webapp/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-10-23 19:29:23 +03:00
Code Activity
32,645 Commits 39 Branches 324 Tags
main
Commit Graph

259 Commits

Author SHA1 Message Date
Martin Kanis
e61e1e4e02 Deleted required client scope is removed from mixed client-scope policies 
Closes #51248

Signed-off-by: Martin Kanis <mkanis@ibm.com>
 2026-10-19 09:21:04 -03:00
Ayush0612005
48e9b6e66c Treat blank repeat fields as unset in time-based policies 
The admin console persists empty strings for unused repeat fields of a
time policy (month, dayMonth, hour, ...). TimePolicyProvider only checked
these values for null before parsing them, so evaluating any permission
that referenced such a policy failed with a NumberFormatException.

Blank or whitespace-only start values are now ignored, and a blank end
value falls back to an exact match on the start value, consistent with
the existing nbf/noa handling.

Closes #53456

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Ayush0612005 <ayushkulshreshtha37@gmail.com>
 2026-10-06 10:11:29 -03:00
Ruchika Jha
08f960d0dd Format string mismatches in logging statements causing silent argument loss and potential MissingFormatArgumentException 
Closes #53069

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-09-24 17:39:52 +02:00
Anass
d92b9afb84 Make sure group claims referencing a name match only top-level groups 
Resolve name-only claims to top-level realm groups and compare their IDs with the groups allowed by the policy. Fall back to full-path matching only when no top-level group has that name.

Closes #51865

Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
Signed-off-by: Anass <86372144+4nass@users.noreply.github.com>
 2026-08-26 13:40:14 -03:00
Martin Bartoš
ddeeb2524d Introduce dedicated delegation permission for token exchange delegation (#51520) 
* Introduce dedicated delegation permission for token exchange delegation

Closes #51481

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Remove ClientModel from the interface signature, remove feature barrier

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Add lost logic for the client context

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
 2026-08-19 13:37:15 +02:00
Pedro Igor
1e832c8f60 Updating aggregate policies to take logic and unsupported policy types when using FGAP 
Closes #51143

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-08-03 14:56:49 -03:00
Pedro Igor
276077e8b3 Skip policies that do not apply to a group being evaluated based on the extendedChildren config 
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-08-03 14:56:49 -03:00
vramik
6618500c50 Partial evaluation misses ancestor group policies with extendChildren 
Closes #51144

Signed-off-by: vramik <vramik@redhat.com>
 2026-08-03 14:56:49 -03:00
Stefan Guilhen
3bf2eabe45 Reject indefinite-length encoding in ASN1Decoder.readLength() 
Closes #49495

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-06-03 14:39:21 -03:00
Alex Szczuczko
d673624b7a Also deploy keycloak-authz-client-tests when deploy-testsuite profile is active 
Closes #47737

Signed-off-by: Alex Szczuczko <aszczucz@redhat.com>
 2026-04-08 17:17:13 +02:00
Ryan Emerson
00c0dee3c4 Display Javascript policy description and code in admin UI 
Closes #47452

Signed-off-by: Ryan Emerson <remerson@ibm.com>
 2026-04-02 12:37:56 -03:00
Pedro Igor
14a3bc00ad Stricter access control for managing permission tickets 
Closes #46723

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-03-08 12:45:34 +01:00
vramik
f8246504c4 AuthorizationServices should prevent org group ids for group policies 
Closes #46050

Signed-off-by: vramik <vramik@redhat.com>
 2026-02-06 08:12:25 -03:00
Pedro Igor
b9243a7270 Only enable JS policies if the scripts feature is enabled 
Closes #44132

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-01-28 12:28:32 +01:00
Pedro Igor
ab351170b4 Support aggregated policies during partial evaluation 
Closes #45324

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2026-01-15 15:20:52 +01:00
Pedro Igor
89a8cddfd6 Make sure group permissions on view scope are not processed when querying users 
Closes #44329

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: vramik <vramik@redhat.com>
 2025-12-08 14:39:40 +01:00
Stian Thorgersen
a2c1055f8d Proposed import order (#43432) 
* Add importOrder to Spotless

Closes #43235

Signed-off-by: stianst <stianst@gmail.com>

* Re-order imports with Spotless

Signed-off-by: stianst <stianst@gmail.com>

---------

Signed-off-by: stianst <stianst@gmail.com>
 2025-11-14 09:34:49 +01:00
stianst
aedd7fe5db Remove unused imports as part of #43233 
Signed-off-by: stianst <stianst@gmail.com>
 2025-10-13 13:32:01 +02:00
Peter Skopek
1ad2444945 Add missing javadocs to published artifacts to allow Maven Central Portal Publisher pass validation process. 
Signed-off-by: Peter Skopek <pskopek@redhat.com>
 2025-08-12 16:50:17 +02:00
Peter Skopek
651d651c30 Add missing artifact descriptions to allow Maven Central Portal Publisher pass validation process. (#40822) 
Signed-off-by: Peter Skopek <pskopek@redhat.com>
 2025-08-12 16:50:17 +02:00
Pedro Igor
43a7b27301 Resolve roles inherited from groups and composite roles 
Closes #39850

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2025-05-26 14:15:06 -03:00
Pedro Igor
7aab9fade8 Move FGAP types to a specific package 
Closes #39712

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2025-05-22 09:53:16 -03:00
Pedro Igor
ae88d7921f Improvements to partial evaluation 
Closes #38732

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2025-04-09 18:15:28 +02:00
Pedro Igor
a4000575a4 Initial support for partial evaluation 
Closes #38085

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2025-03-19 13:30:52 -03:00
Garth
e0806c6284 Add a null check to ClientModels loaded by ID from ClientPolicyRepresentation. 
Closes #37673

Signed-off-by: Garth <244253+xgp@users.noreply.github.com>
 2025-03-07 10:48:07 -03:00
Alexander Schwartz
a357589c14 Apply a heuristic to look up by the role by ID or name 
Closes #36919

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
 2025-02-03 18:12:41 -03:00
Emilien Bondu
13e7d34cd3 Add new error type in authz client and handle properly missing resources errors to enable policy enforcer resource cache eviction/update. 
Closes #36560

Signed-off-by: Emilien Bondu <dev.ebondu@gmail.com>
 2025-01-20 12:01:03 +01:00
vramik
8b5ebe98d8 [FGAP] Design AdminPermissionEvaluator implementation for FGAP v2 
Closes #34921

Signed-off-by: vramik <vramik@redhat.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2025-01-15 16:05:14 -03:00
Stian Thorgersen
c1c147cb17 Restrict access to environment variables when at the server runtime (#36472) 
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2025-01-15 09:36:19 +01:00
Stefan Guilhen
a43b65281d Search user by id and fallback to username when needed 
- prevents performance issues when reading policies as users are always stored by id.

Closes #35796

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2024-12-11 11:54:59 -03:00
Thomas Darimont
f61937f3d9 Prefer usage of StandardCharsets.UTF_8 over "UTF-8" charset reference 
Fixes #35080

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
 2024-11-25 10:45:37 +00:00
Stefan Guilhen
8581886944 Add validation for role and time policies 
Closes #28978

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2024-10-21 15:51:38 -03:00
Pedro Igor
b76f4f9c1b Avoid iterating over user policies when removing users 
Closes #19358

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2024-10-15 15:01:40 +02:00
mposolda
b95d12a968 Add AuthzClientCryptoProvider to authz-client in keycloak main repository 
closes #33831

Signed-off-by: mposolda <mposolda@gmail.com>
 2024-10-15 08:16:14 +02:00
rmartinc
c532751ff4 Downgrade Java for client libraries to 8 
Closes #33051

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2024-09-20 17:01:01 +02:00
mposolda
4b95b42590 Avoid releasing keycloak-authz-client-test artifact to maven repositories 
closes #31653

Signed-off-by: mposolda <mposolda@gmail.com>
 2024-09-05 11:57:08 +02:00
mposolda
cd947ce3bc Removing policy-enforcer from Keycloak repository 
closes #32191

Signed-off-by: mposolda <mposolda@gmail.com>
 2024-08-28 07:40:20 -03:00
mposolda
54a538b3ad Update RolePolicyRepresentation fields from 'boolean' to 'Boolean' 
closes #32117

Signed-off-by: mposolda <mposolda@gmail.com>
 2024-08-14 13:11:06 +02:00
Krishna Kumar
fc80cc75fe Make createPatSupplier private to public 
Closes #29986

Signed-off-by: Krishna Kumar <krishnachaurasia1998@gmail.com>
 2024-07-23 11:11:42 +00:00
Diego Ramp
ae74d923d2 fix bad debugv({}) in favor of more tolerant debugf(%s) 
Closes #31368

Signed-off-by: Diego Ramp <diego.ramp@mobi.ch>
 2024-07-18 10:34:32 +02:00
mposolda
06f6173c8a Add suffix to keycloak-authz-client artifact in keycloak repository 
closes #30926

Signed-off-by: mposolda <mposolda@gmail.com>
 2024-07-17 14:59:09 +02:00
mposolda
5526976d1c Add suffix to keycloak-policy-enforcer artifacts in keycloak repository 
closes #30927

Signed-off-by: mposolda <mposolda@gmail.com>
 2024-07-17 12:03:23 +02:00
Pedro Igor
cbf7f208fb Avoid iterating and updating all group policies when removing groups (#31057) 
Closes #31056

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2024-07-08 13:57:20 +02:00
Romain LABAT
6615691c63 Support for service accounts when fetch roles is enabled (#30687) 
Support for service accounts when fetch roles is enabled

Signed-off-by: Romain LABAT <contact@romainlabat.fr>
Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2024-06-25 18:00:26 -03:00
Douglas Palmer
5af3001122 Check if OSGI metadata can be removed entirely 
Closes #29104

Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
 2024-06-25 14:12:33 +02:00
Stefan Guilhen
52c9e440d6 Guard against NPE when fetching users associated with user policies. 
Closes #28915

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2024-05-10 16:52:25 -03:00
Douglas Palmer
00bd6224fa Remove remaining Fuse adapter bits 
Closes #28787

Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
 2024-05-06 09:02:26 +02:00
Steven Hawkins
9486432f3f fix: removing httpclient override (#28304) 
we need to have a dependency on commons-logging-jboss-logging

closes: #21392

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
 2024-04-23 10:09:06 +02:00
Mark Banierink
ad32896725 replaced and removed deprecated token methods (#27715) 
closes #19671 

Signed-off-by: Mark Banierink <mark.banierink@nedap.com>


Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
 2024-04-23 09:23:37 +02:00
Pedro Igor
8e48bac278 Ordering the group and role ids in the policy representation 
Closes #28824

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
 2024-04-22 20:28:47 +02:00