectUriRegexPatterns;
+ }
+
+ public void setRedirectUriRegexPatterns(List redirectUriRegexPatterns) {
+ this.redirectUriRegexPatterns = redirectUriRegexPatterns;
+ }
+ }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/executor/RegexRedirectUriExecutorFactory.java b/services/src/main/java/org/keycloak/services/clientpolicy/executor/RegexRedirectUriExecutorFactory.java
new file mode 100644
index 000000000000..989944f9858f
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/executor/RegexRedirectUriExecutorFactory.java
@@ -0,0 +1,50 @@
+package org.keycloak.services.clientpolicy.executor;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+public class RegexRedirectUriExecutorFactory implements ClientPolicyExecutorProviderFactory {
+ public static final String PROVIDER_ID = "regex-redirect-uri";
+ public static final String REGEX_PATTERNS_CONFIG_FIELD = "redirect-uri-regex-patterns";
+ private List configProperties = new ArrayList();
+
+ public RegexRedirectUriExecutorFactory() {
+ }
+
+ public ClientPolicyExecutorProvider create(KeycloakSession session) {
+ return new RegexRedirectUriExecutor();
+ }
+
+ public void init(Config.Scope config) {
+ }
+
+ public void postInit(KeycloakSessionFactory factory) {
+ ProviderConfigProperty regexPatterns =
+ new ProviderConfigProperty(REGEX_PATTERNS_CONFIG_FIELD, "Redirect URI Regex Patterns",
+ "Regex-Patterns with which the redirect-URI is checked against",
+ "MultivaluedString", null);
+
+ this.configProperties.add(regexPatterns);
+ }
+
+ public void close() {
+ }
+
+ public String getId() {
+ return PROVIDER_ID;
+ }
+
+ public String getHelpText() {
+ return "Checks if the redirect URI matches a configured regex pattern.";
+ }
+
+ public List getConfigProperties() {
+ return this.configProperties;
+ }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java
index 6d79c701b4b9..65d26fbc661e 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java
@@ -23,7 +23,7 @@
import java.net.URISyntaxException;
import java.net.URL;
import java.net.UnknownHostException;
-import java.util.LinkedList;
+import java.util.Arrays;
import java.util.List;
import java.util.Set;
import java.util.stream.Collectors;
@@ -97,6 +97,10 @@ protected void verifyHost() throws ClientRegistrationPolicyException {
String hostAddress = session.getContext().getConnection().getRemoteAddr();
+ verifyHost(hostAddress);
+ }
+
+ protected void verifyHost(String hostAddress) throws ClientRegistrationPolicyException {
logger.debugf("Verifying remote host : %s", hostAddress);
List trustedHosts = getTrustedHosts();
@@ -130,20 +134,9 @@ protected List getTrustedHosts() {
protected List getTrustedDomains() {
- List trustedHostsConfig = componentModel.getConfig().getList(TrustedHostClientRegistrationPolicyFactory.TRUSTED_HOSTS);
- List domains = new LinkedList<>();
-
- for (String hostname : trustedHostsConfig) {
- if (hostname.startsWith("*.")) {
- hostname = hostname.substring(2);
- domains.add(hostname);
- }
- }
-
- return domains;
+ return componentModel.getConfig().getList(TrustedHostClientRegistrationPolicyFactory.TRUSTED_HOSTS);
}
-
protected String verifyHostInTrustedHosts(String hostAddress, List trustedHosts) {
for (String confHostName : trustedHosts) {
try {
@@ -162,23 +155,39 @@ protected String verifyHostInTrustedHosts(String hostAddress, List trust
return null;
}
+ private boolean checkTrustedDomain(String hostname, String trustedDomain) {
+ if (trustedDomain.startsWith("*.")) {
+ String domain = trustedDomain.substring(2);
+ return hostname.equals(domain) || hostname.endsWith("." + domain);
+ }
+ return hostname.equals(trustedDomain);
+ }
protected String verifyHostInTrustedDomains(String hostAddress, List trustedDomains) {
- if (!trustedDomains.isEmpty()) {
- try {
- String hostname = InetAddress.getByName(hostAddress).getHostName();
+ try {
+ InetAddress address = InetAddress.getByName(hostAddress);
+ String hostname = address.getHostName();
+
+ logger.debugf("Trying verify request from address '%s' of host '%s' by domains", hostAddress, hostname);
- logger.debugf("Trying verify request from address '%s' of host '%s' by domains", hostAddress, hostname);
+ if (hostname.equals(address.getHostAddress())) {
+ logger.debugf("The hostAddress '%s' was not resolved to a hostname", hostAddress);
+ return null;
+ }
+
+ if (Arrays.stream(InetAddress.getAllByName(hostname)).filter(a -> address.equals(a)).findAny().isEmpty()) {
+ logger.debugf("The hostAddress '%s' is not among the direct lookups returned resolving '%s'", hostAddress, hostname);
+ return null;
+ }
- for (String confDomain : trustedDomains) {
- if (hostname.endsWith(confDomain)) {
- logger.debugf("Successfully verified host '%s' by trusted domain '%s'", hostname, confDomain);
- return hostname;
- }
+ for (String confDomain : trustedDomains) {
+ if (checkTrustedDomain(hostname, confDomain)) {
+ logger.debugf("Successfully verified host '%s' by trusted domain '%s'", hostname, confDomain);
+ return hostname;
}
- } catch (UnknownHostException uhe) {
- logger.debugf(uhe, "Request of address '%s' came from unknown host. Skip verification by domains", hostAddress);
}
+ } catch (UnknownHostException uhe) {
+ logger.debugf(uhe, "Request of address '%s' came from unknown host. Skip verification by domains", hostAddress);
}
return null;
@@ -260,7 +269,7 @@ private boolean checkHostTrusted(String host, List trustedHosts, List credentialTypes(@QueryParam(TYPE) String type
return new CredentialContainer(metadata, userCredentialMetadataModels);
};
- return getCredentialProviders()
+ return AuthenticatorUtil.getCredentialProviders(session)
.filter(p -> type == null || Objects.equals(p.getType(), type))
.filter(p -> enabledCredentialTypes.contains(p.getType()))
.map(toCredentialContainer)
@@ -223,12 +235,6 @@ public Stream credentialTypes(@QueryParam(TYPE) String type
.sorted(Comparator.comparing(CredentialContainer::getMetadata));
}
- private Stream getCredentialProviders() {
- return session.getKeycloakSessionFactory().getProviderFactoriesStream(CredentialProvider.class)
- .filter(f -> Types.supports(CredentialProvider.class, f, CredentialProviderFactory.class))
- .map(f -> session.getProvider(CredentialProvider.class, f.getId()));
- }
-
// Going through all authentication flows and their authentication executions to see if there is any authenticator of the corresponding
// credential type.
private Set getEnabledCredentialTypes() {
@@ -261,18 +267,25 @@ private boolean isFlowEffectivelyDisabled(AuthenticationFlowModel flow) {
return false;
}
- private void checkIfCanBeRemoved(String credentialType) {
- Set enabledCredentialTypes = getEnabledCredentialTypes();
- CredentialProvider credentialProvider = getCredentialProviders()
- .filter(p -> credentialType.equals(p.getType()) && enabledCredentialTypes.contains(p.getType()))
- .findAny().orElse(null);
- if (credentialProvider == null) {
- throw new NotFoundException("Credential provider " + credentialType + " not found");
+ private Integer getCurrentAuthenticatedLevel() {
+ ClientModel client = realm.getClientByClientId(auth.getToken().getIssuedFor());
+ Map acrLoaMap = AcrUtils.getAcrLoaMap(client);
+ String tokenAcr = auth.getToken().getAcr();
+ if (tokenAcr == null) {
+ logger.warnf("Not able to remove credential of user '%s' as no acr claim on the token", user.getUsername());
+ throw new ForbiddenException("No LoA on the token");
}
- CredentialTypeMetadataContext ctx = CredentialTypeMetadataContext.builder().user(user).build(session);
- CredentialTypeMetadata metadata = credentialProvider.getCredentialTypeMetadata(ctx);
- if (!metadata.isRemoveable()) {
- throw new BadRequestException("Credential type " + credentialType + " cannot be removed");
+ Integer currentAuthenticatedLevel = acrLoaMap.get(tokenAcr);
+ if (currentAuthenticatedLevel != null) {
+ return currentAuthenticatedLevel;
+ } else {
+ try {
+ return Integer.parseInt(tokenAcr);
+ } catch (NumberFormatException nfe) {
+ logger.warnf("Token acr '%s' not found in acrLoaMap of client '%s' or realm '%s'. Not able to remove credential of user '%s'",
+ tokenAcr, client.getClientId(), realm.getName(), user.getUsername());
+ throw new ForbiddenException("Unsupported acr on the token");
+ }
}
}
@@ -280,28 +293,23 @@ private void checkIfCanBeRemoved(String credentialType) {
* Remove a credential of current user
*
* @param credentialId ID of the credential, which will be removed
+ * @deprecated It is recommended to delete credentials with the use of "delete_credential" kc_action.
+ * Action can be used for instance by adding parameter like "kc_action=delete_credential:123" to the login URL where 123 is ID of the credential to delete.
*/
@Path("{credentialId}")
@DELETE
@NoCache
+ @Deprecated
public void removeCredential(final @PathParam("credentialId") String credentialId) {
auth.require(AccountRoles.MANAGE_ACCOUNT);
- CredentialModel credential = user.credentialManager().getStoredCredentialById(credentialId);
- if (credential == null) {
- // Backwards compatibility with account console 1 - When stored credential is not found, it may be federated credential.
- // In this case, it's ID needs to be something like "otp-id", which is returned by account REST GET endpoint as a placeholder
- // for federated credentials (See CredentialHelper.createUserStorageCredentialRepresentation )
- if (credentialId.endsWith("-id")) {
- String credentialType = credentialId.substring(0, credentialId.length() - 3);
- checkIfCanBeRemoved(credentialType);
- user.credentialManager().disableCredentialType(credentialType);
- return;
- }
+ CredentialModel credential = CredentialDeleteHelper.removeCredential(session, user, credentialId, this::getCurrentAuthenticatedLevel);
- throw new NotFoundException("Credential not found");
+ if (credential != null && OTPCredentialModel.TYPE.equals(credential.getType())) {
+ event.event(EventType.REMOVE_TOTP)
+ .detail(Details.SELECTED_CREDENTIAL_ID, credentialId)
+ .detail(Details.CREDENTIAL_USER_LABEL, credential.getUserLabel());
+ event.success();
}
- checkIfCanBeRemoved(credential.getType());
- user.credentialManager().removeStoredCredentialById(credentialId);
}
diff --git a/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java b/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java
index eb7e3a0d5c3a..a49a57fcb746 100755
--- a/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java
@@ -214,7 +214,7 @@ public SessionResource sessions() {
@Path("/credentials")
public AccountCredentialResource credentials() {
checkAccountApiEnabled();
- return new AccountCredentialResource(session, user, auth);
+ return new AccountCredentialResource(session, user, auth, event);
}
@Path("/resources")
diff --git a/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java b/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java
index aa0c211eff66..dcf796c5e68a 100644
--- a/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java
@@ -16,6 +16,7 @@
*/
package org.keycloak.services.resources.account;
+import java.io.IOException;
import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
@@ -60,6 +61,7 @@
import org.keycloak.services.managers.Auth;
import org.keycloak.services.messages.Messages;
import org.keycloak.services.validation.Validation;
+import org.keycloak.theme.Theme;
import static org.keycloak.models.Constants.ACCOUNT_CONSOLE_CLIENT_ID;
@@ -201,12 +203,12 @@ public Response removeLinkedAccount(@PathParam("providerAlias") String providerA
FederatedIdentityModel link = session.users().getFederatedIdentity(realm, user, providerAlias);
if (link == null) {
- throw ErrorResponse.error(Messages.FEDERATED_IDENTITY_NOT_ACTIVE, Response.Status.BAD_REQUEST);
+ throw ErrorResponse.error(translateErrorMessage(Messages.FEDERATED_IDENTITY_NOT_ACTIVE), Response.Status.BAD_REQUEST);
}
// Removing last social provider is not possible if you don't have other possibility to authenticate
if (!(session.users().getFederatedIdentitiesStream(realm, user).count() > 1 || user.getFederationLink() != null || isPasswordSet())) {
- throw ErrorResponse.error(Messages.FEDERATED_IDENTITY_REMOVING_LAST_PROVIDER, Response.Status.BAD_REQUEST);
+ throw ErrorResponse.error(translateErrorMessage(Messages.FEDERATED_IDENTITY_REMOVING_LAST_PROVIDER), Response.Status.BAD_REQUEST);
}
session.users().removeFederatedIdentity(realm, user, providerAlias);
@@ -239,6 +241,14 @@ private String checkCommonPreconditions(String providerAlias) {
return null;
}
+
+ private String translateErrorMessage(String errorCode) {
+ try {
+ return session.theme().getTheme(Theme.Type.ACCOUNT).getMessages(session.getContext().resolveLocale(user)).getProperty(errorCode);
+ } catch (IOException e) {
+ return errorCode;
+ }
+ }
private boolean isPasswordSet() {
return user.credentialManager().isConfiguredFor(PasswordCredentialModel.TYPE);
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java
index 86693805d381..fc1f15ee5c3b 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java
@@ -74,6 +74,7 @@ public ClientRegistrationPolicyResource(KeycloakSession session, AdminPermission
@Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_REGISTRATION_POLICY)
@Operation( summary="Base path for retrieve providers with the configProperties properly filled")
public Stream getProviders() {
+ auth.realm().requireViewRealm();
return session.getKeycloakSessionFactory().getProviderFactoriesStream(ClientRegistrationPolicy.class)
.map((ProviderFactory factory) -> {
ClientRegistrationPolicyFactory clientRegFactory = (ClientRegistrationPolicyFactory) factory;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
index 2abdfa896d9b..5cc70a3ecf42 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
@@ -30,6 +30,8 @@
import java.util.stream.Collectors;
import java.util.stream.Stream;
+import jakarta.enterprise.inject.Default;
+import jakarta.ws.rs.DefaultValue;
import org.eclipse.microprofile.openapi.annotations.Operation;
import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
@@ -625,14 +627,19 @@ public GlobalRequestResult logoutAll() {
@DELETE
@Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
@Operation( summary = "Remove a specific user session.", description = "Any client that has an admin url will also be told to invalidate this particular session.")
- public void deleteSession(@PathParam("session") String sessionId) {
+ public void deleteSession(@PathParam("session") String sessionId, @DefaultValue("false") @QueryParam("isOffline") boolean offline) {
auth.users().requireManage();
- UserSessionModel userSession = session.sessions().getUserSession(realm, sessionId);
- if (userSession == null) throw new NotFoundException("Sesssion not found");
+ UserSessionModel userSession = offline ? session.sessions().getOfflineUserSession(realm, sessionId) : session.sessions().getUserSession(realm, sessionId);
+ if (userSession == null) {
+ throw new NotFoundException("Sesssion not found");
+ }
+
AuthenticationManager.backchannelLogout(session, realm, userSession, session.getContext().getUri(), connection, headers, true);
- adminEvent.operation(OperationType.DELETE).resource(ResourceType.USER_SESSION).resourcePath(session.getContext().getUri()).success();
+ Map eventRep = new HashMap<>();
+ eventRep.put("offline", offline);
+ adminEvent.operation(OperationType.DELETE).resource(ResourceType.USER_SESSION).resourcePath(session.getContext().getUri()).representation(eventRep).success();
}
/**
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
index 2e7e035d0301..22ff3913015d 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
@@ -24,6 +24,7 @@
import org.eclipse.microprofile.openapi.annotations.tags.Tag;
import org.jboss.resteasy.reactive.NoCache;
import jakarta.ws.rs.NotFoundException;
+import org.keycloak.common.util.Encode;
import org.keycloak.events.admin.OperationType;
import org.keycloak.events.admin.ResourceType;
import org.keycloak.models.ClientModel;
@@ -202,7 +203,7 @@ public Response createRole(final RoleRepresentation rep) {
adminEvent.operation(OperationType.CREATE).resourcePath(uriInfo, role.getName()).representation(rep).success();
- return Response.created(uriInfo.getAbsolutePathBuilder().path(role.getName()).build()).build();
+ return Response.created(uriInfo.getAbsolutePathBuilder().path(Encode.encodePathSegmentAsIs(role.getName())).build()).build();
} catch (ModelDuplicateException e) {
throw ErrorResponse.exists("Role with name " + rep.getName() + " already exists");
}
diff --git a/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProvider.java b/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProvider.java
index d9edb6b207ec..65503a9fb687 100644
--- a/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProvider.java
+++ b/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProvider.java
@@ -176,13 +176,9 @@ public UserModel apply(Attributes attributes) {
protected UserProfileMetadata configureUserProfile(UserProfileMetadata metadata, KeycloakSession session) {
UserProfileContext context = metadata.getContext();
UserProfileMetadata decoratedMetadata = metadata.clone();
- RealmModel realm = session.getContext().getRealm();
-
ComponentModel component = getComponentModel().orElse(null);
if (component == null) {
- // makes sure user providers can override metadata for any attribute
- decorateUserProfileMetadataWithUserStorage(realm, decoratedMetadata);
return decoratedMetadata;
}
@@ -411,23 +407,10 @@ public boolean test(AttributeContext context) {
}
}
- if (session != null) {
- // makes sure user providers can override metadata for any attribute
- decorateUserProfileMetadataWithUserStorage(session.getContext().getRealm(), decoratedMetadata);
- }
-
return decoratedMetadata;
}
- private void decorateUserProfileMetadataWithUserStorage(RealmModel realm, UserProfileMetadata userProfileMetadata) {
- // makes sure user providers can override metadata for any attribute
- UserProvider users = session.users();
- if (users instanceof UserProfileDecorator) {
- ((UserProfileDecorator) users).decorateUserProfile(realm, userProfileMetadata);
- }
- }
-
private Map asHashMap(List groups) {
return groups.stream().collect(Collectors.toMap(g -> g.getName(), g -> g));
}
@@ -459,16 +442,18 @@ private boolean isServiceAccountUser(UserModel user) {
/**
* Get parsed config file configured in model. Default one used if not configured.
*/
- protected UPConfig getParsedConfig(String rawConfig) {
- if (!isBlank(rawConfig)) {
- try {
- return UPConfigUtils.parseConfig(rawConfig);
- } catch (IOException e) {
- throw new RuntimeException("UserProfile configuration for realm '" + session.getContext().getRealm().getName() + "' is invalid:" + e.getMessage(), e);
- }
+ protected UPConfig parseConfigOrDefault(ComponentModel component) {
+ String rawConfig = component.get(UP_COMPONENT_CONFIG_KEY);
+
+ if (isBlank(rawConfig)) {
+ return parsedDefaultRawConfig;
}
- return null;
+ try {
+ return UPConfigUtils.parseConfig(rawConfig);
+ } catch (IOException e) {
+ throw new RuntimeException("UserProfile configuration for realm '" + session.getContext().getRealm().getName() + "' is invalid:" + e.getMessage(), e);
+ }
}
/**
@@ -492,22 +477,27 @@ protected AttributeValidatorMetadata createConfiguredValidator(String validator,
}
private UPConfig getConfigFromComponentModel(ComponentModel model) {
- if (model == null)
- return null;
+ UPConfig cached = getParsedConfigFromCache(model);
- UPConfig cfg = model.getNote(PARSED_UP_CONFIG_COMPONENT_KEY);
- if (cfg != null) {
- return cfg;
+ if (cached == null) {
+ cached = parseAndCacheConfig(model);
}
- String rawConfig = model.get(UP_COMPONENT_CONFIG_KEY);
- if (rawConfig == null) {
+ return cached;
+ }
+
+ private UPConfig parseAndCacheConfig(ComponentModel model) {
+ UPConfig cfg = parseConfigOrDefault(model);
+ model.setNote(PARSED_UP_CONFIG_COMPONENT_KEY, cfg);
+ return cfg;
+ }
+
+ private UPConfig getParsedConfigFromCache(ComponentModel component) {
+ if (component == null) {
return null;
- } else {
- cfg = getParsedConfig(rawConfig);
- model.setNote(PARSED_UP_CONFIG_COMPONENT_KEY, cfg);
- return cfg;
}
+
+ return component.getNote(PARSED_UP_CONFIG_COMPONENT_KEY);
}
private void removeConfigJsonFromComponentModel(ComponentModel model) {
diff --git a/services/src/main/java/org/keycloak/userprofile/validator/DuplicateEmailValidator.java b/services/src/main/java/org/keycloak/userprofile/validator/DuplicateEmailValidator.java
index 5b8e6cab9b77..469f0404c909 100644
--- a/services/src/main/java/org/keycloak/userprofile/validator/DuplicateEmailValidator.java
+++ b/services/src/main/java/org/keycloak/userprofile/validator/DuplicateEmailValidator.java
@@ -18,6 +18,7 @@
import jakarta.ws.rs.core.Response;
import java.util.List;
+import java.util.Objects;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
@@ -62,10 +63,11 @@ public ValidationContext validate(Object input, String inputHint, ValidationCont
KeycloakSession session = context.getSession();
RealmModel realm = session.getContext().getRealm();
+ UserModel user = UserProfileAttributeValidationContext.from(context).getAttributeContext().getUser();
- if (!realm.isDuplicateEmailsAllowed()) {
+ // Only check if duplicate email addresses are not allowed, and the user is either new or changed their email address
+ if (!realm.isDuplicateEmailsAllowed() && (user == null || !Objects.equals(user.getFirstAttribute(inputHint), value))) {
UserModel userByEmail = session.users().getUserByEmail(realm, value);
- UserModel user = UserProfileAttributeValidationContext.from(context).getAttributeContext().getUser();
// check for duplicated email
if (userByEmail != null && (user == null || !userByEmail.getId().equals(user.getId()))) {
context.addError(new ValidationError(ID, inputHint, Messages.EMAIL_EXISTS)
diff --git a/services/src/main/java/org/keycloak/validation/DefaultClientValidationProvider.java b/services/src/main/java/org/keycloak/validation/DefaultClientValidationProvider.java
index b2202e2ed781..954da121e7b1 100644
--- a/services/src/main/java/org/keycloak/validation/DefaultClientValidationProvider.java
+++ b/services/src/main/java/org/keycloak/validation/DefaultClientValidationProvider.java
@@ -27,6 +27,7 @@
import org.keycloak.protocol.oidc.utils.PairwiseSubMapperUtils;
import org.keycloak.protocol.oidc.utils.PairwiseSubMapperValidator;
import org.keycloak.protocol.oidc.utils.SubjectType;
+import org.keycloak.protocol.saml.SamlProtocol;
import org.keycloak.representations.idm.ProtocolMapperRepresentation;
import org.keycloak.representations.oidc.OIDCClientRepresentation;
import org.keycloak.services.util.ResolveRelative;
@@ -76,7 +77,52 @@ private enum FieldMessages {
TOS_URI(ClientModel.TOS_URI,
"Terms of service URL is not a valid URL", "tosURLInvalid",
null, null,
- "Terms of service URL uses an illegal scheme", "tosURLIllegalSchemeError");
+ "Terms of service URL uses an illegal scheme", "tosURLIllegalSchemeError"),
+
+ ADMIN_URL("masterSamlProcessingUrl",
+ "Master SAML Processing URL is not a valid URL", "adminUrlURLInvalid",
+ null, null,
+ "Master SAML Processing URL uses an illegal scheme", "adminUrlURLIllegalSchemeError"),
+
+ SAML_ASSERTION_CONSUMER_URL_POST_URI(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE,
+ "Assertion Consumer Service POST Binding URL is not a valid URL", "samlAssertionConsumerUrlPostURLInvalid",
+ null, null,
+ "Assertion Consumer Service POST Binding URL uses an illegal scheme", "samlAssertionConsumerUrlPostURLIllegalSchemeError"),
+
+ SAML_ASSERTION_CONSUMER_URL_REDIRECT_URI(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE,
+ "Assertion Consumer Service Redirect Binding URL is not a valid URL", "samlAssertionConsumerUrlRedirectURLInvalid",
+ null, null,
+ "Assertion Consumer Service Redirect Binding URL uses an illegal scheme", "samlAssertionConsumerUrlRedirectURLIllegalSchemeError"),
+
+ SAML_ASSERTION_CONSUMER_URL_ARTIFACT_URI(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_ARTIFACT_ATTRIBUTE,
+ "Artifact Binding URL is not a valid URL", "samlAssertionConsumerUrlArtifactURLInvalid",
+ null, null,
+ "Artifact Binding URL uses an illegal scheme", "samlAssertionConsumerUrlArtifactURLIllegalSchemeError"),
+
+ SAML_SINGLE_LOGOUT_SERVICE_URL_POST_URI(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE,
+ "Logout Service POST Binding URL is not a valid URL", "samlLogoutServiceUrlPostURLInvalid",
+ null, null,
+ "Logout Service POST Binding URL uses an illegal scheme", "samlLogoutServiceUrlPostURLIllegalSchemeError"),
+
+ SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_URI(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE,
+ "Logout Service ARTIFACT Binding URL is not a valid URL", "samlLogoutServiceUrlArtifactURLInvalid",
+ null, null,
+ "Logout Service ARTIFACT Binding URL uses an illegal scheme", "samlLogoutServiceUrlArtifactURLIllegalSchemeError"),
+
+ SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_URI(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE,
+ "Logout Service Redirect Binding URL is not a valid URL", "samlLogoutServiceUrlRedirectURLInvalid",
+ null, null,
+ "Logout Service Redirect Binding URL uses an illegal scheme", "samlLogoutServiceUrlRedirectURLIllegalSchemeError"),
+
+ SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_URI(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE,
+ "Logout Service SOAP Binding URL is not a valid URL", "samlLogoutServiceUrlSoapURLInvalid",
+ null, null,
+ "Logout Service SOAP Binding URL uses an illegal scheme", "samlAssertionConsumerUrlPostURLIllegalSchemeError"),
+
+ SAML_ARTIFACT_RESOLUTION_SERVICE_URL_URI(SamlProtocol.SAML_ARTIFACT_RESOLUTION_SERVICE_URL_ATTRIBUTE,
+ "Artifact Resolution Service is not a valid URL", "samlAssertionConsumerUrlPostURLInvalid",
+ null, null,
+ "Artifact Resolution Service uses an illegal scheme", "samlAssertionConsumerUrlPostURLIllegalSchemeError");
private String fieldId;
@@ -174,6 +220,19 @@ private void validateUrls(ValidationContext context) {
checkUriLogo(FieldMessages.LOGO_URI, client.getAttribute(ClientModel.LOGO_URI), context);
checkUri(FieldMessages.POLICY_URI, client.getAttribute(ClientModel.POLICY_URI), context, true, false);
checkUri(FieldMessages.TOS_URI, client.getAttribute(ClientModel.TOS_URI), context, true, false);
+
+ // extra validation URLs for SAML clients
+ if (SamlProtocol.LOGIN_PROTOCOL.equals(client.getProtocol())) {
+ checkUri(FieldMessages.ADMIN_URL, client.getManagementUrl(), context, true, false);
+ checkUri(FieldMessages.SAML_ASSERTION_CONSUMER_URL_POST_URI, client.getAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_ASSERTION_CONSUMER_URL_REDIRECT_URI, client.getAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_ASSERTION_CONSUMER_URL_ARTIFACT_URI, client.getAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_ARTIFACT_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_URI, client.getAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_URI, client.getAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_URI, client.getAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_URI, client.getAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE), context, true, false);
+ checkUri(FieldMessages.SAML_ARTIFACT_RESOLUTION_SERVICE_URL_URI, client.getAttribute(SamlProtocol.SAML_ARTIFACT_RESOLUTION_SERVICE_URL_ATTRIBUTE), context, true, false);
+ }
}
private void checkUri(FieldMessages field, String url, ValidationContext context, boolean checkValidUrl, boolean checkFragment) {
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory b/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
index ac3961633aa5..fb61a458049b 100755
--- a/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
@@ -24,6 +24,7 @@ org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory
org.keycloak.authentication.requiredactions.WebAuthnPasswordlessRegisterFactory
org.keycloak.authentication.requiredactions.UpdateUserLocaleAction
org.keycloak.authentication.requiredactions.DeleteAccount
+org.keycloak.authentication.requiredactions.DeleteCredentialAction
org.keycloak.authentication.requiredactions.VerifyUserProfile
org.keycloak.authentication.requiredactions.RecoveryAuthnCodesAction
org.keycloak.authentication.requiredactions.UpdateEmail
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.ProtocolMapper b/services/src/main/resources/META-INF/services/org.keycloak.protocol.ProtocolMapper
index 544200a95b0a..6508d71ae91f 100755
--- a/services/src/main/resources/META-INF/services/org.keycloak.protocol.ProtocolMapper
+++ b/services/src/main/resources/META-INF/services/org.keycloak.protocol.ProtocolMapper
@@ -45,4 +45,5 @@ org.keycloak.protocol.saml.mappers.SAMLAudienceProtocolMapper
org.keycloak.protocol.saml.mappers.SAMLAudienceResolveProtocolMapper
org.keycloak.protocol.oidc.mappers.ClaimsParameterTokenMapper
org.keycloak.protocol.saml.mappers.UserAttributeNameIdMapper
-org.keycloak.protocol.oidc.mappers.ClaimsParameterWithValueIdTokenMapper
\ No newline at end of file
+org.keycloak.protocol.oidc.mappers.ClaimsParameterWithValueIdTokenMapper
+org.keycloak.protocol.oidc.mappers.SessionStateMapper
\ No newline at end of file
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory
index 0b5e3cffdece..9a9312fdeb7c 100644
--- a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory
@@ -5,4 +5,5 @@ org.keycloak.services.clientpolicy.condition.ClientAccessTypeConditionFactory
org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceHostsConditionFactory
org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceGroupsConditionFactory
org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceRolesConditionFactory
-org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory
\ No newline at end of file
+org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory
+org.keycloak.services.clientpolicy.condition.ClientIdsConditionFactory
\ No newline at end of file
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory
index 4f0320c276b7..370e888c94b8 100644
--- a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory
@@ -13,6 +13,7 @@ org.keycloak.services.clientpolicy.executor.FullScopeDisabledExecutorFactory
org.keycloak.protocol.oidc.grants.ciba.clientpolicy.executor.SecureCibaSessionEnforceExecutorFactory
org.keycloak.protocol.oidc.grants.ciba.clientpolicy.executor.SecureCibaSignedAuthenticationRequestExecutorFactory
org.keycloak.protocol.oidc.grants.ciba.clientpolicy.executor.SecureCibaAuthenticationRequestSigningAlgorithmExecutorFactory
+org.keycloak.services.clientpolicy.executor.RegexRedirectUriExecutorFactory
org.keycloak.services.clientpolicy.executor.SecureLogoutExecutorFactory
org.keycloak.services.clientpolicy.executor.RejectResourceOwnerPasswordCredentialsGrantExecutorFactory
org.keycloak.services.clientpolicy.executor.ClientSecretRotationExecutorFactory
diff --git a/services/src/main/resources/org/keycloak/protocol/oidc/endpoints/login-status-iframe.html b/services/src/main/resources/org/keycloak/protocol/oidc/endpoints/login-status-iframe.html
index ee640cffa0fa..73ac4bc95355 100755
--- a/services/src/main/resources/org/keycloak/protocol/oidc/endpoints/login-status-iframe.html
+++ b/services/src/main/resources/org/keycloak/protocol/oidc/endpoints/login-status-iframe.html
@@ -28,6 +28,7 @@
}
let init;
+ let preventAdditionalRequests = false;
async function checkState(clientId, origin, sessionState) {
// Check if the browser has granted us access to 3rd-party storage (such as cookies).
@@ -41,6 +42,13 @@
// If not initialized, verify this client is allowed access with a call to the server.
if (!init) {
+ // Prevent additional requests to the server to avoid potential DoS attacks.
+ if (preventAdditionalRequests) {
+ return "error";
+ } else {
+ preventAdditionalRequests = true;
+ }
+
const url = new URL(`${location.origin}${location.pathname}/init`);
url.searchParams.set("client_id", clientId);
diff --git a/services/src/test/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParserTest.java b/services/src/test/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParserTest.java
new file mode 100644
index 000000000000..bdd90cf781d5
--- /dev/null
+++ b/services/src/test/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestParserTest.java
@@ -0,0 +1,89 @@
+package org.keycloak.protocol.oidc.endpoints.request;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.models.KeycloakContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+public class AuthzEndpointRequestParserTest {
+
+ @Mock
+ KeycloakSession keycloakSession;
+
+ @Mock
+ RealmModel realmModel;
+
+ @Mock
+ KeycloakContext keycloakContext;
+
+ @Before
+ public void setUp() throws Exception {
+ MockitoAnnotations.initMocks(this);
+ Mockito.lenient().when(keycloakSession.getContext()).thenReturn(keycloakContext);
+ Mockito.lenient().when(keycloakContext.getRealm()).thenReturn(realmModel);
+ Mockito.lenient().when(realmModel.getAttribute("additionalReqParamsMaxNumber", 10)).thenReturn(10);
+ Mockito.lenient().when(realmModel.getAttribute("additionalReqParamsMaxSize", 2000)).thenReturn(2000);
+ Mockito.lenient().when(realmModel.getAttribute("additionalReqParamsFailFast", false)).thenReturn(false);
+ Mockito.lenient().when(realmModel.getAttribute("additionalReqParamsMaxOverallSize", Integer.MAX_VALUE)).thenReturn(Integer.MAX_VALUE);
+ }
+
+ @Test
+ public void testExtractAdditionalReqParams() {
+
+ TestAuthzEndpointRequestParser test = new TestAuthzEndpointRequestParser(keycloakSession);
+
+ Map additionalReqParams = new HashMap<>();
+
+ test.extractAdditionalReqParams(additionalReqParams);
+
+ assertNotNull(additionalReqParams);
+ assertEquals(1, additionalReqParams.size());
+ assertTrue(additionalReqParams.containsKey("hash"));
+
+ }
+
+
+ private class TestAuthzEndpointRequestParser extends AuthzEndpointRequestParser {
+
+ protected TestAuthzEndpointRequestParser(KeycloakSession keycloakSession) {
+ super(keycloakSession);
+ }
+
+ @Override
+ protected String getParameter(String paramName) {
+ return "VER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM%2CVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaMVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM%2CVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaMVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM%2CVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaMVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM%2CVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaMVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM%2CVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaMVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM%2CVER2CFYJFMliVLAFlYUUE9Vj4FkbIhHq1Ufe_VnWcsY%2C7P2xRG3WGTXogxuhXOfIrZsfL8lrnCE-G7E95chcwBw%2C9ba29mAU6sK4O9cBk22sGe9bK0Y5ilNycVVx0yij5SM%2Cw6HfN_o5gO7s39azUBWTyCBQiEbbihAGddwr9eUteFA%2CjYYPTQT4nz79AYMNOM67TcnDABQXOMWK0yJ_91EXwaM";
+ }
+
+ @Override
+ protected Integer getIntParameter(String paramName) {
+ return 10;
+ }
+
+ @Override
+ protected Set keySet() {
+
+ Set parameterSet = new HashSet<>();
+ parameterSet.add("hash");
+ parameterSet.add("customParameter1");
+ parameterSet.add("customParameter2");
+ parameterSet.add("client_id");
+
+ return parameterSet;
+ }
+ }
+
+
+}
diff --git a/services/src/test/java/org/keycloak/protocol/oidc/utils/RedirectUtilsTest.java b/services/src/test/java/org/keycloak/protocol/oidc/utils/RedirectUtilsTest.java
index 814d29920690..fcc501934d3c 100644
--- a/services/src/test/java/org/keycloak/protocol/oidc/utils/RedirectUtilsTest.java
+++ b/services/src/test/java/org/keycloak/protocol/oidc/utils/RedirectUtilsTest.java
@@ -87,6 +87,8 @@ public void testverifyRedirectUriMixedSchemes() {
Assert.assertEquals("custom1:/parent/child", RedirectUtils.verifyRedirectUri(session, null, "custom1:/parent/child", set, false));
Assert.assertEquals("custom2:/something", RedirectUtils.verifyRedirectUri(session, null, "custom2:/something", set, false));
Assert.assertEquals("https://keycloak.org/test", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test", set, false));
+ Assert.assertEquals("https://keycloak.org/", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/", set, false));
+ Assert.assertEquals("https://keycloak.org", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "custom1:/test", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "custom1:/test1/test", set, false));
@@ -172,6 +174,8 @@ public void testRelativeRedirectUri() {
Assert.assertEquals("https://keycloak.org/path", RedirectUtils.verifyRedirectUri(session, "https://keycloak.org", "/path", set, false));
Assert.assertEquals("https://keycloak.org/path", RedirectUtils.verifyRedirectUri(session, "https://keycloak.org", "path", set, false));
+ Assert.assertEquals("https://keycloak.org/test/../other", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/../other", set, false));
+ Assert.assertEquals("http://keycloak.org/test%2Fother", RedirectUtils.verifyRedirectUri(session, null, "http://keycloak.org/test%2Fother", set, false));
}
@Test
@@ -184,8 +188,6 @@ public void testUserInfo() {
Assert.assertEquals("https://keycloak.org/index.html", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/index.html", set, false));
Assert.assertEquals("https://test.com/index.html", RedirectUtils.verifyRedirectUri(session, null, "https://test.com/index.html", set, false));
- Assert.assertEquals("https://something@keycloak.org/path", RedirectUtils.verifyRedirectUri(session, null, "https://something@keycloak.org/path", set, false));
- Assert.assertEquals("https://some%20thing@test.com/path", RedirectUtils.verifyRedirectUri(session, null, "https://some%20thing@test.com/path", set, false));
Assert.assertEquals("https://something@keycloak.com/exact", RedirectUtils.verifyRedirectUri(session, null, "https://something@keycloak.com/exact", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://something@other.com/", set, false));
@@ -193,12 +195,15 @@ public void testUserInfo() {
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org%2F@other.com", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://test@other.com", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://test.com@other.com", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://something@keycloak.org/path", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://some%20thing@test.com/path", set, false));
}
@Test
public void testEncodedRedirectUri() {
Set set = Stream.of(
- "https://keycloak.org/test/*"
+ "https://keycloak.org/test/*",
+ "https://keycloak.org/exact/%5C%2F/.."
).collect(Collectors.toSet());
Assert.assertEquals("https://keycloak.org/test/index.html", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/index.html", set, false));
@@ -206,16 +211,30 @@ public void testEncodedRedirectUri() {
Assert.assertEquals("https://keycloak.org/test?encodeTest=a%3Cb#encode2=a%3Cb", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test?encodeTest=a%3Cb#encode2=a%3Cb", set, false));
Assert.assertEquals("https://keycloak.org/test/#encode2=a%3Cb", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/#encode2=a%3Cb", set, false));
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/../", set, false)); // direct
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2E%2E/", set, false)); // encoded
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test%2F%2E%2E%2F", set, false)); // encoded
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%252E%252E/", set, false)); // double-encoded
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%252E%252E/?some_query_param=some_value", set, false)); // double-encoded
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%252E%252E/#encodeTest=a%3Cb", set, false)); // double-encoded
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%25252E%25252E/", set, false)); // triple-encoded
- Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2525252525252E%2525252525252E/", set, false)); // seventh-encoded
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/../", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test\\..\\", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2E%2E/", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2e%2e/", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2E./", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2E.", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test\\%2E.", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test%2f%2E%2e%2F", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test%5C%2E.%5c", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test%5C..", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2F%2E%2E%2Fdocumentation", set, false));
+ Assert.assertEquals("https://keycloak.org/test/.../", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/.../", set, false));
+ Assert.assertEquals("https://keycloak.org/test/%2E../", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%2E../", set, false)); // encoded
+ Assert.assertEquals("https://keycloak.org/test/some%2Fthing/", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/some%2Fthing/", set, false)); // encoded
+ Assert.assertEquals("https://keycloak.org/test/./", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/./", set, false));
+ Assert.assertEquals("https://keycloak.org/test/%252E%252E/", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%252E%252E/", set, false)); // double-encoded
+ Assert.assertEquals("https://keycloak.org/test/%252E%252E/#encodeTest=a%3Cb", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%252E%252E/#encodeTest=a%3Cb", set, false)); // double-encoded
+ Assert.assertEquals("https://keycloak.org/test/%25252E%25252E/", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test/%25252E%25252E/", set, false)); // triple-encoded
+ Assert.assertEquals("https://keycloak.org/exact/%5C%2F/..", RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/exact/%5C%2F/..", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak%2Eorg/test/", set, false));
Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org%2Ftest%2F%40sample.com", set, false));
+
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test%2Fanother/../any/path/", set, false));
+ Assert.assertNull(RedirectUtils.verifyRedirectUri(session, null, "https://keycloak.org/test%2Fanother/%2E%2E/any/path/", set, false));
}
}
diff --git a/services/src/test/java/org/keycloak/services/clientregistration/policies/impl/HostsTest.java b/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/HostsTest.java
similarity index 97%
rename from services/src/test/java/org/keycloak/services/clientregistration/policies/impl/HostsTest.java
rename to services/src/test/java/org/keycloak/services/clientregistration/policy/impl/HostsTest.java
index 5ca4407f6b96..98699f7a3bfa 100644
--- a/services/src/test/java/org/keycloak/services/clientregistration/policies/impl/HostsTest.java
+++ b/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/HostsTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.keycloak.services.clientregistration.policies.impl;
+package org.keycloak.services.clientregistration.policy.impl;
import java.net.InetAddress;
diff --git a/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java b/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java
new file mode 100644
index 000000000000..9c444137aba0
--- /dev/null
+++ b/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.clientregistration.policy.impl;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.keycloak.common.Profile;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.crypto.CryptoProvider;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.DefaultKeycloakSession;
+import org.keycloak.services.DefaultKeycloakSessionFactory;
+import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyException;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class TrustedHostClientRegistrationPolicyTest {
+
+ private static KeycloakSession session;
+
+ @BeforeClass
+ public static void beforeClass() {
+ Profile.defaults();
+ CryptoIntegration.init(CryptoProvider.class.getClassLoader());
+ DefaultKeycloakSessionFactory sessionFactory = new DefaultKeycloakSessionFactory();
+ sessionFactory.init();
+ session = new DefaultKeycloakSession(sessionFactory);
+ }
+
+ @Test
+ public void testLocalhostName() {
+ TrustedHostClientRegistrationPolicyFactory factory = new TrustedHostClientRegistrationPolicyFactory();
+ ComponentModel model = createComponentModel("localhost");
+ TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
+
+ policy.verifyHost("127.0.0.1");
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.verifyHost("10.0.0.1"));
+ policy.checkURLTrusted("https://localhost", policy.getTrustedHosts(), policy.getTrustedDomains());
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://otherhost",
+ policy.getTrustedHosts(), policy.getTrustedDomains()));
+ }
+
+ @Test
+ public void testLocalhostDomain() {
+ TrustedHostClientRegistrationPolicyFactory factory = new TrustedHostClientRegistrationPolicyFactory();
+ ComponentModel model = createComponentModel("*.localhost");
+ TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
+
+ policy.verifyHost("127.0.0.1");
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.verifyHost("10.0.0.1"));
+ policy.checkURLTrusted("https://localhost", policy.getTrustedHosts(), policy.getTrustedDomains());
+ policy.checkURLTrusted("https://other.localhost", policy.getTrustedHosts(), policy.getTrustedDomains());
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://otherlocalhost",
+ policy.getTrustedHosts(), policy.getTrustedDomains()));
+ }
+
+ @Test
+ public void testLocalhostIP() {
+ TrustedHostClientRegistrationPolicyFactory factory = new TrustedHostClientRegistrationPolicyFactory();
+ ComponentModel model = createComponentModel("127.0.0.1");
+ TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
+
+ policy.verifyHost("127.0.0.1");
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.verifyHost("10.0.0.1"));
+ policy.checkURLTrusted("https://127.0.0.1", policy.getTrustedHosts(), policy.getTrustedDomains());
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://localhost",
+ policy.getTrustedHosts(), policy.getTrustedDomains()));
+ }
+
+ @Test
+ public void testGoogleCrawlBot() {
+ // https://developers.google.com/search/blog/2006/09/how-to-verify-googlebot
+ TrustedHostClientRegistrationPolicyFactory factory = new TrustedHostClientRegistrationPolicyFactory();
+ ComponentModel model = createComponentModel("*.googlebot.com");
+ TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
+
+ policy.verifyHost("66.249.66.1");
+ policy.checkURLTrusted("https://www.googlebot.com", policy.getTrustedHosts(), policy.getTrustedDomains());
+ policy.checkURLTrusted("https://googlebot.com", policy.getTrustedHosts(), policy.getTrustedDomains());
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://www.othergooglebot.com",
+ policy.getTrustedHosts(), policy.getTrustedDomains()));
+ }
+
+ @Test
+ public void testGithubDomain() throws UnknownHostException {
+ TrustedHostClientRegistrationPolicyFactory factory = new TrustedHostClientRegistrationPolicyFactory();
+ ComponentModel model = createComponentModel("*.github.com");
+ TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
+
+ policy.verifyHost(InetAddress.getByName("www.github.com").getHostAddress());
+ policy.verifyHost(InetAddress.getByName("github.com").getHostAddress());
+ policy.checkURLTrusted("https://www.github.com", policy.getTrustedHosts(), policy.getTrustedDomains());
+ policy.checkURLTrusted("https://github.com", policy.getTrustedHosts(), policy.getTrustedDomains());
+ Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://othergithub.com",
+ policy.getTrustedHosts(), policy.getTrustedDomains()));
+ }
+
+ private ComponentModel createComponentModel(String... hosts) {
+ ComponentModel model = new ComponentModel();
+ model.put(TrustedHostClientRegistrationPolicyFactory.HOST_SENDING_REGISTRATION_REQUEST_MUST_MATCH, "true");
+ model.put(TrustedHostClientRegistrationPolicyFactory.CLIENT_URIS_MUST_MATCH, "true");
+ model.getConfig().addAll(TrustedHostClientRegistrationPolicyFactory.TRUSTED_HOSTS, hosts);
+ return model;
+ }
+}
diff --git a/set-version.sh b/set-version.sh
index 21886a202163..28443058ed1b 100755
--- a/set-version.sh
+++ b/set-version.sh
@@ -33,3 +33,14 @@ echo "$(jq '. += {"version": "'$NEW_NPM_VERSION'"}' js/libs/keycloak-admin-clien
echo "New Mvn Version: $NEW_VERSION" >&2
echo "New NPM Version: $NEW_NPM_VERSION" >&2
+
+# js-ci.yml remove 999
+sed -i -E 's/keycloak-[0-9]+\.[0-9]+\.[0-9]+(-PS-[0-9]+){0,1}(-SNAPSHOT){0,1}\.tar.gz/keycloak-'$NEW_VERSION'.tar.gz/g' .github/workflows/js-ci.yml
+sed -i -E 's/keycloak-[0-9]+\.[0-9]+\.[0-9]+(-PS-[0-9]+){0,1}(-SNAPSHOT){0,1}/keycloak-'$NEW_VERSION'/g' .github/workflows/js-ci.yml
+
+
+cat < release-details
+VERSION=$NEW_VERSION
+SHORT_VERSION=$NEW_VERSION
+NPM_VERSION=$NEW_VERSION
+EOT
diff --git a/testsuite/db-allocator-plugin/pom.xml b/testsuite/db-allocator-plugin/pom.xml
index c82daf8462b7..626960aa01ed 100644
--- a/testsuite/db-allocator-plugin/pom.xml
+++ b/testsuite/db-allocator-plugin/pom.xml
@@ -22,7 +22,7 @@
keycloak-testsuite-pom
org.keycloak
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml
index 3ec43f7bb981..c0e5fca2365e 100644
--- a/testsuite/integration-arquillian/pom.xml
+++ b/testsuite/integration-arquillian/pom.xml
@@ -22,7 +22,7 @@
org.keycloak
keycloak-testsuite-pom
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
../pom.xml
@@ -85,6 +85,13 @@
+
+ org.keycloak
+ keycloak-parent
+ ${project.version}
+ pom
+ import
+
@@ -229,6 +236,14 @@
com.google.guava
guava
+
+ org.slf4j
+ slf4j-api
+
+
+ org.slf4j
+ slf4j-log4j12
+
diff --git a/testsuite/integration-arquillian/servers/adapter-spi/pom.xml b/testsuite/integration-arquillian/servers/adapter-spi/pom.xml
index 7f641d873404..7a2b57bc8c77 100644
--- a/testsuite/integration-arquillian/servers/adapter-spi/pom.xml
+++ b/testsuite/integration-arquillian/servers/adapter-spi/pom.xml
@@ -5,7 +5,7 @@
integration-arquillian-servers
org.keycloak.testsuite
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
pom
diff --git a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml
index 7539a2caf5a0..bc4674f6d5eb 100644
--- a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml
+++ b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml
@@ -5,7 +5,7 @@
integration-arquillian-servers-adapter-spi
org.keycloak.testsuite
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
../pom.xml
4.0.0
diff --git a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-saml-jakarta/pom.xml b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-saml-jakarta/pom.xml
index 27455823417e..df7683a7ac40 100644
--- a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-saml-jakarta/pom.xml
+++ b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-saml-jakarta/pom.xml
@@ -5,7 +5,7 @@
integration-arquillian-servers-adapter-spi
org.keycloak.testsuite
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
../pom.xml
4.0.0
diff --git a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-spi-jakarta/pom.xml b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-spi-jakarta/pom.xml
index 3fe965d90478..43233b630a2c 100644
--- a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-spi-jakarta/pom.xml
+++ b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-spi-jakarta/pom.xml
@@ -5,7 +5,7 @@
integration-arquillian-servers-adapter-spi
org.keycloak.testsuite
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
../pom.xml
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml b/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml
index a00eae01d9ec..0c3d6650383b 100644
--- a/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/eap/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/eap/pom.xml
index 34afca828528..10982bc6f9b7 100644
--- a/testsuite/integration-arquillian/servers/app-server/jboss/eap/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jboss/eap/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-jboss
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/eap6/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/eap6/pom.xml
index e5bbcdd78b13..79272ae46869 100644
--- a/testsuite/integration-arquillian/servers/app-server/jboss/eap6/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jboss/eap6/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-jboss
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml
index 50ab5e2be1b6..f9cf3748c864 100644
--- a/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml
@@ -5,7 +5,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-jboss
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml
index 30fa7cb29d50..a996a6eadd12 100644
--- a/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml
@@ -22,7 +22,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml
index 4932980a169d..954601335b26 100644
--- a/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-jboss
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jetty/94/pom.xml b/testsuite/integration-arquillian/servers/app-server/jetty/94/pom.xml
index 14fc2f005fa7..3a0daafbc2de 100644
--- a/testsuite/integration-arquillian/servers/app-server/jetty/94/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jetty/94/pom.xml
@@ -18,7 +18,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-jetty
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jetty/common/pom.xml b/testsuite/integration-arquillian/servers/app-server/jetty/common/pom.xml
index ffb12cebace8..b10a9c9d0f17 100644
--- a/testsuite/integration-arquillian/servers/app-server/jetty/common/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jetty/common/pom.xml
@@ -18,7 +18,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-jetty
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/jetty/pom.xml b/testsuite/integration-arquillian/servers/app-server/jetty/pom.xml
index 1c938b754ea7..a43cf381e473 100644
--- a/testsuite/integration-arquillian/servers/app-server/jetty/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/jetty/pom.xml
@@ -18,7 +18,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/karaf/fuse63/pom.xml b/testsuite/integration-arquillian/servers/app-server/karaf/fuse63/pom.xml
index b57b22e505b3..df360634a3dc 100644
--- a/testsuite/integration-arquillian/servers/app-server/karaf/fuse63/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/karaf/fuse63/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-karaf
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/pom.xml b/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/pom.xml
index 7b2e45786b9e..7a0e3517415c 100644
--- a/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server-karaf
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
diff --git a/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/src/main/resources/product-portal-keycloak.json b/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/src/main/resources/product-portal-keycloak.json
new file mode 100644
index 000000000000..0a28d8c5c4d2
--- /dev/null
+++ b/testsuite/integration-arquillian/servers/app-server/karaf/fuse7x/src/main/resources/product-portal-keycloak.json
@@ -0,0 +1,10 @@
+
+{
+ "realm": "demo",
+ "resource": "product-portal",
+ "auth-server-url": "http://localhost:8080/auth",
+ "ssl-required" : "external",
+ "credentials": {
+ "secret": "password"
+ }
+}
\ No newline at end of file
diff --git a/testsuite/integration-arquillian/servers/app-server/karaf/pom.xml b/testsuite/integration-arquillian/servers/app-server/karaf/pom.xml
index fc156da61e25..0c843bb73220 100644
--- a/testsuite/integration-arquillian/servers/app-server/karaf/pom.xml
+++ b/testsuite/integration-arquillian/servers/app-server/karaf/pom.xml
@@ -21,7 +21,7 @@
org.keycloak.testsuite
integration-arquillian-servers-app-server
- 999.0.0-SNAPSHOT
+ 24.0.5-PS-2
4.0.0
@@ -119,6 +119,7 @@
keycloak-direct-access.json
keycloak-hawtio-client.json
keycloak-hawtio.json
+ product-portal-keycloak.json