webapp/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-10-23 19:29:23 +03:00
Code Activity
32,645 Commits 39 Branches 324 Tags
main
Commit Graph

70 Commits

Author SHA1 Message Date
Erik Jan de Wit
b1bdd565b9 Compare redirect URI hostnames case-insensitively (#52845) 
* Compare redirect URI hostnames case-insensitively

Fixes #52119

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Harden case-insensitive redirect URI matching against review findings

Compare raw authorities when parsed hosts are null, handle opaque URIs
and unparseable wildcard prefixes safely, and preserve user-info and
port-wildcard semantics during redirect validation.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Address remaining review findings for case-insensitive URI matching.

Keep opaque fragments and registry user-info case-sensitive, tighten port-wildcard detection, and align iframe/web-origin checks with the same rules.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Update OAuthRedirectUriTest for case-insensitive host/scheme matching.

Hostname and scheme case differences are now accepted; keep path
comparisons case-sensitive.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Address review feedback for case-insensitive URI matching.

Document the scheme/host case change, compare opaque SSP and require
explicit ports for port wildcards, and keep user-info out of origin equality.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Fix IPv6 port detection and authority-less wildcard matching.

Address Copilot review findings: treat only a colon after ']' as an IPv6
port, compare raw port suffixes so nonnumeric/empty ports are distinct,
skip the exact-match fallback for port wildcards, and compare schemes
only for authority-less wildcard prefixes.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Distinguish port wildcards from empty-port path wildcards

Detect port wildcards from the original :* authority before stripping,
so patterns like https://example.com:/* compare ports normally. Clarify
the upgrade note that user-info/path rules apply to redirect URIs only.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Ignore example.com URLs in documentation link checks

The upgrade note uses example.com redirect URI samples that must not be
fetched by ExternalLinksTest.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Normalize redirect/origin hostnames with IDNA before compare

Unicode, percent-encoded, and punycode forms of the same hostname
now match; registry-names such as underscores still fall back safely.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Compare hosts case-insensitively without IDNA

Split raw authorities before host extraction so percent-encoded
delimiters cannot spoof user-info, and drop IDNA to avoid
transitional mapping mismatches with browsers.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Use ASCII-only case folding for hostname compare

String.equalsIgnoreCase also folds Unicode letters, so ı.com
incorrectly matched i.com for redirects and CORS origins.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Require trailing :* for port-wildcard redirects

An authority containing :* with a later path wildcard must not
activate the port-wildcard branch.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Ignore Prometheus metric braces in docs variable check

GuideTest.checkVariables falsely flagged HTTP metric label examples
in the upgrading guide after quotes were HTML-escaped.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

* Allow wildcards for registry-name redirect hosts

Java leaves getHost() null for underscores in registered names, which
made areWildcardsAllowed reject valid path wildcards. Recognize those
authorities when there is no user-info and any port is valid, preserving
the CVE-2026-7504 protections.

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

---------

Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
 2026-10-06 08:07:00 +02:00
Martin Bartoš
b21e6f0a08 Documentation for the Client TE Delegation (#51999) 
* Documentation for the Client TE Delegation

Closes #51986

Co-authored-by: Šimon Vacek <86605314+vaceksimon@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Address suggestions

Co-authored-by: Ricardo Martin <rmartinc@redhat.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Šimon Vacek <86605314+vaceksimon@users.noreply.github.com>
Co-authored-by: Ricardo Martin <rmartinc@redhat.com>
 2026-09-24 10:47:50 +02:00
Alexander Schwartz
fca8fe793d Release notes and upgrading guide for 26.8 
Closes #53022

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Stian Thorgersen <stianst@gmail.com>
 2026-09-22 13:42:27 +02:00
Ruchika Jha
9fbce7753c Deprecated changes for multicluster v1 
Closes #52772

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-09-21 16:14:13 +00:00
Alexander Schwartz
af61d23bd5 Refactoring docs 
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-09-09 09:07:47 -03:00
dependabot[bot]
33bc6b65d2 Bump org.apache.httpcomponents.client5:httpclient5 (#51716) 
Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.0.1 to 5.6.3.
- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.3/RELEASE_NOTES.txt)
- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.0.1...rel/v5.6.3)

---
updated-dependencies:
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: 5.6.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-14 13:10:23 +02:00
dependabot[bot]
871d7ea9d9 Bump org.jsoup:jsoup from 1.18.3 to 1.23.1 in /docs/documentation/tests (#51597) 
Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.18.3 to 1.23.1.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.18.3...jsoup-1.23.1)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-12 09:42:17 +00:00
Vasiliy Mikhailov
5670eb7211 Stricter path matching and validation of template URLs for resource access 
Closes #50291

Signed-off-by: Vasiliy Mikhailov <vasiliy.mikhailov@gmail.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-07-03 15:56:31 +02:00
Alexander Schwartz
0166062336 Capturing the current state of work for the 26.7 release 
Restructuring and augmenting the release notes and migration guide for 26.7

Closes #50227

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-07-02 14:58:26 +02:00
forkimenjeckayang
b745dfa51a [OID4VCI] Documentation for OID4VCI credential request (#50060) 
closes #49504



Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
 2026-06-18 12:53:21 +02:00
Stefan Guilhen
171a5846a7 Add SCIM API documentation to server admin guide 
Closes #47604

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
 2026-06-12 09:50:52 -03:00
Stian Thorgersen
0932c7f46d Ignore failing link https://www.h2database.com/html/commands.html#set_non_keywords (#49759) 
Signed-off-by: stianst <stianst@gmail.com>
 2026-06-08 08:33:48 +02:00
Vlasta Ramik
ba23dd1c24 Support mapping existing Realm and Client roles to Organization Groups (#48670) 
Closes #47327

Signed-off-by: vramik <vramik@redhat.com>
 2026-05-28 13:33:32 +02:00
vramik
10d50847df Improve documentation for cases when migrating from FGAP:V1 to V2 
Closes #48588

Signed-off-by: vramik <vramik@redhat.com>
 2026-05-11 08:10:39 -03:00
Faseela K
33edd62a78 Ignore oasis-open.org in ExternalLinksTest (#48682) 
Fixes #48681

Signed-off-by: Faseela K <faseela.k@est.tech>
 2026-05-07 14:01:10 +02:00
Giuseppe Graziano
06f32bd7aa Remove ignored-links after 26.6.0 
Closes #45822

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2026-04-09 09:03:57 +00:00
Rahul Ramkumar
799699a808 Add KCRAW_ prefix for environment variables to preserve literal values (#47197) 
Closes #46657

Signed-off-by: Rahul Ramkumar <rahulram226@gmail.com>
 2026-04-07 10:12:18 +02:00
Martin Bartoš
c0458c0801 Provide documentation for customizable log service properties 
Closes #47586

Co-authored-by: Daniele Mams <mammarella.daniele@gmail.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
 2026-03-31 11:16:29 +02:00
Pedro Ruivo
94fb77b821 Update release notes with DB TLS options 
Closes #47105

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
 2026-03-13 11:04:23 +01:00
vramik
367f9e2cc8 Organization Groups Documentation 
Closes #45516

Signed-off-by: vramik <vramik@redhat.com>
 2026-03-10 10:31:50 -03:00
Ruchika Jha
e82e107b85 Enable graceful HTTP shutdown and document default behavior 
Closes #43589

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2026-02-13 14:28:49 +00:00
Giuseppe Graziano
0bc95be9cc Remove ignored-links after 26.5.0 
Closes #44810

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2026-01-28 15:08:08 +00:00
Giuseppe Graziano
23aad2a942 DPoP Guide (#45274) 
Closes #42747

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2026-01-13 11:01:28 +01:00
Alexander Schwartz
e43cf55028 Finalizing 26.5 release notes 
Closes #45131

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Stian Thorgersen <stian@redhat.com>
 2026-01-05 14:10:32 +01:00
Robin Meese
0957572751 Add logout event to SessionResource 
Closes #44842

Signed-off-by: Robin Meese <39960884+robson90@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
 2025-12-29 12:25:45 +00:00
Giuseppe Graziano
c0c4067bdd JWT Authorization Grant feature to preview 
Closes #44492

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
 2025-12-11 10:37:30 +01:00
Martin Bartoš
8def691053 [OTel] Provide general options for telemetry settings (#41705) 
* [OTel] Provide general options for telemetry settings

Closes #41263

Co-authored-by: Ryan Emerson <remerson@redhat.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/observability/telemetry.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Provide release notes and deprecation note

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Ignore link to the telemetry guide for now

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Ryan Emerson <remerson@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
 2025-12-10 12:03:46 +00:00
Martin Bartoš
419afce847 Fix anchors in the documentation 
Closes #43084

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
 2025-10-21 12:33:32 +00:00
Martin Bartoš
f53e5ebdac [Docs] Additional datasources support (#42655) 
* [Docs] Additional datasources support

Closes #40388

Closes #42263

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Rename namedKey to wildcardKey in the code

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Clarify the defaults for DB kind

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Be more clear about the Named key reference in guide

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Vasek's review

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
 2025-09-27 08:45:12 +00:00
rmartinc
c05b84a0d2 Ignore external links to https://www.npmjs.com/package 
Closes #42856

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2025-09-23 12:36:46 +02:00
Ricardo Martin
93791f67fb Add User_agent header for documentation links checker 
Closes #42164

Signed-off-by: rmartinc <rmartinc@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
 2025-09-09 21:02:42 +00:00
Alexander Schwartz
665f4140da Adding missing docs for 26.4 release notes 
Closes #42252

Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Vinod Anandan <vinod@owasp.org>
 2025-09-02 17:47:12 -03:00
dependabot[bot]
1a262cc899 Bump commons-io:commons-io from 2.7 to 2.14.0 in /docs/documentation/tests (#41463) 
Bumps commons-io:commons-io from 2.7 to 2.14.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-version: 2.14.0
  dependency-type: direct:development
...

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
 2025-08-14 06:08:39 +00:00
Peter Skopek
651d651c30 Add missing artifact descriptions to allow Maven Central Portal Publisher pass validation process. (#40822) 
Signed-off-by: Peter Skopek <pskopek@redhat.com>
 2025-08-12 16:50:17 +02:00
Michal Hajas
88f660b235 Add experimental feature rolling-updates:v2 that allows rolling updat… (#39751) 
...e for patch releases
Closes #38882
Signed-off-by: Michal Hajas <mhajas@redhat.com>
 2025-05-27 11:17:42 -03:00
Alexander Schwartz
d69a530d5b Check HTML head for redirects 
Closes #38655

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
 2025-04-04 18:40:41 +02:00
Alexander Schwartz
c9b88c6bf6 Finalizing release notes and documentation for initial rolling update 
Closes #38168

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
 2025-03-19 21:34:09 +01:00
Marek Posolda
290905c9cf Documentation for supported token-exchange (#38008) 
closes #37126

Signed-off-by: Marek Posolda <mposolda@gmail.com>


Co-authored-by: Bruno Oliveira da Silva <bruno@abstractj.com>
Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
 2025-03-14 09:55:44 +01:00
Alexander Schwartz
bc7ec1208e Enable the TLS based JGroups encryption by default and update the docs 
Closes #37696

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
 2025-03-03 10:50:51 -03:00
Václav Muzikář
764ca50fc4 Upgrade to Quarkus 3.18.2 (#37300) 
* Upgrade to Quarkus 3.18.2

Closes #37056

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>

* Update docs/documentation/upgrading/topics/changes/changes-26_2_0.adoc

Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Václav Muzikář <vaclav@muzikari.cz>

---------

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Signed-off-by: Václav Muzikář <vaclav@muzikari.cz>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
 2025-02-17 16:30:05 +01:00
rmartinc
17d2dd58ca Add some common headers for the links check in docs 
Closes #36675

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2025-01-22 12:21:29 +01:00
Alexander Schwartz
05e612bfb6 Moving the docs for password metrics to a new guide 
Closes #36442

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Michal Hajas <mhajas@redhat.com>
 2025-01-14 16:17:04 +00:00
Martin Bartoš
3e8f8277d4 Remove ignored links from the documentation tests after KC 26 release 
Closes #32071

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
 2025-01-06 22:37:01 +01:00
Stan Silvert
b4a200d333 Fixes release notes section on new login theme, keycloak.v2 (#33359) 
* Fixes #33351

Signed-off-by: Stan Silvert <ssilvert@redhat.com>

* Fixes #33351

Signed-off-by: Stan Silvert <ssilvert@redhat.com>

* Ignore saml.xml.org because of expired cert.

Signed-off-by: Stan Silvert <ssilvert@redhat.com>

---------

Signed-off-by: Stan Silvert <ssilvert@redhat.com>
 2024-09-30 15:38:29 +02:00
Jon Koops
cf90247441 Ignore documentation links with broken certificate (#33026) 
Closes #33023

Signed-off-by: Jon Koops <jonkoops@gmail.com>
 2024-09-17 13:17:32 +02:00
Martin Bartoš
d17a48f8f8 Add docs for the OpenTelemetry tracing 
Closes #31908

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
 2024-08-13 08:46:48 +02:00
rmartinc
942d5d0aa3 Convert chapter planning for securing applications and services to guides 
Final removal of the securing_apps documentation
Final checks for links, order and other minor things
Closes #31328

Signed-off-by: rmartinc <rmartinc@redhat.com>
 2024-08-01 16:45:56 +02:00
Peter Zaoral
07cfdac862 Document admin bootstrapping and recovery 
Closes: #30011

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
 2024-07-30 15:45:56 +02:00
Martin Bartoš
04b16a914c Remove link to management interface guide from ignored links in docs 
Closes #28475

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
 2024-06-12 11:50:21 +02:00
Martin Bartoš
b2c88e9876 docs: Support management port for health and metrics (#28213) 
Relates to #19334

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Václav Muzikář <vmuzikar@redhat.com>
 2024-04-09 14:33:30 +02:00