The four cache policy detail fields were addressed with a fixed array index -
config.maxLifespan[0] and the three eviction fields. That holds on the LDAP and
Kerberos screens, which load with form.reset(component) and keep the raw
ComponentRepresentation, so the entry really is an array.
The custom provider screen loads with convertToFormValues, which unwraps a
single-element array, so the same entry is the plain string "50". react-hook-form
resolves config.maxLifespan[0] against that string as "5", and registering on an
index path writes that value back into form state. The truncation is therefore what
the next save sends, whether or not the user touched the field: a stored 50 persists
as ["5"], and an eviction time of 12:30 as 1:3.
Each field is now addressed by the shape actually present, the same way cachePolicy
already tolerated both through getValue. Only an array or a still-unset value takes
the index, so nothing changes for LDAP, for Kerberos or for a new provider, and the
path stays put when the number control replaces the string with a number.
Closes#52029
Signed-off-by: Mahathir Mohammad Shuvo <shuvo1728@gmail.com>
The account console never told the user that a password change went
through. Keep the result of the application-initiated action in the
Keycloak context and show accountPasswordUpdatedMessage on the signing in
page when UPDATE_PASSWORD finishes successfully.
Closes#54220
Signed-off-by: Chethann <chethankumar0544@gmail.com>
A master realm admin with an e-mail address should see that address in
the test connection hint on the Email tab of any realm, not only master.
Related to #54060, #52744
Signed-off-by: bangarusaivivek <bangarusaivivek1996@gmail.com>
* Authorize receiver-driven SSF subject adds per subject
Any SSF receiver with ssf.manage could subscribe to security events for
every user in the realm, since subjects/add only verified stream
ownership. Receiver adds are now gated by ssf.receiverSubjectAddPolicy
(AUTHENTICATED by default, ANY, NONE), and can no longer override a
subject an administrator explicitly ignored.
Fixes#53695
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
* Ignore expired sessions in the SSF AUTHENTICATED add check
Session streams can return user and client sessions past their idle or
max lifespan, so an expired relationship still let a receiver add the
user. Require the same session validity checks as token refresh.
Also restore the default add policy in test cleanup by blanking the
attribute: a client update keeps attributes omitted from the
representation, so ANY/NONE leaked into later tests.
Fixes#53695
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
---------
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
With catchNotFound the agent returns null for a missing resource, but most
of these methods declared T | undefined, and several declared no missing
case at all: findProtocolMapperById, findProtocolMappersByProtocol,
roles.findUsersWithRole, workflows.scheduled, getRequiredActionForAlias
(any) and the two policy lookups (void). The admin console now converts
the null where it stores the result as T | undefined, filters it out of
the user, role and policy selections, and shows an empty list where a
missing role or user made the Users in role and Workflows tabs fail.
Closes#43371
Signed-off-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
The admin console required view-clients and view-identity-providers to show
Authentication, and the Authorization Services roles for the flow routes,
while the endpoints behind them only ask for view-realm or manage-realm and
filter flow usage by the caller's own permissions (#53315).
Closes#51135
Signed-off-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
Update create-keycloak-theme to a patched simple-git release that addresses CVE-2026-102826, CVE-2026-102827, CVE-2026-102828, and CVE-2026-102829.
Closes#53582
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
RoleSelect mounts in the Permissions Evaluation tab before the roles
field has a value, so getValues() returns undefined and reading
.length crashes the page. The guard was removed by the
no-unnecessary-condition cleanup because the form type declared the
value as non-nullable. Declare the field as possibly undefined so the
type matches react-hook-form's runtime behaviour and the lint rule no
longer flags the guard.
Fixes#53370
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
The Permissions → Evaluation help popover builds its key as
select${resourceType}, and selectRoles was never defined, so the Roles
resource type showed the raw key instead of help text.
Fixes#53373
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
* Prevent reverse tabnabbing for account console client links
Open client-controlled URLs with noopener and noreferrer so opened
pages cannot access window.opener.
Closes#52677
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* Add regression test for account console tabnabbing protection
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* changed to href
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* updated tests
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
---------
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
Using `view-organizations` would require all users accessing the edit organization route to have access to all organizations, even if they are granted access to just one organization through FGAP. Using `query-organizations` unifies the role behavior with the users and group resource types.
Closes: #53400
Signed-off-by: s3n-w6i <37022952+s3n-w6i@users.noreply.github.com>
* Name the remove buttons in the FGAP resource selects
The remove button on each row of the group, role and organization selects was icon-only, so screen readers announced an unlabelled button. Give each one an aria-label that names the row it removes.
Closes#53372
Signed-off-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
* Include the client in the accessible name of a client role's remove button
Client role names are only unique within a client, so two selected roles with the same name from different clients got the same accessible name.
Closes#53372
Signed-off-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
* Test the remove buttons of the FGAP role select by their accessible names
Covers a realm role and a client role of the same name, which the client ID in the button's name tells apart.
Closes#53372
Signed-off-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
---------
Signed-off-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
Co-authored-by: Yang Bai <271969568+ybai08@users.noreply.github.com>
NumberControl hands the raw form value to PatternFly, and a value backed by a
config or attribute map is a string. Both steppers broke on that. PatternFly
substitutes 0 for a value that is not a number when it decides whether a
stepper is in range, so against the `min` of 0 that most callers set, the
minus button was permanently disabled. And `value + 1` on a string appends
instead of incrementing, so a stored 50 turned into 501 on the first click of
plus, which is then what gets saved.
Convert a numeric string once, for the displayed value as well as for the
steppers, since the disabled state is decided inside PatternFly from what it
is handed. A value that is not a numeric string is passed on untouched, so an
empty or unparseable field renders as before.
Closes#53126
Signed-off-by: Niko Köbler <niko@n-k.de>
* Updated translation for Turkish
Language: tr
Updated translation for Turkish
Language: tr
Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Arif EROL <arif.erol16@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Arif EROL <arif.erol16@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Translated using Weblate (Portuguese (Brazil))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/pt_BR/
Translated using Weblate (Portuguese (Brazil))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/pt_BR/
Updated translation for Portuguese (Brazil)
Language: pt_BR
Updated translation for Portuguese (Brazil)
Language: pt_BR
Updated translation for Portuguese (Brazil)
Language: pt_BR
Updated translation for Portuguese (Brazil)
Language: pt_BR
Updated translation for Portuguese (Brazil)
Language: pt_BR
Updated translation for Portuguese (Brazil)
Language: pt_BR
Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Gustavo Bretas <gustavobretas@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Rafael Cunha <rafael.danicunha@gmail.com>
Signed-off-by: Gustavo Bretas <gustavobretas@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Rafael Cunha <rafael.danicunha@gmail.com>
* Updated translation for German
Language: de
Translated using Weblate (German)
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/de/
Translated using Weblate (German)
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/de/
Updated translation for German
Language: de
Updated translation for German
Language: de
Updated translation for German
Language: de
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: André Schild <andre@schild.ws>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Hosted Weblate user 165770 <fstolte@users.noreply.hosted.weblate.org>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: André Schild <andre@schild.ws>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Hosted Weblate user 165770 <fstolte@users.noreply.hosted.weblate.org>
* Updated translation for Russian
Language: ru
Updated translation for Russian
Language: ru
Co-authored-by: Eugene Pasternak <pasternake@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Eugene Pasternak <pasternake@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Updated translation for Catalan
Language: ca
Co-authored-by: Ecron <ecron_89@hotmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Ecron <ecron_89@hotmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Updated translation for Czech
Language: cs
Updated translation for Czech
Language: cs
Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Martin Kluska <martin@kluska.cz>
Co-authored-by: Peter Schiffer <peter@pschiffer.eu>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Martin Kluska <martin@kluska.cz>
Signed-off-by: Peter Schiffer <peter@pschiffer.eu>
* Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Updated translation for Dutch
Language: nl
Translated using Weblate (Dutch)
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/nl/
Co-authored-by: Daan Breur <daanbreur@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Jan Herrygers <jherrygers@vaa.com>
Signed-off-by: Daan Breur <daanbreur@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Jan Herrygers <jherrygers@vaa.com>
* Updated translation for Spanish
Language: es
Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Herbert Solórzano <herbert.solorzano@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Herbert Solórzano <herbert.solorzano@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Updated translation for French
Language: fr
Updated translation for French
Language: fr
Updated translation for French
Language: fr
Updated translation for French
Language: fr
Updated translation for French
Language: fr
Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: André Schild <andre@schild.ws>
Co-authored-by: Dodouce <marin.pau22@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Lewis Bertin <lewis@tactiqual.tech>
Co-authored-by: Sylvain Pichon <service@spichon.fr>
Signed-off-by: André Schild <andre@schild.ws>
Signed-off-by: Dodouce <marin.pau22@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Lewis Bertin <lewis@tactiqual.tech>
Signed-off-by: Sylvain Pichon <service@spichon.fr>
* Updated translation for Swedish
Language: sv
Updated translation for Swedish
Language: sv
Translated using Weblate (Swedish)
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/sv/
Updated translation for Swedish
Language: sv
Updated translation for Swedish
Language: sv
Updated translation for Swedish
Language: sv
Updated translation for Swedish
Language: sv
Updated translation for Swedish
Language: sv
Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Updated translation for Swedish
Language: sv
Co-authored-by: Daniel Nylander <yeagersthlm@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: bittin1ddc447d824349b2 <bittin@reimu.nl>
Signed-off-by: Daniel Nylander <yeagersthlm@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: bittin1ddc447d824349b2 <bittin@reimu.nl>
* Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Translated using Weblate (Persian)
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/fa/
Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Translated using Weblate (Persian)
Currently translated at 100.0% (1 of 1 strings)
Translated using Weblate (Persian)
Currently translated at 100.0% (1 of 1 strings)
Translated using Weblate (Persian)
Currently translated at 100.0% (1 of 1 strings)
Translated using Weblate (Persian)
Currently translated at 100.0% (1 of 1 strings)
Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Updated translation for Persian
Language: fa
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Naser Mirzaei <nasermirzaei89@gmail.com>
Co-authored-by: Soltinator <ali.soltani2000@hotmail.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Naser Mirzaei <nasermirzaei89@gmail.com>
Signed-off-by: Soltinator <ali.soltani2000@hotmail.com>
Translate-URL: https://hosted.weblate.org/projects/keycloak/keycloak-e-mail-theme/fa/
Translate-URL: https://hosted.weblate.org/projects/keycloak/keycloak-login-theme/fa/
Translate-URL: https://hosted.weblate.org/projects/keycloak/keycloak-v2-login-theme/fa/
Translate-URL: https://hosted.weblate.org/projects/keycloak/keycloak-welcome-theme/fa/
Translation: Keycloak/Keycloak E-mail theme
Translation: Keycloak/Keycloak Login theme
Translation: Keycloak/Keycloak Welcome theme
Translation: Keycloak/Keycloak v2 Login theme
* Update translation files
Updated by "Cleanup translation files" hook in Weblate.
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
* Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Translated using Weblate (Chinese (Traditional Han script))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Translated using Weblate (Chinese (Traditional Han script))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Translated using Weblate (Chinese (Traditional Han script))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Translated using Weblate (Chinese (Traditional Han script))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Translated using Weblate (Chinese (Traditional Han script))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Translated using Weblate (Chinese (Traditional Han script))
Translation: Keycloak/Admin backend
Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Updated translation for Chinese (Traditional Han script)
Language: zh_Hant
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: 秉虎 <s96016641@gmail.com>
Co-authored-by: 翁震軒 <benwater12@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: 秉虎 <s96016641@gmail.com>
Signed-off-by: 翁震軒 <benwater12@gmail.com>
* Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Updated translation for Hungarian
Language: hu
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Norbert Kelemen <nkelemen18@nkelemen.hu>
Co-authored-by: Vilmos Szabó-Nagy <me@vnagy.eu>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Norbert Kelemen <nkelemen18@nkelemen.hu>
Signed-off-by: Vilmos Szabó-Nagy <me@vnagy.eu>
---------
Signed-off-by: Arif EROL <arif.erol16@gmail.com>
Signed-off-by: Hosted Weblate <hosted@weblate.org>
Signed-off-by: Gustavo Bretas <gustavobretas@gmail.com>
Signed-off-by: Rafael Cunha <rafael.danicunha@gmail.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: André Schild <andre@schild.ws>
Signed-off-by: Hosted Weblate user 165770 <fstolte@users.noreply.hosted.weblate.org>
Signed-off-by: Eugene Pasternak <pasternake@gmail.com>
Signed-off-by: Ecron <ecron_89@hotmail.com>
Signed-off-by: Martin Kluska <martin@kluska.cz>
Signed-off-by: Peter Schiffer <peter@pschiffer.eu>
Signed-off-by: Daan Breur <daanbreur@gmail.com>
Signed-off-by: Jan Herrygers <jherrygers@vaa.com>
Signed-off-by: Herbert Solórzano <herbert.solorzano@gmail.com>
Signed-off-by: Dodouce <marin.pau22@gmail.com>
Signed-off-by: Lewis Bertin <lewis@tactiqual.tech>
Signed-off-by: Sylvain Pichon <service@spichon.fr>
Signed-off-by: Daniel Nylander <yeagersthlm@gmail.com>
Signed-off-by: bittin1ddc447d824349b2 <bittin@reimu.nl>
Signed-off-by: Naser Mirzaei <nasermirzaei89@gmail.com>
Signed-off-by: Soltinator <ali.soltani2000@hotmail.com>
Signed-off-by: 秉虎 <s96016641@gmail.com>
Signed-off-by: 翁震軒 <benwater12@gmail.com>
Signed-off-by: Norbert Kelemen <nkelemen18@nkelemen.hu>
Signed-off-by: Vilmos Szabó-Nagy <me@vnagy.eu>
Co-authored-by: Arif EROL <arif.erol16@gmail.com>
Co-authored-by: Gustavo Bretas <gustavobretas@gmail.com>
Co-authored-by: Rafael Cunha <rafael.danicunha@gmail.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: André Schild <andre@schild.ws>
Co-authored-by: Hosted Weblate user 165770 <fstolte@users.noreply.hosted.weblate.org>
Co-authored-by: Eugene Pasternak <pasternake@gmail.com>
Co-authored-by: Ecron <ecron_89@hotmail.com>
Co-authored-by: Martin Kluska <martin@kluska.cz>
Co-authored-by: Peter Schiffer <peter@pschiffer.eu>
Co-authored-by: Daan Breur <daanbreur@gmail.com>
Co-authored-by: Jan Herrygers <jherrygers@vaa.com>
Co-authored-by: Herbert Solórzano <herbert.solorzano@gmail.com>
Co-authored-by: Dodouce <marin.pau22@gmail.com>
Co-authored-by: Lewis Bertin <lewis@tactiqual.tech>
Co-authored-by: Sylvain Pichon <service@spichon.fr>
Co-authored-by: Daniel Nylander <yeagersthlm@gmail.com>
Co-authored-by: bittin1ddc447d824349b2 <bittin@reimu.nl>
Co-authored-by: Naser Mirzaei <nasermirzaei89@gmail.com>
Co-authored-by: Soltinator <ali.soltani2000@hotmail.com>
Co-authored-by: 秉虎 <s96016641@gmail.com>
Co-authored-by: 翁震軒 <benwater12@gmail.com>
Co-authored-by: Norbert Kelemen <nkelemen18@nkelemen.hu>
Co-authored-by: Vilmos Szabó-Nagy <me@vnagy.eu>
* Load quick theme login resources under the http-relative-path
The quick theme login preview and the theme download built the login
theme resource URLs from `/resources/...` at the server root, so with a
non-root http-relative-path the preview rendered unstyled and the
downloaded theme bundled a 404 page as its stylesheet.
Build both from the admin console's base URL, which includes the
relative path.
Closes#52913
Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>
Claude-Session: https://claude.ai/code/session_01CFRv5kvesfnKYgHmNw9Vpf
* Skip the quick-theme preview test when the feature is disabled
The Quick theme tab only mounts when the server has the QUICK_THEME feature.
The E2E CI server does not enable it, so clicking the tab timed out. Gate the
test on the feature, mirroring the OID4VCI skip helper.
Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>
---------
Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>
The Realm settings header received the resolved display name as
`realmName` and used it both as the page title and for the delete call,
so deleting a realm whose display name differs from its name sent
DELETE /admin/realms/{displayName} and failed with a 404.
Pass the display name separately for the title and keep the realm name
for the delete call.
Closes#51498
Claude-Session: https://claude.ai/code/session_01CFRv5kvesfnKYgHmNw9Vpf
Signed-off-by: Aloys Jehwin <aloysjehwin@gmail.com>
clickSaveMapper() checked for a /mappers(/:id) URL, which the add-mapper
page (/mappers/create) already matches. The helper then clicked Cancel
before react-hook-form had sent the create request, so the mapper was
never saved and the row assertion failed intermittently.
Fixes#53252
Assisted-by: Claude Opus 5.5
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
* Use prefix search in the admin console user picker
The shared UserSelect component searched with username=, which the LDAP
provider always turns into a contains filter with a leading wildcard
(cn=*term*). Directory servers cannot use an attribute index for that
filter, so on large LDAP/Active Directory realms the Evaluate tabs, user
policy and permission pickers took minutes or timed out, while the same
term on the Users page returned immediately.
Searching with search= gives the same prefix match the Users page uses,
for both LDAP and the database provider. Because that search also
matches email and first/last name, options now show those as a
description, and the help text explains the search syntax.
Fixes#53220
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
* Test searching the user picker by email and last name
The existing picker tests select users by exact username, which the
picker's parallel exact-username lookup satisfies even if the paged
search query regresses. Search for a user whose username shares no
prefix with its email or name, so the test only passes when the picker
uses the search= prefix match.
Fixes#53220
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
---------
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
The enabled/disabled toggle in the user federation provider header was
always interactive, even for users with only view-realm access, while
the rest of the provider form is already gated behind manage-realm via
FormAccess. Gate the toggle with the same manage-realm check so it is
read-only for users who cannot manage the realm.
Closes#51269
Signed-off-by: Oleksii Udovychenko <1110375+oleksii-udovychenko@users.noreply.github.com>
* Prevent LDAP bind credentials from being sent to a changed server
- this change adds validation on both the save and test paths to reject requests where the URL or Bind DN changed while the credential is still the placeholder
- the admin UI now also clears the credential field when either value changes, prompting re-entry
Closes#47295Closes#51146
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
* Ensure URL change is rejected when bind credential is omitted (placeholder sent)
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
* Ensure authType change to NONE can't be used to bypass URL change validation
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
---------
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
