* Emit credential_id on UPDATE_CREDENTIAL events from built-in required actions
UpdatePassword, UpdateTotp and WebAuthnRegister now set Details.CREDENTIAL_ID on the generic
UPDATE_CREDENTIAL event, matching REMOVE_CREDENTIAL which already carries the credential id. This
lets event consumers identify which credential row was created or updated when a user has multiple
credentials of the same type.
The OTP credential id is surfaced by hydrating it in OTPCredentialProvider.createCredential; the
WebAuthn id is read from the createCredential return value. A password update, however, may be
handled entirely by a federated CredentialInputUpdater (e.g. LDAP in WRITABLE edit mode), in which
case nothing is written to the Keycloak credential store and there is no id to report.
SubjectCredentialManager therefore gains updateCredentialAndGet, which returns the credential
written to the Keycloak credential store, or an empty Optional when a user-storage provider handled
the write. UpdatePassword emits the detail only when a credential comes back.
CredentialInputUpdater gains a default updateCredentialAndGet returning a CredentialUpdate: whether
the updater handled the input, and the credential it wrote to the Keycloak credential store, if
any. The default delegates to updateCredential and reports no credential, so an updater writing to
its own store, or one without data about what it wrote, leaves the event without an id.
PasswordCredentialProvider overrides it and hands over the model produced by the write itself:
nothing is read back afterwards, so no concurrent password write can make the event report another
row, and the required action needs neither a pre-update snapshot nor a hash or timestamp comparison
to find out whether the local row changed. UserCredentialManager asks each updater once and keeps
the first outcome that was handled, so updateCredential keeps reporting what it reported before.
SubjectCredentialManagerCacheAdapter invalidates the cached user for updateCredentialAndGet as it
does for every other mutating method, so the write path does not read credentials through the user
cache.
RecoveryAuthnCodesAction emits the id as well. CredentialHelper.createRecoveryCodesCredential now
returns the credential it created in the local storage, or null when the userStorage handled the
write, so the action applies the same emit-only-when-locally-stored rule as the other required
actions.
The tests compare the emitted value with the credential id actually persisted for the user, rather
than only asserting that some id is present. RequiredActionUpdatePasswordFederatedTest covers the
federated branch: a user whose password is held by a user-storage provider, with a stale password
row left in the Keycloak DB, must not get that untouched row's id on the event.
WebAuthnRegisterAndLoginTest asserts that the deprecated cloned event still carries the details it
had before, as the id is added to the generic event only after that clone is emitted.
The release notes mention the new event detail. The migration guide needs no entry, as the touched
SPI interfaces only gain default methods.
Closes#50247
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Nuno Faria <nuno.faria@getflip.com>
* Fix release notes, avoid executing other updater
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
---------
Signed-off-by: Nuno Faria <nuno.faria@getflip.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
* Promote Client v2 to preview
Closes#53212
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Update also Querying guide
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Mark Querying guide as Preview
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Update KeycloakSharedCsvMetadata
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
---------
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
* Add CI test suite and documentation for HTTP_CLIENT_V2
Closes: #52979
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
* Add CI test suite and documentation for HTTP_CLIENT_V2
Closes: #52979
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
---------
Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
Updated the documentation to clarify the experimental support for the Identity Assertion JWT Authorization Grant, specifying the current limitations and future plans
Signed-off-by: Vinod Anandan <vinod@owasp.org>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Restructuring and augmenting the release notes and migration guide for 26.7
Closes#50227
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
* fix: refining the health check and exposing excluding the health check
closes: #49248
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* simplifying the health check
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* switching the health check to a dedicated executor
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* updating help messages
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* Update quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java
Co-authored-by: Peter Zaoral <pepo48@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
* addressing review comments and adding dist tests
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* adding a release note and a small doc note.
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* addressing review comments
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Peter Zaoral <pepo48@gmail.com>
* Ability to add parameterized scope type
Closes#49532
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
* Be more defensive in the contract with nullability + emptiness
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
* Provide test for scopes with the target user
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
---------
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
