8000 [26.8] Enforce the essential acr level when the flow finishes without a step-up by michalvavrik · Pull Request #54345 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[26.8] Enforce the essential acr level when the flow finishes without a step-up - #54345

Merged
rmartinc merged 3 commits into
keycloak:release/26.8from
michalvavrik:backports-26.8/53157
Nov 12, 2026
Merged

[26.8] Enforce the essential acr level when the flow finishes without a step-up#54345
rmartinc merged 3 commits into
keycloak:release/26.8from
michalvavrik:backports-26.8/53157

Conversation

@michalvavrik
@michalvavrik michalvavrik commented Oct 26, 2026
Copy link
Copy Markdown
Member

@michalvavrik
michalvavrik requested review from a team as code owners October 26, 2026 15:28
@michalvavrik
[26.8] fix: enforce the essential acr level when the flow finishes wi…
be15078 
…thout a step-up

closes: keycloak#53157
backports: keycloak#53587

Signed-off-by: Michal Vavřík <dev@michalvavrik.net>
@michalvavrik
michalvavrik commented Oct 26, 2026
Copy link
Copy Markdown
Member Author

The failure doesn't seem related.

@michalvavrik michalvavrik mentioned this pull request Oct 26, 2026
Merged
@mabartos mabartos linked an issue Oct 27, 2026 that may be closed by this pull request
[CVE-2026-97176] Essential (forced) acr requirement silently bypassed when a browser flow re-evaluates an already active session with no interactive step #53157
Closed
mabartos
mabartos previously approved these changes Oct 27, 2026
View reviewed changes
@mabartos
Merge branch 'release/26.8' into backports-26.8/53157
9ad1e0d 
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
mabartos
mabartos previously approved these changes Nov 10, 2026
View reviewed changes
rmartinc
rmartinc previously approved these changes Nov 12, 2026
View reviewed changes
@rmartinc rmartinc left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @michalvavrik and @mabartos!

@rmartinc
Merge branch 'release/26.8' into backports-26.8/53157
dbddd59 
Signed-off-by: Ricardo Martin <rmartinc@redhat.com>
@rmartinc
rmartinc dismissed stale reviews from mabartos and themself via dbddd59 November 12, 2026 15:09
@rmartinc
rmartinc commented Nov 12, 2026
Copy link
Copy Markdown
Contributor

I have fixed the notes conflict. Adding auto-merge for the PR.

@rmartinc
rmartinc enabled auto-merge (squash) November 12, 2026 15:10
@keycloak-github-bot
keycloak-github-bot Bot commented Nov 12, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.46.0', revision: 'df5a634 df5a6341cbb5f8f06b836bd595752775627c80dc'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.21'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SamlXMLAttacksTest#

Keycloak CI - Adapter IT Strict Cookies

org.jboss.arquillian.container.spi.client.container.LifecycleException: Could not stop container
	at org.jboss.as.arquillian.container.CommonManagedDeployableContainer.stopInternal(CommonManagedDeployableContainer.java:234)
	at org.jboss.as.arquillian.container.CommonDeployableContainer.stop(CommonDeployableContainer.java:143)
	at org.jboss.arquillian.container.impl.ContainerImpl.stop(ContainerImpl.java:199)
	at org.jboss.arquillian.container.impl.client.container.ContainerLifecycleController$9.perform(ContainerLifecycleController.java:148)
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Nov 12, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@rmartinc
rmartinc merged commit df20572 into keycloak:release/26.8 Nov 12, 2026
91 checks passed
@michalvavrik
michalvavrik deleted the backports-26.8/53157 branch November 12, 2026 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rmartinc rmartinc rmartinc approved these changes
@mabartos mabartos mabartos left review comments
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test

Projects

None yet

Milestone

No milestone

3 participants

@michalvavrik @rmartinc @mabartos
0