keycloak

mirror of https://github.com/keycloak/keycloak.git synced 2026-10-23 19:29:23 +03:00

Files

Stan Silvert 0b881862c6 Authorize receiver-driven SSF subject adds per subject (#53765 )

* Authorize receiver-driven SSF subject adds per subject

Any SSF receiver with ssf.manage could subscribe to security events for
every user in the realm, since subjects/add only verified stream
ownership. Receiver adds are now gated by ssf.receiverSubjectAddPolicy
(AUTHENTICATED by default, ANY, NONE), and can no longer override a
subject an administrator explicitly ignored.

Fixes #53695

Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5

* Ignore expired sessions in the SSF AUTHENTICATED add check

Session streams can return user and client sessions past their idle or
max lifespan, so an expired relationship still let a receiver add the
user. Require the same session validity checks as token refresh.

Also restore the default add policy in test cleanup by blanking the
attribute: a client update keeps attributes omitted from the
representation, so ANY/NONE leaked into later tests.

Fixes #53695

Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5.5

---------

Signed-off-by: Stan Silvert <ssilvert@redhat.com>

2026-10-14 14:45:17 -04:00