mirror of
https://github.com/keycloak/keycloak.git
synced 2026-10-23 19:29:23 +03:00
d716581723
* SSF: Reject mismatched user+tenant subjects in synthetic SSF emit (#50812) A complex sub_id combining an unsubscribed user with a subscribed but unrelated tenant organization previously dispatched, because the emitter's subscription gate treated the tenant facet as an independent allow signal. Now every supplied user/tenant facet must resolve (via the shared SubjectResolver tenant contract), the user must be a member of the tenant organization, per-user include/ignore settings take precedence over org subscriptions, and org-level gates scan all of the user's memberships, mirroring the native dispatcher's subject filter. Fixes #50812 Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> * Additional EventEmitterService changes Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> * SSF: Surface structured params for synthetic-emit subject errors We now ship a machine-readable params map with emit failures so clients don't have to parse the English error_description: complex-subject resolution failures carry params.subjectMember ("user"|"tenant") to discriminate the two subject_not_found cases, and subject_mismatch carries the resolved user/tenant pairing. Wire subject_mismatch and the new params into the admin console's translateEmitError with English message keys. Align terminology with SSF 1.0 §3.3: "facet" -> "subject member" throughout the SSF modules, tests, and admin console. Follow-up to #50815 review feedback. Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> * SSF: Only resolve tenant subjects from validated namespaces The shared tenant resolver accepted an iss_sub subject by sub alone and any https URI by its last path segment, so an emitter could pair a foreign issuer or URI with a local organization and have the verbatim sub_id signed into a SET asserting an identity Keycloak never checked. Require the realm's own issuer for iss_sub tenants (no IdP fallback as organizations have no federated analog) and restrict the uri format to urn:keycloak:org:<alias>. Follow-up to #50815 review feedback. Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> * SSF: Make tenant subject resolution unambiguous Every tenant identifier now states its lookup kind: opaque and iss_sub values resolve strictly by internal org id, and URI tenants require an explicit segment — urn:keycloak:org:alias:<alias> or urn:keycloak:org🆔<id> — with no cross-fallback. The bare urn:keycloak:org:<value> shorthand and all alias/id lookup heuristics are gone, so a UUID-shaped alias can never shadow another org's id. Keycloak's own producers (admin emit shorthand, SET token mapper) serialize the self-describing alias URN instead of a raw alias in an opaque id, keeping the wire value human-readable without exposing internal UUIDs. Follow-up to #50815 review feedback. Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> * SSF: Narrow overstated subject-member guarantee in emit comment Only user and tenant members of a complex sub_id are resolved and gated; the remaining members are forwarded unvalidated — session and group have Keycloak-side counterparts but are currently not mapped, device/application/org_unit have nothing to resolve against. Follow-up to #50815 review feedback. Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> * SSF: Omit resolved identifiers from subject_mismatch emit response The emit endpoint is callable by service accounts holding only the configured emit role, so echoing the resolved username and organization alias for otherwise-opaque submitted ids disclosed realm metadata. Keep the stable error code and generic message; the admin console renders a generic translated mismatch message. Params must never carry resolved entity data. Follow-up to #50815 review feedback. Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com> --------- Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>