* Compare redirect URI hostnames case-insensitively
Fixes#52119
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Harden case-insensitive redirect URI matching against review findings
Compare raw authorities when parsed hosts are null, handle opaque URIs
and unparseable wildcard prefixes safely, and preserve user-info and
port-wildcard semantics during redirect validation.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Address remaining review findings for case-insensitive URI matching.
Keep opaque fragments and registry user-info case-sensitive, tighten port-wildcard detection, and align iframe/web-origin checks with the same rules.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Update OAuthRedirectUriTest for case-insensitive host/scheme matching.
Hostname and scheme case differences are now accepted; keep path
comparisons case-sensitive.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Address review feedback for case-insensitive URI matching.
Document the scheme/host case change, compare opaque SSP and require
explicit ports for port wildcards, and keep user-info out of origin equality.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Fix IPv6 port detection and authority-less wildcard matching.
Address Copilot review findings: treat only a colon after ']' as an IPv6
port, compare raw port suffixes so nonnumeric/empty ports are distinct,
skip the exact-match fallback for port wildcards, and compare schemes
only for authority-less wildcard prefixes.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Distinguish port wildcards from empty-port path wildcards
Detect port wildcards from the original :* authority before stripping,
so patterns like https://example.com:/* compare ports normally. Clarify
the upgrade note that user-info/path rules apply to redirect URIs only.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Ignore example.com URLs in documentation link checks
The upgrade note uses example.com redirect URI samples that must not be
fetched by ExternalLinksTest.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Normalize redirect/origin hostnames with IDNA before compare
Unicode, percent-encoded, and punycode forms of the same hostname
now match; registry-names such as underscores still fall back safely.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Compare hosts case-insensitively without IDNA
Split raw authorities before host extraction so percent-encoded
delimiters cannot spoof user-info, and drop IDNA to avoid
transitional mapping mismatches with browsers.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Use ASCII-only case folding for hostname compare
String.equalsIgnoreCase also folds Unicode letters, so ı.com
incorrectly matched i.com for redirects and CORS origins.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Require trailing :* for port-wildcard redirects
An authority containing :* with a later path wildcard must not
activate the port-wildcard branch.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Ignore Prometheus metric braces in docs variable check
GuideTest.checkVariables falsely flagged HTTP metric label examples
in the upgrading guide after quotes were HTML-escaped.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Allow wildcards for registry-name redirect hosts
Java leaves getHost() null for underscores in registered names, which
made areWildcardsAllowed reject valid path wildcards. Recognize those
authorities when there is no user-info and any port is valid, preserving
the CVE-2026-7504 protections.
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
---------
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Promote Client v2 to preview
Closes#53212
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Update also Querying guide
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Mark Querying guide as Preview
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Update KeycloakSharedCsvMetadata
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
---------
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Add Vert.x HTTP client as v2 alternative to Apache HTTP client
Closes#49968
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* Add Vert.x HTTP client as v2 alternative to Apache HTTP client
Closes#49968
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* review
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* review
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* review
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* rewrite bridge to use lower-level HttpClient with chunk-level response handling
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* rewrite proxy to per-request routing
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* review
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* remove normalizeNoProxy
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* rewrite getInputStream to use lower-level HttpClient with lazy streaming
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* review
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* review
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
---------
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
EnvUtil.replace built the Matcher.appendReplacement replacement string by
escaping '\' but not '$', so a resolved system-property value containing
'$' (e.g. a keystore/truststore path) threw IllegalArgumentException
("Illegal group reference") or silently spliced a capture group for
"$<digit>". Use Matcher.quoteReplacement, which escapes both '\' and '$'.
Closes#51709
Signed-off-by: Md. Amdadul Bari Imad <amdadulbari@gmail.com>
Expanding a composite-role tree bound every parent id of a breadth-first
level into a single IN clause, which exceeds the per-statement parameter
limit on some databases (MSSQL: 2100) for large role sets.
Split the parent ids into chunks of at most jpaInParametersLimitThreshold
(default 1000) via the new generic CollectionUtil#partition and run one
getChildRolesFromParentIds query per chunk. Child ids are de-duplicated
across chunks to preserve the "select distinct" semantics.
Fixes#51510
Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
* Return SPNEGO mutual authentication token
Propagate the final GSS response token through Kerberos credential
validation and return it on the successful authentication response.
Closes#51559
Signed-off-by: Alex Wicks <alex@awicks.io>
* Harden SPNEGO response token handling
Handle optional GSS output tokens and verify that mutual
authentication completes without persisting the response token in user
sessions.
Closes#51559
Signed-off-by: Alex Wicks <alex@awicks.io>
---------
Signed-off-by: Alex Wicks <alex@awicks.io>
Fix#44013
The Twitter broker relies on the unmaintained twitter4j library (no release in several years) and Twitter's legacy OAuth 1.0a endpoints. twitter4j uses Java serialization to record its state, which recurs as noise in security reviews.
This deprecates the broker behind a disabled-by-default feature (twitter-broker), mirroring the Instagram broker deprecation. As Twitter(X) now supports OAuth 2.0, the generic OAuth v2 identity provider can be used as a replacement, and the admin guide documents the migration.
Signed-off-by: Bapuji Koraganti <bapuk.2008@gmail.com>
Signed-off-by: Bapuji Koraganti <34816445+bkoragan@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
* fix: normalizing logic when context is not available
closes: #49083
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* adding javadocs and making the implementations uniform
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
# server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
# services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
* updating based upon review comments
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* Update server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
Co-authored-by: Peter Zaoral <pepo48@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Peter Zaoral <pepo48@gmail.com>
* Initial draft to check CA subject DN in X.509 client authenticator
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
* Add the test to the FIPS suites and doc changes
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
* Delete AbstractMutualTLSClientTest to move the old test
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
* Move the old test to the new test suite
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
* final test changes
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
* First round of review changes.
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
* Add a client executor to add default CA subject DN to client registration
Closes#48412
Signed-off-by: rmartinc <rmartinc@redhat.com>
---------
Signed-off-by: rmartinc <rmartinc@redhat.com>
