Viewing a user's sessions, offline sessions and consents only required
permission to view the user, so an admin without view permission on a
client could still read its UUID, clientId and the user's grants for it.
The same leak existed in the Admin UI sessions list and in the other
clients listed in a client's session endpoints.
Fixes#50981
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Signed-off-by: Tomas Kyjovsky <tkyjovsk@ibm.com>
Co-authored-by: Tomas Kyjovsky <tkyjovsk@ibm.com>
* Filter authentication flow usage by client and IdP view permissions
The Admin UI authentication-flow endpoints only require permission to
view authentication flows, which view-realm grants. They reported every
client and identity provider bound to a flow, so an admin without
view-clients or view-identity-providers could enumerate clients and
providers that the regular admin endpoints hide from them.
Fixes#50983
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
* Test flow usage filtering with fine-grained client permissions
The existing tests only covered admins with no client access or with
view-clients, so they would still pass if filtering ran after the
summary cap or after paging. Grant view on a single client through
fine-grained admin permissions, with more hidden clients sorting ahead
of it than the cap and page size, so both endpoints must filter first.
Fixes#50983
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5
---------
Signed-off-by: Stan Silvert <ssilvert@redhat.com>
* fix: re-using the AdminRoot authentication
also making the mutative operation checks consistent
closes: #52099
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* addressing review comments
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* existence is checked by the rest layer
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* Admin v2: Mask client secrets for view-only users
When a user lacks manage permission on a client, strip client secrets
from GET /clients/{client} and GET /clients responses to match v1 behavior.
Closes#52197
Signed-off-by: Shatrughan Rai <polyglot.dev@outlook.com>
# Conflicts:
# rest/admin-v2/services/src/main/java/org/keycloak/services/client/DefaultClientService.java
* Refactor getClientListSecretMaskedForViewOnly test
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Shatrughan Rai <polyglot.dev@outlook.com>
* Fix: test scope
fixes an unclosed Stream in the authorization test by wrapping it
in try-with-resources, matching the pattern used in tests.
Fixes: keycloak/keycloak#52197
Signed-off-by: Shatrughan Rai <polyglot.dev@outlook.com>
* moving the fix to the new client resource type
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Shatrughan Rai <polyglot.dev@outlook.com>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
* refactor: adding all fields to Schema classes
closes: #51326
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* removing the model mapper classes
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
---------
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
* Initial plan
* Fix SAML null attribute removal in SAMLClientModelMapper
When a SAML client attribute is set to null (via PATCH with explicit null
or PUT omitting the field), the v2 mapper now removes the corresponding
model attribute instead of silently ignoring the null value.
Previously, `setAttributeIfNotNull` and `setBooleanAttributeIfNotNull`
would skip null values, leaving stale attributes (e.g. signingCertificate)
in place. This was a security concern since an administrator who PATCHed
`signingCertificate: null` would receive a 200 but the old certificate
would still be trusted for SAML signature verification.
Closes#51213
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* decouple ListOptions from Client fields
Introduce a resource-agnostic SortField marker interface + a
SortFieldResolver<F> functional interface, make SortOption generic over
F extends SortField, and split ListOptions sort parsing into two phases
fixes: #50558
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* fix rebase
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
* use cache map to lookup enum fields
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
---------
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
Add the admin-permissions and _system clients to Constants.defaultClients so the existing ClientManager.isInternalClient check in removeClient blocks their deletion, returning a 400 "Could not delete client" like the other built-in clients (account, realm-management, etc.). This fixes the admin-permissions client previously returning "unknown_error" on the v1 Admin API.
Closes#49674
Signed-off-by: Muhammed Oguz <muhammed@keymate.io>
- This PR addresses remaining refinements for Keycloak 26.7.0 together, as they are all touching same areas and we are on schedule
- Closes: https://github.com/keycloak/keycloak/issues/47497
- Closes: https://github.com/keycloak/keycloak/issues/47493
- Closes: https://github.com/keycloak/keycloak/issues/47496
- Minor fixes:
- Enum values must listed in the option help
- Editor must appear in the `config` command help
- help command must be invoked regardless of its position for the root command and `config` command to aling with the rest of v2 commands and also it makes sense to show help for commands like `kcadm.sh --v2 --help client` and `--v2 config --help editor`, for we show `--help` in the autocomplete
Only for testing this with `999.0.0-SNAPSHOT`, if you previously had a descriptor with the `999.0.0-SNAPSHOT` version, I recommend to login first (use `config credentials`) so that you have updated descriptor first (and thus, correct help).
Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
