diff --git a/adapters/pom.xml b/adapters/pom.xml index a82799bcd314..e1316c93034d 100755 --- a/adapters/pom.xml +++ b/adapters/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Adapters diff --git a/adapters/saml/core-public/pom.xml b/adapters/saml/core-public/pom.xml index 94d354283e18..7627aed36ea3 100755 --- a/adapters/saml/core-public/pom.xml +++ b/adapters/saml/core-public/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml 4.0.0 diff --git a/adapters/saml/core/pom.xml b/adapters/saml/core/pom.xml index 0abc99412056..fc7db5529447 100755 --- a/adapters/saml/core/pom.xml +++ b/adapters/saml/core/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml 4.0.0 diff --git a/adapters/saml/pom.xml b/adapters/saml/pom.xml index 0f46c3a97bfa..27cac5eff89f 100755 --- a/adapters/saml/pom.xml +++ b/adapters/saml/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml Keycloak SAML Client Adapter Modules diff --git a/adapters/saml/wildfly-elytron/pom.xml b/adapters/saml/wildfly-elytron/pom.xml index 56c7c05de32a..ca9138f58f4f 100755 --- a/adapters/saml/wildfly-elytron/pom.xml +++ b/adapters/saml/wildfly-elytron/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml 4.0.0 diff --git a/adapters/saml/wildfly/pom.xml b/adapters/saml/wildfly/pom.xml index f1b3048e711c..380b9c89f3cb 100755 --- a/adapters/saml/wildfly/pom.xml +++ b/adapters/saml/wildfly/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml Keycloak SAML Wildfly Integration diff --git a/adapters/saml/wildfly/wildfly-subsystem/pom.xml b/adapters/saml/wildfly/wildfly-subsystem/pom.xml index 90b38b0f7462..3436f6b9749c 100755 --- a/adapters/saml/wildfly/wildfly-subsystem/pom.xml +++ b/adapters/saml/wildfly/wildfly-subsystem/pom.xml @@ -21,7 +21,7 @@ org.keycloak keycloak-parent - 999.0.0-SNAPSHOT + 26.1.2 ../../../../pom.xml diff --git a/adapters/spi/adapter-spi/pom.xml b/adapters/spi/adapter-spi/pom.xml index 8c2206c57dd9..f9e476ac69e6 100755 --- a/adapters/spi/adapter-spi/pom.xml +++ b/adapters/spi/adapter-spi/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml 4.0.0 diff --git a/adapters/spi/jboss-adapter-core/pom.xml b/adapters/spi/jboss-adapter-core/pom.xml index 6978a6d20c9b..8117925f9004 100755 --- a/adapters/spi/jboss-adapter-core/pom.xml +++ b/adapters/spi/jboss-adapter-core/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml 4.0.0 diff --git a/adapters/spi/pom.xml b/adapters/spi/pom.xml index cdfe1b127ff3..a4ddea1f68c3 100755 --- a/adapters/spi/pom.xml +++ b/adapters/spi/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml Keycloak Client Adapter SPI Modules diff --git a/authz/client/pom.xml b/authz/client/pom.xml index 05889a050411..5cca2bc21656 100644 --- a/authz/client/pom.xml +++ b/authz/client/pom.xml @@ -7,7 +7,7 @@ org.keycloak keycloak-authz-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/authz/policy/common/pom.xml b/authz/policy/common/pom.xml index eb1e18fbe74d..1318d8dbf62d 100644 --- a/authz/policy/common/pom.xml +++ b/authz/policy/common/pom.xml @@ -25,7 +25,7 @@ org.keycloak keycloak-authz-provider-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java index 8b9e3c1c9653..5aa5b68ddc5e 100644 --- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java +++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java @@ -42,6 +42,7 @@ import java.util.LinkedHashSet; import java.util.Map; import java.util.Set; +import java.util.regex.Pattern; import java.util.stream.Collectors; /** @@ -210,6 +211,8 @@ private Set getRoles(String rawRoles, RealmModel realm) { return Collections.emptySet(); } + public static final Pattern UUID_PATTERN = Pattern.compile("[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}"); + private RoleModel getRole(RolePolicyRepresentation.RoleDefinition definition, RealmModel realm) { String roleName = definition.getId(); String clientId = null; @@ -223,10 +226,13 @@ private RoleModel getRole(RolePolicyRepresentation.RoleDefinition definition, Re RoleModel role; if (clientId == null) { - role = realm.getRole(roleName); + // if the role name looks like a UUID, it is likely that it is a role ID. Then do this look-up first to avoid hitting the database twice + // TODO: In a future version of the auth feature, make this more strict to avoid the double lookup and any ambiguity + boolean looksLikeAUuid = UUID_PATTERN.matcher(roleName).matches(); + role = looksLikeAUuid ? realm.getRoleById(roleName) : realm.getRole(roleName); if (role == null) { - role = realm.getRoleById(roleName); + role = !looksLikeAUuid ? realm.getRoleById(roleName) : realm.getRole(roleName);; } } else { ClientModel client = realm.getClientByClientId(clientId); diff --git a/authz/policy/pom.xml b/authz/policy/pom.xml index 48091592faad..764357b94397 100644 --- a/authz/policy/pom.xml +++ b/authz/policy/pom.xml @@ -7,7 +7,7 @@ org.keycloak keycloak-authz-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/authz/pom.xml b/authz/pom.xml index 711d68b47108..fd33a2a50ae0 100644 --- a/authz/pom.xml +++ b/authz/pom.xml @@ -7,7 +7,7 @@ org.keycloak keycloak-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/boms/pom.xml b/boms/pom.xml index 4d105b60615e..f13a4e51e1cd 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -27,7 +27,7 @@ org.keycloak.bom keycloak-bom-parent - 999.0.0-SNAPSHOT + 26.1.2 pom diff --git a/boms/spi/pom.xml b/boms/spi/pom.xml index 339c18bb3033..45d160408426 100644 --- a/boms/spi/pom.xml +++ b/boms/spi/pom.xml @@ -23,7 +23,7 @@ org.keycloak.bom keycloak-bom-parent - 999.0.0-SNAPSHOT + 26.1.2 org.keycloak.bom diff --git a/common/pom.xml b/common/pom.xml index 1fea851011f7..8b6de3354752 100755 --- a/common/pom.xml +++ b/common/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/core/pom.xml b/core/pom.xml index 8363871a6732..b67de3da49d8 100755 --- a/core/pom.xml +++ b/core/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/crypto/default/pom.xml b/crypto/default/pom.xml index 2b0cf1fb234f..624052988121 100644 --- a/crypto/default/pom.xml +++ b/crypto/default/pom.xml @@ -21,7 +21,7 @@ keycloak-crypto-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/crypto/elytron/pom.xml b/crypto/elytron/pom.xml index 51b7d6dbeac7..489255cb4a78 100644 --- a/crypto/elytron/pom.xml +++ b/crypto/elytron/pom.xml @@ -21,7 +21,7 @@ keycloak-crypto-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/crypto/fips1402/pom.xml b/crypto/fips1402/pom.xml index dab8c4724be3..45eb73059943 100644 --- a/crypto/fips1402/pom.xml +++ b/crypto/fips1402/pom.xml @@ -21,7 +21,7 @@ keycloak-crypto-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/crypto/pom.xml b/crypto/pom.xml index de2f6d339653..258c860fc6f4 100644 --- a/crypto/pom.xml +++ b/crypto/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Crypto Parent diff --git a/dependencies/pom.xml b/dependencies/pom.xml index 019146bf55c3..62065eb4d600 100755 --- a/dependencies/pom.xml +++ b/dependencies/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/dependencies/server-all/pom.xml b/dependencies/server-all/pom.xml index 40825859ef61..afa132d58ddd 100755 --- a/dependencies/server-all/pom.xml +++ b/dependencies/server-all/pom.xml @@ -21,7 +21,7 @@ keycloak-dependencies-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/dependencies/server-min/pom.xml b/dependencies/server-min/pom.xml index 5388210a0050..099a46db8b9a 100755 --- a/dependencies/server-min/pom.xml +++ b/dependencies/server-min/pom.xml @@ -21,7 +21,7 @@ keycloak-dependencies-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/distribution/api-docs-dist/pom.xml b/distribution/api-docs-dist/pom.xml index 49cef2855b5b..ff443d10b754 100755 --- a/distribution/api-docs-dist/pom.xml +++ b/distribution/api-docs-dist/pom.xml @@ -21,7 +21,7 @@ keycloak-distribution-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-api-docs-dist diff --git a/distribution/downloads/pom.xml b/distribution/downloads/pom.xml index 3651b049e9b5..c4b2df32dadd 100755 --- a/distribution/downloads/pom.xml +++ b/distribution/downloads/pom.xml @@ -21,7 +21,7 @@ keycloak-distribution-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-dist-downloads diff --git a/distribution/galleon-feature-packs/pom.xml b/distribution/galleon-feature-packs/pom.xml index eb2026a1eeb2..59316e5d2cb7 100644 --- a/distribution/galleon-feature-packs/pom.xml +++ b/distribution/galleon-feature-packs/pom.xml @@ -20,7 +20,7 @@ keycloak-distribution-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 Galleon Feature Pack Builds diff --git a/distribution/galleon-feature-packs/saml-adapter-galleon-pack-layer-metadata-tests/pom.xml b/distribution/galleon-feature-packs/saml-adapter-galleon-pack-layer-metadata-tests/pom.xml index d9d706e53e88..5af170713310 100644 --- a/distribution/galleon-feature-packs/saml-adapter-galleon-pack-layer-metadata-tests/pom.xml +++ b/distribution/galleon-feature-packs/saml-adapter-galleon-pack-layer-metadata-tests/pom.xml @@ -19,7 +19,7 @@ org.keycloak galleon-feature-packs-parent - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/distribution/galleon-feature-packs/saml-adapter-galleon-pack/pom.xml b/distribution/galleon-feature-packs/saml-adapter-galleon-pack/pom.xml index 37978951b2ee..d0f7fe53ef02 100644 --- a/distribution/galleon-feature-packs/saml-adapter-galleon-pack/pom.xml +++ b/distribution/galleon-feature-packs/saml-adapter-galleon-pack/pom.xml @@ -19,7 +19,7 @@ org.keycloak galleon-feature-packs-parent - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/distribution/licenses-common/pom.xml b/distribution/licenses-common/pom.xml index bf615a63ee6f..e2794141c358 100644 --- a/distribution/licenses-common/pom.xml +++ b/distribution/licenses-common/pom.xml @@ -20,7 +20,7 @@ keycloak-distribution-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-distribution-licenses-common diff --git a/distribution/maven-plugins/licenses-processor/pom.xml b/distribution/maven-plugins/licenses-processor/pom.xml index 547d24d96374..00b1323e7ead 100644 --- a/distribution/maven-plugins/licenses-processor/pom.xml +++ b/distribution/maven-plugins/licenses-processor/pom.xml @@ -20,7 +20,7 @@ keycloak-distribution-maven-plugins-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-distribution-licenses-maven-plugin diff --git a/distribution/maven-plugins/pom.xml b/distribution/maven-plugins/pom.xml index 0658ad683770..ab160fb93979 100644 --- a/distribution/maven-plugins/pom.xml +++ b/distribution/maven-plugins/pom.xml @@ -20,7 +20,7 @@ keycloak-distribution-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-distribution-maven-plugins-parent diff --git a/distribution/pom.xml b/distribution/pom.xml index d2b8affb0c08..4b190f689ce7 100755 --- a/distribution/pom.xml +++ b/distribution/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/distribution/saml-adapters/pom.xml b/distribution/saml-adapters/pom.xml index e0bf923961d4..915d8012a93a 100755 --- a/distribution/saml-adapters/pom.xml +++ b/distribution/saml-adapters/pom.xml @@ -20,7 +20,7 @@ keycloak-distribution-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 SAML Adapters Distribution Parent diff --git a/distribution/saml-adapters/wildfly-adapter/pom.xml b/distribution/saml-adapters/wildfly-adapter/pom.xml index b019240ae075..5135cb6cce60 100755 --- a/distribution/saml-adapters/wildfly-adapter/pom.xml +++ b/distribution/saml-adapters/wildfly-adapter/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../pom.xml Keycloak Wildfly SAML Adapter diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml index d503885a0fb5..3c19cab550b5 100755 --- a/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml +++ b/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../../pom.xml diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml index 8d7e26856ae9..6f9297ca8bb9 100755 --- a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml +++ b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml @@ -25,7 +25,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../../../pom.xml diff --git a/docs/documentation/aggregation/pom.xml b/docs/documentation/aggregation/pom.xml index 778c61ef0ee9..040c4069aff4 100644 --- a/docs/documentation/aggregation/pom.xml +++ b/docs/documentation/aggregation/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/api_documentation/pom.xml b/docs/documentation/api_documentation/pom.xml index 580cefbb335e..95c7fd5690b6 100644 --- a/docs/documentation/api_documentation/pom.xml +++ b/docs/documentation/api_documentation/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/authorization_services/pom.xml b/docs/documentation/authorization_services/pom.xml index 6e1042aa8410..fd584d18ead9 100644 --- a/docs/documentation/authorization_services/pom.xml +++ b/docs/documentation/authorization_services/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/dist/pom.xml b/docs/documentation/dist/pom.xml index 7ae91bdb25a5..d9c6c9d81af2 100644 --- a/docs/documentation/dist/pom.xml +++ b/docs/documentation/dist/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/header-maven-plugin/pom.xml b/docs/documentation/header-maven-plugin/pom.xml index 0bd4fe40645d..e14cb3406efe 100644 --- a/docs/documentation/header-maven-plugin/pom.xml +++ b/docs/documentation/header-maven-plugin/pom.xml @@ -5,12 +5,12 @@ documentation-parent org.keycloak.documentation - 999.0.0-SNAPSHOT + 26.1.2 org.keycloak.documentation header-maven-plugin - 999.0.0-SNAPSHOT + 26.1.2 maven-plugin github-maven-plugin diff --git a/docs/documentation/pom.xml b/docs/documentation/pom.xml index 24fe1917d0d5..1ad3e0e19b9e 100644 --- a/docs/documentation/pom.xml +++ b/docs/documentation/pom.xml @@ -5,14 +5,14 @@ keycloak-docs-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Documentation Parent org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 pom diff --git a/docs/documentation/release_notes/pom.xml b/docs/documentation/release_notes/pom.xml index 57d62bebae50..89c043299f39 100644 --- a/docs/documentation/release_notes/pom.xml +++ b/docs/documentation/release_notes/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/release_notes/topics/26_1_0.adoc b/docs/documentation/release_notes/topics/26_1_0.adoc index cd8172c95f1d..80b00b3043e5 100644 --- a/docs/documentation/release_notes/topics/26_1_0.adoc +++ b/docs/documentation/release_notes/topics/26_1_0.adoc @@ -15,7 +15,7 @@ See the https://www.keycloak.org/server/caching[Configuring distributed caches] = Virtual Threads enabled for Infinispan and JGroups thread pools -Starting from this release, {project_name} automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups when running on OpenJDK 21. +Starting from this release, {project_name} automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups when running on OpenJDK 21 for environments with at least 2 CPU cores available. This removes the need to configure the JGroups thread pool, the need to align the JGroups thread pool with the HTTP worker thread pool, and reduces the overall memory footprint. = OpenTelemetry Tracing supported diff --git a/docs/documentation/server_admin/pom.xml b/docs/documentation/server_admin/pom.xml index cb0c3fdffef2..5f506b8da9e1 100644 --- a/docs/documentation/server_admin/pom.xml +++ b/docs/documentation/server_admin/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/server_development/pom.xml b/docs/documentation/server_development/pom.xml index 6e0ec2e820c6..f4b5a5c926d2 100644 --- a/docs/documentation/server_development/pom.xml +++ b/docs/documentation/server_development/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/tests/pom.xml b/docs/documentation/tests/pom.xml index a8d4ec97ce72..32769f5f4343 100644 --- a/docs/documentation/tests/pom.xml +++ b/docs/documentation/tests/pom.xml @@ -59,7 +59,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/documentation/topics/templates/document-attributes.adoc b/docs/documentation/topics/templates/document-attributes.adoc index d7522a7a1e0c..647ef13f70ce 100644 --- a/docs/documentation/topics/templates/document-attributes.adoc +++ b/docs/documentation/topics/templates/document-attributes.adoc @@ -2,10 +2,10 @@ :project_name_full: Keycloak :project_community: true :project_product: false -:project_version: DEV -:project_versionMvn: 999.0.0-SNAPSHOT -:project_versionNpm: 999.0.0-SNAPSHOT -:project_versionDoc: DEV +:project_version: 26.1.2 +:project_versionMvn: 26.1.2 +:project_versionNpm: 26.1.2 +:project_versionDoc: 26.1.2 :archivebasename: keycloak :archivedownloadurl: https://github.com/keycloak/keycloak/releases/download/{project_version}/keycloak-{project_version}.zip diff --git a/docs/documentation/upgrading/pom.xml b/docs/documentation/upgrading/pom.xml index 9c081109a538..4af908730ed4 100644 --- a/docs/documentation/upgrading/pom.xml +++ b/docs/documentation/upgrading/pom.xml @@ -5,7 +5,7 @@ org.keycloak.documentation documentation-parent - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/guides/high-availability/concepts-threads.adoc b/docs/guides/high-availability/concepts-threads.adoc index baaac0932c55..f707a280f143 100644 --- a/docs/guides/high-availability/concepts-threads.adoc +++ b/docs/guides/high-availability/concepts-threads.adoc @@ -17,7 +17,7 @@ For a configuration where this is applied, visit <@links.ha id="deploy-keycloak- // remove this paragraph once OpenJDK 17 is no longer supported on the server side. // https://github.com/keycloak/keycloak/issues/31101 -JGroups communications, which is used in single-site setups for the communication between {project_name} nodes, benefits from the use of virtual threads which are available in OpenJDK 21. +JGroups communications, which is used in single-site setups for the communication between {project_name} nodes, benefits from the use of virtual threads which are available in OpenJDK 21 when at least two cores are available for {project_name}. This reduces the memory usage and removes the need to configure thread pool sizes. Therefore, the use of OpenJDK 21 is recommended. diff --git a/docs/guides/pom.xml b/docs/guides/pom.xml index dde0fa3350ad..4e178d335b16 100644 --- a/docs/guides/pom.xml +++ b/docs/guides/pom.xml @@ -19,7 +19,7 @@ keycloak-docs-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/guides/server/caching.adoc b/docs/guides/server/caching.adoc index 3f551efd4d99..39e44dced7eb 100644 --- a/docs/guides/server/caching.adoc +++ b/docs/guides/server/caching.adoc @@ -317,14 +317,14 @@ The table below shows the TCP ports that need to be open for the `jdbc-ping` sta |Port |Property | Description m|7800 -m|jgroups.bind.address +m|jgroups.bind.port |Unicast data transmission. m|57800 m|jgroups.fd.port-offset |Failure detection by protocol `FD_SOCK2`. It listens to the abrupt closing of a socket to suspect a {project_name} server failure. -The `jgroups.fd.port-offset` property defines the offset from the `jgroups.bind.address`. +The `jgroups.fd.port-offset` property defines the offset from the `jgroups.bind.port`. |=== @@ -348,6 +348,26 @@ To set up for IPv6 only and have {project_name} pick the bind address automatica export JAVA_OPTS_APPEND="-Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true" ---- +== Running instances on different networks + +If you run {project_name} instances on different networks, for example behind firewalls or in containers, the different instances will not be able to reach each other by their local IP address. +In such a case, set up a port forwarding rule (sometimes called "`virtual server`") to their local IP address. + +When using port forwarding, use the following properties so each node correctly advertises its external address to the other nodes: + +|=== +|Property | Description + +m|jgroups.external_port +|Port that other instances in the {project_name} cluster should use to contact this node. + +m|jgroups.external_addr +|IP address that other instances in the {project_name} should use to contact this node. + +|=== + +NOTE: Use `-D=` set this in your `JAVA_OPTS_APPEND` environment variable or in your CLI command. + == Exposing metrics from caches Metrics from caches are automatically exposed when the metrics are enabled. diff --git a/docs/maven-plugin/pom.xml b/docs/maven-plugin/pom.xml index e2953f6f89db..e69706368f74 100644 --- a/docs/maven-plugin/pom.xml +++ b/docs/maven-plugin/pom.xml @@ -20,7 +20,7 @@ keycloak-docs-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/docs/pom.xml b/docs/pom.xml index 35f5dfa64ff6..4b66e6ea5d6a 100644 --- a/docs/pom.xml +++ b/docs/pom.xml @@ -19,7 +19,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Docs Parent diff --git a/federation/ipatuura/pom.xml b/federation/ipatuura/pom.xml index 5153d42c3cb9..bb4c9f8866ee 100644 --- a/federation/ipatuura/pom.xml +++ b/federation/ipatuura/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml 4.0.0 diff --git a/federation/kerberos/pom.xml b/federation/kerberos/pom.xml index 95e483b06bf3..29d1cfece9ff 100755 --- a/federation/kerberos/pom.xml +++ b/federation/kerberos/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml 4.0.0 diff --git a/federation/ldap/pom.xml b/federation/ldap/pom.xml index 25d4e22833a4..04d3ef71a37d 100755 --- a/federation/ldap/pom.xml +++ b/federation/ldap/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml 4.0.0 diff --git a/federation/pom.xml b/federation/pom.xml index 662c1f5a77e7..abdfa70a9368 100755 --- a/federation/pom.xml +++ b/federation/pom.xml @@ -22,7 +22,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/federation/sssd/pom.xml b/federation/sssd/pom.xml index 6f1b1ee0361e..f1b7dfdf5a2f 100644 --- a/federation/sssd/pom.xml +++ b/federation/sssd/pom.xml @@ -4,7 +4,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml 4.0.0 diff --git a/integration/admin-client/pom.xml b/integration/admin-client/pom.xml index b818b72628e7..83ecf245a510 100755 --- a/integration/admin-client/pom.xml +++ b/integration/admin-client/pom.xml @@ -22,7 +22,7 @@ keycloak-integration-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/integration/client-cli/admin-cli/pom.xml b/integration/client-cli/admin-cli/pom.xml index d7ca8276dae6..46071b4d334a 100755 --- a/integration/client-cli/admin-cli/pom.xml +++ b/integration/client-cli/admin-cli/pom.xml @@ -21,7 +21,7 @@ keycloak-client-cli-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/integration/client-cli/client-cli-dist/pom.xml b/integration/client-cli/client-cli-dist/pom.xml index 679d8647b605..7308813bc384 100755 --- a/integration/client-cli/client-cli-dist/pom.xml +++ b/integration/client-cli/client-cli-dist/pom.xml @@ -21,7 +21,7 @@ keycloak-client-cli-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-client-cli-dist diff --git a/integration/client-cli/pom.xml b/integration/client-cli/pom.xml index c751fb955906..6a5d4247c724 100644 --- a/integration/client-cli/pom.xml +++ b/integration/client-cli/pom.xml @@ -20,7 +20,7 @@ keycloak-integration-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 Keycloak Client CLI diff --git a/integration/client-registration/pom.xml b/integration/client-registration/pom.xml index c272b5814b53..aa0e3c1ac04c 100755 --- a/integration/client-registration/pom.xml +++ b/integration/client-registration/pom.xml @@ -21,7 +21,7 @@ keycloak-integration-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/integration/pom.xml b/integration/pom.xml index 3881051a2f84..f892334d8c01 100755 --- a/integration/pom.xml +++ b/integration/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Integration diff --git a/js/apps/account-ui/package.json b/js/apps/account-ui/package.json index bd2d88d777fb..c9a865dc28fd 100644 --- a/js/apps/account-ui/package.json +++ b/js/apps/account-ui/package.json @@ -1,6 +1,6 @@ { "name": "@keycloak/keycloak-account-ui", - "version": "999.0.0-SNAPSHOT", + "version": "26.1.2", "type": "module", "main": "lib/keycloak-account-ui.js", "types": "./lib/keycloak-account-ui.d.ts", diff --git a/js/apps/account-ui/pom.xml b/js/apps/account-ui/pom.xml index 855adaa460dd..bec5ec69b44b 100644 --- a/js/apps/account-ui/pom.xml +++ b/js/apps/account-ui/pom.xml @@ -7,7 +7,7 @@ keycloak-js-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml diff --git a/js/apps/admin-ui/package.json b/js/apps/admin-ui/package.json index 29ef81192432..7ca3f922fb28 100644 --- a/js/apps/admin-ui/package.json +++ b/js/apps/admin-ui/package.json @@ -1,6 +1,6 @@ { "name": "@keycloak/keycloak-admin-ui", - "version": "999.0.0-SNAPSHOT", + "version": "26.1.2", "type": "module", "main": "lib/keycloak-admin-ui.js", "types": "./lib/keycloak-admin-ui.d.ts", diff --git a/js/apps/admin-ui/pom.xml b/js/apps/admin-ui/pom.xml index c595c33f8e0a..7cc0f8988a8c 100644 --- a/js/apps/admin-ui/pom.xml +++ b/js/apps/admin-ui/pom.xml @@ -7,7 +7,7 @@ keycloak-js-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml diff --git a/js/libs/keycloak-admin-client/package.json b/js/libs/keycloak-admin-client/package.json index 083574137a50..949bc1487867 100644 --- a/js/libs/keycloak-admin-client/package.json +++ b/js/libs/keycloak-admin-client/package.json @@ -1,6 +1,6 @@ { "name": "@keycloak/keycloak-admin-client", - "version": "999.0.0-SNAPSHOT", + "version": "26.1.2", "description": "A client to interact with Keycloak's Administration API", "type": "module", "main": "lib/index.js", diff --git a/js/libs/keycloak-admin-client/pom.xml b/js/libs/keycloak-admin-client/pom.xml index 9ff20572d1ad..b796d0a10451 100644 --- a/js/libs/keycloak-admin-client/pom.xml +++ b/js/libs/keycloak-admin-client/pom.xml @@ -5,7 +5,7 @@ keycloak-js-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml diff --git a/js/libs/keycloak-js/package.json b/js/libs/keycloak-js/package.json index be564f9fe8f4..74f775d10a8a 100644 --- a/js/libs/keycloak-js/package.json +++ b/js/libs/keycloak-js/package.json @@ -1,6 +1,6 @@ { "name": "keycloak-js", - "version": "999.0.0-SNAPSHOT", + "version": "26.1.2", "type": "module", "description": "A client-side JavaScript OpenID Connect library that can be used to secure web applications.", "exports": { diff --git a/js/libs/keycloak-js/pom.xml b/js/libs/keycloak-js/pom.xml index 68906bf6a463..8c2261230d82 100644 --- a/js/libs/keycloak-js/pom.xml +++ b/js/libs/keycloak-js/pom.xml @@ -5,7 +5,7 @@ keycloak-js-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml diff --git a/js/libs/ui-shared/package.json b/js/libs/ui-shared/package.json index 685b7d3a5cc5..1a922063e91a 100644 --- a/js/libs/ui-shared/package.json +++ b/js/libs/ui-shared/package.json @@ -1,6 +1,6 @@ { "name": "@keycloak/keycloak-ui-shared", - "version": "999.0.0-SNAPSHOT", + "version": "26.1.2", "type": "module", "main": "./dist/keycloak-ui-shared.js", "types": "./dist/keycloak-ui-shared.d.ts", diff --git a/js/libs/ui-shared/pom.xml b/js/libs/ui-shared/pom.xml index 8cd3fff0c7cf..ecd11567ff3a 100644 --- a/js/libs/ui-shared/pom.xml +++ b/js/libs/ui-shared/pom.xml @@ -5,7 +5,7 @@ keycloak-js-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml diff --git a/js/pom.xml b/js/pom.xml index 70bbeeee75d7..194718c07636 100644 --- a/js/pom.xml +++ b/js/pom.xml @@ -5,7 +5,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/js/themes-vendor/pom.xml b/js/themes-vendor/pom.xml index 98e72f13ae1e..154cfc1b44e3 100755 --- a/js/themes-vendor/pom.xml +++ b/js/themes-vendor/pom.xml @@ -3,7 +3,7 @@ keycloak-js-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/model/infinispan/pom.xml b/model/infinispan/pom.xml index 186e8da7267e..487b68058f06 100755 --- a/model/infinispan/pom.xml +++ b/model/infinispan/pom.xml @@ -21,7 +21,7 @@ keycloak-model-pom org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/model/infinispan/proto.lock b/model/infinispan/proto.lock index 5833df7e99d6..0c37deb3a0c0 100644 --- a/model/infinispan/proto.lock +++ b/model/infinispan/proto.lock @@ -1143,6 +1143,11 @@ "name" : "containerId", "type" : "string", "optional" : true + }, { + "id" : 3, + "name" : "roleName", + "type" : "string", + "optional" : true } ] }, { "name" : "GroupAddedEvent", diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java index 2e51914aead9..cd662679248b 100755 --- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java +++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java @@ -64,8 +64,9 @@ public void realmRemoval(String id, String name, Set invalidations) { addInvalidations(InRealmPredicate.create().realm(id), invalidations); } - public void roleAdded(String roleContainerId, Set invalidations) { + public void roleAdded(String roleContainerId, String roleName, Set invalidations) { invalidations.add(RealmCacheSession.getRolesCacheKey(roleContainerId)); + invalidations.add(RealmCacheSession.getRoleByNameCacheKey(roleContainerId, roleName)); } public void roleUpdated(String roleContainerId, String roleName, Set invalidations) { diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java index 7ecc221de847..463ed1ae5eeb 100755 --- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java +++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java @@ -64,6 +64,7 @@ import org.keycloak.models.cache.infinispan.entities.GroupNameQuery; import org.keycloak.models.cache.infinispan.entities.RealmListQuery; import org.keycloak.models.cache.infinispan.entities.RoleListQuery; +import org.keycloak.models.cache.infinispan.entities.RoleByNameQuery; import org.keycloak.models.cache.infinispan.events.ClientAddedEvent; import org.keycloak.models.cache.infinispan.events.ClientRemovedEvent; import org.keycloak.models.cache.infinispan.events.ClientScopeAddedEvent; @@ -320,13 +321,13 @@ private void invalidateRole(String id) { if (adapter != null) adapter.invalidate(); } - private void addedRole(String roleId, String roleContainerId) { + private void addedRole(String roleId, String roleContainerId, String roleName) { // this is needed so that a new role that hasn't been committed isn't cached in a query listInvalidations.add(roleContainerId); invalidateRole(roleId); - cache.roleAdded(roleContainerId, invalidations); - invalidationEvents.add(RoleAddedEvent.create(roleId, roleContainerId)); + cache.roleAdded(roleContainerId, roleName, invalidations); + invalidationEvents.add(RoleAddedEvent.create(roleId, roleContainerId, roleName)); } @Override @@ -719,7 +720,7 @@ public RoleModel addRealmRole(RealmModel realm, String name) { @Override public RoleModel addRealmRole(RealmModel realm, String id, String name) { RoleModel role = getRoleDelegate().addRealmRole(realm, id, name); - addedRole(role.getId(), realm.getId()); + addedRole(role.getId(), realm.getId(), name); return role; } @@ -836,7 +837,7 @@ public RoleModel addClientRole(ClientModel client, String name) { @Override public RoleModel addClientRole(ClientModel client, String id, String name) { RoleModel role = getRoleDelegate().addClientRole(client, id, name); - addedRole(role.getId(), client.getId()); + addedRole(role.getId(), client.getId(), name); return role; } @@ -848,7 +849,7 @@ public RoleModel getRealmRole(RealmModel realm, String name) { return getRoleDelegate().getRealmRole(realm, name); } - RoleListQuery query = cache.get(cacheKey, RoleListQuery.class); + RoleByNameQuery query = cache.get(cacheKey, RoleByNameQuery.class); if (query != null) { logger.tracev("getRealmRole cache hit: {0}.{1}", realm.getName(), name); } @@ -856,13 +857,21 @@ public RoleModel getRealmRole(RealmModel realm, String name) { if (query == null) { Long loaded = cache.getCurrentRevision(cacheKey); RoleModel model = getRoleDelegate().getRealmRole(realm, name); - if (model == null) return null; - query = new RoleListQuery(loaded, cacheKey, realm, model.getId()); + if (model == null) { + // caching empty results will speed up the policy evaluation which tries to look up the role by name and ID + query = new RoleByNameQuery(loaded, cacheKey, realm, null); + } else { + query = new RoleByNameQuery(loaded, cacheKey, realm, model.getId()); + } logger.tracev("adding realm role cache miss: client {0} key {1}", realm.getName(), cacheKey); cache.addRevisioned(query, startupRevision); return model; } - RoleModel role = getRoleById(realm, query.getRoles().iterator().next()); + String roleId = query.getRole(); + if (roleId == null) { + return null; + } + RoleModel role = getRoleById(realm, roleId); if (role == null) { invalidations.add(cacheKey); return getRoleDelegate().getRealmRole(realm, name); @@ -878,7 +887,7 @@ public RoleModel getClientRole(ClientModel client, String name) { return getRoleDelegate().getClientRole(client, name); } - RoleListQuery query = cache.get(cacheKey, RoleListQuery.class); + RoleByNameQuery query = cache.get(cacheKey, RoleByNameQuery.class); if (query != null) { logger.tracev("getClientRole cache hit: {0}.{1}", client.getClientId(), name); } @@ -886,13 +895,21 @@ public RoleModel getClientRole(ClientModel client, String name) { if (query == null) { Long loaded = cache.getCurrentRevision(cacheKey); RoleModel model = getRoleDelegate().getClientRole(client, name); - if (model == null) return null; - query = new RoleListQuery(loaded, cacheKey, client.getRealm(), model.getId(), client.getClientId()); + if (model == null) { + // caching empty results will speed up the policy evaluation which tries to look up the role by name and ID + query = new RoleByNameQuery(loaded, cacheKey, client.getRealm(), null, client.getClientId()); + } else { + query = new RoleByNameQuery(loaded, cacheKey, client.getRealm(), model.getId(), client.getClientId()); + } logger.tracev("adding client role cache miss: client {0} key {1}", client.getClientId(), cacheKey); cache.addRevisioned(query, startupRevision); return model; } - RoleModel role = getRoleById(client.getRealm(), query.getRoles().iterator().next()); + String roleId = query.getRole(); + if (roleId == null) { + return null; + } + RoleModel role = getRoleById(client.getRealm(), roleId); if (role == null) { invalidations.add(cacheKey); return getRoleDelegate().getClientRole(client, name); diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleByNameQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleByNameQuery.java new file mode 100755 index 000000000000..dd68205c29b4 --- /dev/null +++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleByNameQuery.java @@ -0,0 +1,72 @@ +/* + * Copyright 2025 Red Hat, Inc. and/or its affiliates + * and other contributors as indicated by the @author tags. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.keycloak.models.cache.infinispan.entities; + +import org.keycloak.models.RealmModel; + +import java.util.Set; + +/** + * @author Alexander Schwartz + * @version $Revision: 1 $ + */ +public class RoleByNameQuery extends AbstractRevisioned implements RoleQuery, InClient { + private final String role; + private final String realm; + private final String realmName; + private String client; + + public RoleByNameQuery(Long revisioned, String id, RealmModel realm, String role) { + super(revisioned, id); + this.realm = realm.getId(); + this.realmName = realm.getName(); + this.role = role; + } + + public RoleByNameQuery(Long revision, String id, RealmModel realm, String role, String client) { + this(revision, id, realm, role); + this.client = client; + } + + @Override + public Set getRoles() { + return role == null ? Set.of() : Set.of(role); + } + + public String getRole() { + return role; + } + + @Override + public String getRealm() { + return realm; + } + + @Override + public String getClientId() { + return client; + } + + @Override + public String toString() { + return "RoleNameQuery{" + + "id='" + getId() + "'" + + ", realmName='" + realmName + '\'' + + ", clientUuid='" + client + '\'' + + '}'; + } +} diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java index d780006e66e6..5b397835b78e 100644 --- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java +++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java @@ -20,6 +20,7 @@ import java.util.Set; import org.infinispan.protostream.annotations.ProtoFactory; +import org.infinispan.protostream.annotations.ProtoField; import org.infinispan.protostream.annotations.ProtoTypeId; import org.keycloak.marshalling.Marshalling; import org.keycloak.models.cache.infinispan.RealmCacheManager; @@ -30,17 +31,21 @@ @ProtoTypeId(Marshalling.ROLE_ADDED_EVENT) public class RoleAddedEvent extends BaseRoleEvent { + @ProtoField(3) + final String roleName; + @ProtoFactory - RoleAddedEvent(String id, String containerId) { + RoleAddedEvent(String id, String containerId, String roleName) { super(id, containerId); + this.roleName = roleName; } - public static RoleAddedEvent create(String roleId, String containerId) { - return new RoleAddedEvent(roleId, containerId); + public static RoleAddedEvent create(String roleId, String containerId, String roleName) { + return new RoleAddedEvent(roleId, containerId, roleName); } @Override public void addInvalidations(RealmCacheManager realmCache, Set invalidations) { - realmCache.roleAdded(containerId, invalidations); + realmCache.roleAdded(containerId, roleName, invalidations); } } diff --git a/model/jpa/pom.xml b/model/jpa/pom.xml index 734bdb27c86c..7168bdd2a2d2 100755 --- a/model/jpa/pom.xml +++ b/model/jpa/pom.xml @@ -21,7 +21,7 @@ keycloak-model-pom org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/model/pom.xml b/model/pom.xml index 373f1649470f..7a94fd8cf553 100755 --- a/model/pom.xml +++ b/model/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Model Parent diff --git a/model/storage-private/pom.xml b/model/storage-private/pom.xml index 69638558fc3d..cae267911d21 100644 --- a/model/storage-private/pom.xml +++ b/model/storage-private/pom.xml @@ -3,7 +3,7 @@ keycloak-model-pom org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/model/storage-services/pom.xml b/model/storage-services/pom.xml index 8d7acffc7fa9..2cac78bc863c 100644 --- a/model/storage-services/pom.xml +++ b/model/storage-services/pom.xml @@ -3,7 +3,7 @@ keycloak-model-pom org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/model/storage/pom.xml b/model/storage/pom.xml index 0823e334170c..1815f72ecfbd 100644 --- a/model/storage/pom.xml +++ b/model/storage/pom.xml @@ -3,7 +3,7 @@ keycloak-model-pom org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/operator/pom.xml b/operator/pom.xml index c6420a96580c..a65db6619aee 100644 --- a/operator/pom.xml +++ b/operator/pom.xml @@ -7,7 +7,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/pom.xml b/pom.xml index 38c820476c4b..cbb44ed569e8 100644 --- a/pom.xml +++ b/pom.xml @@ -31,7 +31,7 @@ org.keycloak keycloak-parent - 999.0.0-SNAPSHOT + 26.1.2 pom @@ -41,7 +41,7 @@ 17 17 - 999.0.0-SNAPSHOT + 26.1.2 1.5.8 @@ -96,7 +96,7 @@ 2.3.230 6.2.13.Final 6.2.13.Final - 15.0.11.Final + 15.0.12.Final 5.0.12.Final diff --git a/quarkus/config-api/pom.xml b/quarkus/config-api/pom.xml index 4c4b20043d36..7b311fcb7978 100755 --- a/quarkus/config-api/pom.xml +++ b/quarkus/config-api/pom.xml @@ -21,7 +21,7 @@ keycloak-quarkus-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/quarkus/container/Dockerfile b/quarkus/container/Dockerfile index 98fa3a202b4d..7567419314b5 100644 --- a/quarkus/container/Dockerfile +++ b/quarkus/container/Dockerfile @@ -1,6 +1,6 @@ FROM registry.access.redhat.com/ubi9 AS ubi-micro-build -ENV KEYCLOAK_VERSION 999.0.0-SNAPSHOT +ENV KEYCLOAK_VERSION 26.1.2 ARG KEYCLOAK_DIST=https://github.com/keycloak/keycloak/releases/download/$KEYCLOAK_VERSION/keycloak-$KEYCLOAK_VERSION.tar.gz RUN dnf install -y tar gzip diff --git a/quarkus/deployment/pom.xml b/quarkus/deployment/pom.xml index 79829a0c3dbc..5ae8a4938294 100644 --- a/quarkus/deployment/pom.xml +++ b/quarkus/deployment/pom.xml @@ -5,7 +5,7 @@ keycloak-quarkus-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/quarkus/dist/pom.xml b/quarkus/dist/pom.xml index 780df25d7fa3..e61ac4471e16 100755 --- a/quarkus/dist/pom.xml +++ b/quarkus/dist/pom.xml @@ -21,7 +21,7 @@ keycloak-quarkus-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 keycloak-quarkus-dist diff --git a/quarkus/pom.xml b/quarkus/pom.xml index b561e444e28b..2939379f7800 100644 --- a/quarkus/pom.xml +++ b/quarkus/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml Keycloak Quarkus Parent diff --git a/quarkus/runtime/pom.xml b/quarkus/runtime/pom.xml index 45e163fe0646..5864cc430f99 100644 --- a/quarkus/runtime/pom.xml +++ b/quarkus/runtime/pom.xml @@ -5,7 +5,7 @@ keycloak-quarkus-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java index 76d301fd052b..d22f394e997f 100644 --- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java +++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java @@ -53,21 +53,43 @@ public class KeycloakMain implements QuarkusApplication { private static final String INFINISPAN_VIRTUAL_THREADS_PROP = "org.infinispan.threads.virtual"; + public static final int MIN_VT_POOL_SIZE = 2; + static { // enable Infinispan and JGroups virtual threads by default - if (System.getProperty(INFINISPAN_VIRTUAL_THREADS_PROP) == null) { + if (System.getProperty(INFINISPAN_VIRTUAL_THREADS_PROP) == null && getParallelism() >= MIN_VT_POOL_SIZE) { System.setProperty(INFINISPAN_VIRTUAL_THREADS_PROP, "true"); } } public static void main(String[] args) { ensureForkJoinPoolThreadFactoryHasBeenSetToQuarkus(); + ensureVirtualThreadsParallelism(); System.setProperty("kc.version", Version.VERSION); main(args, new Picocli()); } + private static void ensureVirtualThreadsParallelism() { + if (Boolean.parseBoolean(System.getProperty(INFINISPAN_VIRTUAL_THREADS_PROP))) { + if (getParallelism() < MIN_VT_POOL_SIZE) { + throw new RuntimeException("To be able to use Infinispan/JGroups virtual threads, you need to set the Java system property jdk.virtualThreadScheduler.parallelism to at least " + MIN_VT_POOL_SIZE); + } + } + } + + private static int getParallelism() { + int parallelism; + String parallelismValue = System.getProperty("jdk.virtualThreadScheduler.parallelism"); + if (parallelismValue != null) { + parallelism = Integer.parseInt(parallelismValue); + } else { + parallelism = Runtime.getRuntime().availableProcessors(); + } + return parallelism; + } + public static void main(String[] args, Picocli picocli) { List cliArgs = null; try { diff --git a/quarkus/server/pom.xml b/quarkus/server/pom.xml index f29fbf884293..8828e56d300a 100644 --- a/quarkus/server/pom.xml +++ b/quarkus/server/pom.xml @@ -7,7 +7,7 @@ keycloak-quarkus-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/quarkus/tests/integration/pom.xml b/quarkus/tests/integration/pom.xml index cf576b50efb0..abe75de5f10a 100644 --- a/quarkus/tests/integration/pom.xml +++ b/quarkus/tests/integration/pom.xml @@ -24,7 +24,7 @@ keycloak-quarkus-test-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/quarkus/tests/junit5/pom.xml b/quarkus/tests/junit5/pom.xml index 7d9b450c896e..26cd858289b6 100644 --- a/quarkus/tests/junit5/pom.xml +++ b/quarkus/tests/junit5/pom.xml @@ -24,7 +24,7 @@ keycloak-quarkus-test-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/quarkus/tests/pom.xml b/quarkus/tests/pom.xml index 434605e1b9f2..95c4bd5ca290 100644 --- a/quarkus/tests/pom.xml +++ b/quarkus/tests/pom.xml @@ -24,7 +24,7 @@ keycloak-quarkus-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/rest/admin-ui-ext/pom.xml b/rest/admin-ui-ext/pom.xml index caac25c83318..6fa670db2223 100644 --- a/rest/admin-ui-ext/pom.xml +++ b/rest/admin-ui-ext/pom.xml @@ -22,7 +22,7 @@ org.keycloak keycloak-rest-parent - 999.0.0-SNAPSHOT + 26.1.2 keycloak-rest-admin-ui-ext diff --git a/rest/pom.xml b/rest/pom.xml index c4d975748c08..7693b6c8520d 100644 --- a/rest/pom.xml +++ b/rest/pom.xml @@ -22,7 +22,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 Keycloak Administration UI diff --git a/saml-core-api/pom.xml b/saml-core-api/pom.xml index 186a56010c83..6914b68d4fc2 100755 --- a/saml-core-api/pom.xml +++ b/saml-core-api/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/saml-core/pom.xml b/saml-core/pom.xml index aee0a238921a..91720e416392 100755 --- a/saml-core/pom.xml +++ b/saml-core/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/server-spi-private/pom.xml b/server-spi-private/pom.xml index f4fc61ab3e3b..854484225b33 100755 --- a/server-spi-private/pom.xml +++ b/server-spi-private/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/server-spi/pom.xml b/server-spi/pom.xml index 0dcc733f15f9..3ea139ba5b46 100755 --- a/server-spi/pom.xml +++ b/server-spi/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/services/pom.xml b/services/pom.xml index 34bd11c7c0e1..f530d1742117 100755 --- a/services/pom.xml +++ b/services/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java index cac1035bb97d..688dcca656f5 100644 --- a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java +++ b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java @@ -25,20 +25,13 @@ import org.keycloak.events.Errors; import org.keycloak.events.EventBuilder; import org.keycloak.models.AdminRoles; -import org.keycloak.models.AuthenticatedClientSessionModel; import org.keycloak.models.ClientInitialAccessModel; import org.keycloak.models.ClientModel; -import org.keycloak.models.ClientSessionContext; import org.keycloak.models.Constants; import org.keycloak.models.KeycloakSession; import org.keycloak.models.RealmModel; -import org.keycloak.models.RoleModel; -import org.keycloak.models.UserModel; -import org.keycloak.models.UserSessionModel; -import org.keycloak.models.UserSessionProvider; import org.keycloak.protocol.oidc.utils.AuthorizeClientUtil; import org.keycloak.representations.AccessToken; -import org.keycloak.representations.JsonWebToken; import org.keycloak.services.ErrorResponseException; import org.keycloak.services.clientpolicy.ClientPolicyException; import org.keycloak.services.clientpolicy.context.DynamicClientRegisterContext; @@ -48,18 +41,18 @@ import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyException; import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyManager; import org.keycloak.services.clientregistration.policy.RegistrationAuth; -import org.keycloak.services.util.DefaultClientSessionContext; +import org.keycloak.services.managers.AuthenticationManager; import org.keycloak.util.TokenUtil; import jakarta.ws.rs.WebApplicationException; import jakarta.ws.rs.core.HttpHeaders; import jakarta.ws.rs.core.Response; -import org.keycloak.utils.RoleResolveUtil; -import java.util.ArrayList; -import java.util.HashMap; -import java.util.List; +import java.util.Arrays; +import java.util.Collections; import java.util.Map; +import java.util.Optional; +import java.util.Set; /** * @author Stian Thorgersen @@ -71,7 +64,7 @@ public class ClientRegistrationAuth { private final EventBuilder event; private RealmModel realm; - private JsonWebToken jwt; + private AccessToken jwt; private ClientInitialAccessModel initialAccessModel; private String kid; private String token; @@ -122,7 +115,7 @@ public String getKid() { return kid; } - public JsonWebToken getJwt() { + public AccessToken getJwt() { return jwt; } @@ -293,75 +286,28 @@ public ClientInitialAccessModel getInitialAccessModel() { private boolean hasRole(String... roles) { try { - - //support for lightweight access token - if (jwt.getSubject() == null) { - String sid = (String) jwt.getOtherClaims().get("sid"); - if (sid != null) { - final String issuedFor = jwt.getIssuedFor(); - UserSessionProvider sessions = session.sessions(); - UserSessionModel userSession = sessions.getUserSession(realm, sid); - if (userSession == null) { - userSession = sessions.getOfflineUserSession(realm, sid); - } - - if (userSession != null) { - //get client session - ClientModel client = realm.getClientByClientId(issuedFor); - AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId()); - - //set realm roles - ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, (String) jwt.getOtherClaims().get("scope"), session); - Map resourceAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx); - - Map>> resourceAccessMap = new HashMap<>(); - resourceAccess.forEach((key, access) -> - resourceAccessMap.put(key, Map.of("roles", new ArrayList<>(access.getRoles()))) - ); - jwt.setSubject(userSession.getUser().getId()); - jwt.getOtherClaims().put("resource_access", resourceAccessMap); - } - } - } + AuthenticationManager.resolveLightweightAccessTokenRoles(session, jwt, session.getContext().getRealm()); return hasRoleInToken(roles); - } catch (Throwable t) { return false; } } private boolean hasRoleInToken(String[] role) { - Map otherClaims = jwt.getOtherClaims(); - if (otherClaims != null) { - Map>> resourceAccess = (Map>>) jwt.getOtherClaims().get("resource_access"); - if (resourceAccess == null) { - return false; - } - - List roles = null; - - Map> map; - if (realm.getName().equals(Config.getAdminRealm())) { - map = resourceAccess.get(realm.getMasterAdminClient().getClientId()); - } else { - map = resourceAccess.get(Constants.REALM_MANAGEMENT_CLIENT_ID); - } + Map resourceAccess = jwt.getResourceAccess(); + if (resourceAccess == null) { + return false; + } - if (map != null) { - roles = map.get("roles"); - } + String clientId = realm.getName().equals(Config.getAdminRealm()) + ? realm.getMasterAdminClient().getClientId() + : Constants.REALM_MANAGEMENT_CLIENT_ID; - if (roles == null) { - return false; - } + Set roles = Optional.ofNullable(resourceAccess.get(clientId)) + .map(AccessToken.Access::getRoles) + .orElse(Collections.emptySet()); - for (String r : role) { - if (roles.contains(r)) { - return true; - } - } - } - return false; + return Arrays.stream(role).anyMatch(roles::contains); } private boolean authenticatePublicClient(ClientModel client) { diff --git a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java index 78e93d3d0bdf..807d86db92c0 100755 --- a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java +++ b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java @@ -20,7 +20,6 @@ import org.keycloak.TokenCategory; import org.keycloak.TokenVerifier; import org.keycloak.common.VerificationException; -import org.keycloak.common.util.Time; import org.keycloak.crypto.SignatureSignerContext; import org.keycloak.crypto.SignatureProvider; import org.keycloak.crypto.SignatureVerifierContext; @@ -31,6 +30,7 @@ import org.keycloak.models.RealmModel; import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.protocol.oidc.TokenManager.TokenRevocationCheck; +import org.keycloak.representations.AccessToken; import org.keycloak.representations.JsonWebToken; import org.keycloak.services.Urls; import org.keycloak.services.clientregistration.policy.RegistrationAuth; @@ -90,9 +90,9 @@ public static TokenVerification verifyToken(KeycloakSession session, RealmModel } String kid; - JsonWebToken jwt; + AccessToken jwt; try { - TokenVerifier verifier = TokenVerifier.create(token, JsonWebToken.class) + TokenVerifier verifier = TokenVerifier.create(token, AccessToken.class) .withChecks(new TokenVerifier.RealmUrlCheck(getIssuer(session, realm)), TokenVerifier.IS_ACTIVE, new TokenRevocationCheck(session)); SignatureVerifierContext verifierContext = session.getProvider(SignatureProvider.class, verifier.getHeader().getAlgorithm().name()).verifier(verifier.getHeader().getKeyId()); @@ -136,10 +136,10 @@ private static String getIssuer(KeycloakSession session, RealmModel realm) { protected static class TokenVerification { private final String kid; - private final JsonWebToken jwt; + private final AccessToken jwt; private final RuntimeException error; - public static TokenVerification success(String kid, JsonWebToken jwt) { + public static TokenVerification success(String kid, AccessToken jwt) { return new TokenVerification(kid, jwt, null); } @@ -147,7 +147,7 @@ public static TokenVerification error(RuntimeException error) { return new TokenVerification(null,null, error); } - private TokenVerification(String kid, JsonWebToken jwt, RuntimeException error) { + private TokenVerification(String kid, AccessToken jwt, RuntimeException error) { this.kid = kid; this.jwt = jwt; this.error = error; @@ -157,7 +157,7 @@ public String getKid() { return kid; } - public JsonWebToken getJwt() { + public AccessToken getJwt() { return jwt; } diff --git a/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java b/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java index 3146a493854e..ec3d421b4dcb 100755 --- a/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java +++ b/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java @@ -89,6 +89,8 @@ import org.keycloak.services.resources.LoginActionsService; import org.keycloak.services.resources.RealmsResource; import org.keycloak.services.util.AuthorizationContextUtil; +import org.keycloak.services.util.DefaultClientSessionContext; +import org.keycloak.services.util.UserSessionUtil; import org.keycloak.sessions.AuthenticationSessionModel; import org.keycloak.sessions.CommonClientSessionModel; import org.keycloak.sessions.RootAuthenticationSessionModel; @@ -99,6 +101,7 @@ import jakarta.ws.rs.core.Response; import jakarta.ws.rs.core.UriBuilder; import jakarta.ws.rs.core.UriInfo; +import org.keycloak.utils.RoleResolveUtil; import java.net.URI; import java.net.URLDecoder; import java.net.URLEncoder; @@ -1606,6 +1609,33 @@ private static boolean isClientValid(UserSessionModel userSession, ClientModel c return true; } + public static void resolveLightweightAccessTokenRoles(KeycloakSession session, AccessToken accessToken, RealmModel realm) { + final String issuedFor = accessToken.getIssuedFor(); + ClientModel client = realm.getClientByClientId(issuedFor); + if(client == null) { + return; + } + boolean isAlwaysUseLightweightAccessToken = Boolean.parseBoolean(client.getAttribute(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED)); + if (isAlwaysUseLightweightAccessToken || accessToken.getSubject() == null || (accessToken.getSessionId() == null && accessToken.getResourceAccess().isEmpty() && accessToken.getRealmAccess() == null)) { + //get user session + EventBuilder event = new EventBuilder(realm, session); + event.event(EventType.INTROSPECT_TOKEN); + UserSessionModel userSession = UserSessionUtil.findValidSession(session,realm, accessToken, event, client); + + if (userSession != null) { + //get client session + AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId()); + //set realm roles + ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, accessToken.getScope(), session); + AccessToken.Access realmAccess = RoleResolveUtil.getResolvedRealmRoles(session, clientSessionCtx, false); + Map clientAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx); + accessToken.subject(userSession.getUser().getId()); + accessToken.setRealmAccess(realmAccess); + accessToken.setResourceAccess(clientAccess); + } + } + } + public enum AuthenticationStatus { SUCCESS, ACCOUNT_TEMPORARILY_DISABLED, ACCOUNT_DISABLED, ACTIONS_REQUIRED, INVALID_USER, INVALID_CREDENTIALS, MISSING_PASSWORD, MISSING_TOTP, FAILED } diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java index 5c7a0d2ee4a0..bf4dbbb484ad 100644 --- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java +++ b/services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java @@ -44,6 +44,7 @@ import org.keycloak.models.UserSessionProvider; import org.keycloak.representations.AccessToken; import org.keycloak.representations.idm.authorization.Permission; +import org.keycloak.services.managers.AuthenticationManager; import org.keycloak.services.managers.RealmManager; import org.keycloak.services.resources.admin.AdminAuth; @@ -108,28 +109,8 @@ class MgmtPermissions implements AdminPermissionEvaluator, AdminPermissionManage } private void initIdentity(KeycloakSession session, AdminAuth auth) { - final String issuedFor = auth.getToken().getIssuedFor(); AccessToken accessToken = auth.getToken(); - ClientModel client = adminsRealm.getClientByClientId(issuedFor); - //support for lightweight access token and transient session - boolean isAlwaysUseLightweightAccessToken = Boolean.parseBoolean(client.getAttribute(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED)); - if (isAlwaysUseLightweightAccessToken || accessToken.getSubject() == null || (accessToken.getSessionId() == null && accessToken.getResourceAccess().isEmpty() && accessToken.getRealmAccess() == null)) { - //get user session - EventBuilder event = new EventBuilder(adminsRealm, session); - event.event(EventType.INTROSPECT_TOKEN); - UserSessionModel userSession = UserSessionUtil.findValidSession(session, adminsRealm, accessToken, event, client); - - if (userSession != null) { - //get client session - AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId()); - //set realm roles - ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, auth.getToken().getScope(), session); - AccessToken.Access realmAccess = RoleResolveUtil.getResolvedRealmRoles(session, clientSessionCtx, false); - Map clientAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx); - accessToken.setRealmAccess(realmAccess); - accessToken.setResourceAccess(clientAccess); - } - } + AuthenticationManager.resolveLightweightAccessTokenRoles(session, accessToken, adminsRealm); this.identity = new KeycloakIdentity(accessToken, session, adminsRealm); } diff --git a/test-framework/bom/pom.xml b/test-framework/bom/pom.xml index 3e4ebaf86dd2..f5579a462bde 100755 --- a/test-framework/bom/pom.xml +++ b/test-framework/bom/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/core/pom.xml b/test-framework/core/pom.xml index 6b41630cbff6..20fcb47bd14d 100755 --- a/test-framework/core/pom.xml +++ b/test-framework/core/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/db-mariadb/pom.xml b/test-framework/db-mariadb/pom.xml index ca242dd24b38..01165032f45f 100755 --- a/test-framework/db-mariadb/pom.xml +++ b/test-framework/db-mariadb/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/db-mssql/pom.xml b/test-framework/db-mssql/pom.xml index 3e753b8ea4e8..9c38459f548a 100755 --- a/test-framework/db-mssql/pom.xml +++ b/test-framework/db-mssql/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/db-mysql/pom.xml b/test-framework/db-mysql/pom.xml index 78cbebe52aef..2fd9a7d47103 100755 --- a/test-framework/db-mysql/pom.xml +++ b/test-framework/db-mysql/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/db-oracle/pom.xml b/test-framework/db-oracle/pom.xml index dc32995efb1c..00f0c1f4d26c 100755 --- a/test-framework/db-oracle/pom.xml +++ b/test-framework/db-oracle/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/db-postgres/pom.xml b/test-framework/db-postgres/pom.xml index 76510ab60eba..dbf184fe33a0 100755 --- a/test-framework/db-postgres/pom.xml +++ b/test-framework/db-postgres/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/email-server/pom.xml b/test-framework/email-server/pom.xml index 40b18a112589..60f57908080d 100755 --- a/test-framework/email-server/pom.xml +++ b/test-framework/email-server/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/examples/pom.xml b/test-framework/examples/pom.xml index df5988fc17d1..a23e672c5fb7 100755 --- a/test-framework/examples/pom.xml +++ b/test-framework/examples/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/examples/providers/pom.xml b/test-framework/examples/providers/pom.xml index fb8bd77ab748..c621a8f42824 100644 --- a/test-framework/examples/providers/pom.xml +++ b/test-framework/examples/providers/pom.xml @@ -5,7 +5,7 @@ keycloak-test-framework-examples org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/test-framework/examples/tests/pom.xml b/test-framework/examples/tests/pom.xml index 44a50b4a100e..6f43bf13ee39 100644 --- a/test-framework/examples/tests/pom.xml +++ b/test-framework/examples/tests/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-examples org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/oauth-nimbus-poc/pom.xml b/test-framework/oauth-nimbus-poc/pom.xml index 859bece5c43e..f418ff3970ce 100755 --- a/test-framework/oauth-nimbus-poc/pom.xml +++ b/test-framework/oauth-nimbus-poc/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/pom.xml b/test-framework/pom.xml index a2aade2e49ed..b12c46374c5a 100755 --- a/test-framework/pom.xml +++ b/test-framework/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/remote-providers/pom.xml b/test-framework/remote-providers/pom.xml index 9868f5f8019e..e37cda9118ed 100644 --- a/test-framework/remote-providers/pom.xml +++ b/test-framework/remote-providers/pom.xml @@ -22,7 +22,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/remote/pom.xml b/test-framework/remote/pom.xml index b24869030672..f4d17c61919b 100644 --- a/test-framework/remote/pom.xml +++ b/test-framework/remote/pom.xml @@ -22,7 +22,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/test-framework/ui/pom.xml b/test-framework/ui/pom.xml index 6b5db3a53118..bb1d5e19fca6 100755 --- a/test-framework/ui/pom.xml +++ b/test-framework/ui/pom.xml @@ -21,7 +21,7 @@ keycloak-test-framework-parent org.keycloak.testframework - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/tests/base/pom.xml b/tests/base/pom.xml index 2b1fcb203b76..b08772b046f9 100755 --- a/tests/base/pom.xml +++ b/tests/base/pom.xml @@ -21,7 +21,7 @@ keycloak-tests-parent org.keycloak.tests - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/tests/pom.xml b/tests/pom.xml index b12aea28a007..4dd155855cff 100755 --- a/tests/pom.xml +++ b/tests/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/tests/utils/pom.xml b/tests/utils/pom.xml index 77d8e3bed65e..b6730987b955 100755 --- a/tests/utils/pom.xml +++ b/tests/utils/pom.xml @@ -21,7 +21,7 @@ keycloak-tests-parent org.keycloak.tests - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml index 519cd78ba676..df934eb06806 100644 --- a/testsuite/integration-arquillian/pom.xml +++ b/testsuite/integration-arquillian/pom.xml @@ -22,7 +22,7 @@ org.keycloak keycloak-testsuite-pom - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml b/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml index a00eae01d9ec..9d9c7160a11e 100644 --- a/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml +++ b/testsuite/integration-arquillian/servers/app-server/app-server-spi/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-app-server - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml index bf2689dd999d..6bb4b3bcff5b 100644 --- a/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml +++ b/testsuite/integration-arquillian/servers/app-server/jboss/galleon/pom.xml @@ -5,7 +5,7 @@ org.keycloak.testsuite integration-arquillian-servers-app-server-jboss - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml index 3c55d4907b13..36e7944115df 100644 --- a/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml +++ b/testsuite/integration-arquillian/servers/app-server/jboss/pom.xml @@ -22,7 +22,7 @@ org.keycloak.testsuite integration-arquillian-servers-app-server - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml b/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml index f6f3e0fe8720..b730f720be42 100644 --- a/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml +++ b/testsuite/integration-arquillian/servers/app-server/jboss/wildfly/pom.xml @@ -22,7 +22,7 @@ org.keycloak.testsuite integration-arquillian-servers-app-server-jboss - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/app-server/pom.xml b/testsuite/integration-arquillian/servers/app-server/pom.xml index a5e877a89af2..de0e40ea7f1d 100644 --- a/testsuite/integration-arquillian/servers/app-server/pom.xml +++ b/testsuite/integration-arquillian/servers/app-server/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/auth-server/pom.xml b/testsuite/integration-arquillian/servers/auth-server/pom.xml index a5ed91a6c734..eace54ad0dbe 100644 --- a/testsuite/integration-arquillian/servers/auth-server/pom.xml +++ b/testsuite/integration-arquillian/servers/auth-server/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml b/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml index 937dcb17fa77..20a4320c3f46 100644 --- a/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml +++ b/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml @@ -5,7 +5,7 @@ integration-arquillian-servers-auth-server org.keycloak.testsuite - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/auth-server/services/pom.xml b/testsuite/integration-arquillian/servers/auth-server/services/pom.xml index a096973d211c..7b5775cb87ce 100644 --- a/testsuite/integration-arquillian/servers/auth-server/services/pom.xml +++ b/testsuite/integration-arquillian/servers/auth-server/services/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-auth-server - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers-deployment/pom.xml b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers-deployment/pom.xml index 20063ee9442d..24fc823e0ea9 100644 --- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers-deployment/pom.xml +++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers-deployment/pom.xml @@ -24,7 +24,7 @@ org.keycloak.testsuite integration-arquillian-servers-auth-server-services - 999.0.0-SNAPSHOT + 26.1.2 integration-arquillian-testsuite-providers-deployment diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml index 05d6bac5555f..3243c948ec33 100644 --- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml +++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml @@ -24,7 +24,7 @@ org.keycloak.testsuite integration-arquillian-servers-auth-server-services - 999.0.0-SNAPSHOT + 26.1.2 integration-arquillian-testsuite-providers diff --git a/testsuite/integration-arquillian/servers/auth-server/undertow/pom.xml b/testsuite/integration-arquillian/servers/auth-server/undertow/pom.xml index 85fbfdb300cb..cc5f612c5737 100644 --- a/testsuite/integration-arquillian/servers/auth-server/undertow/pom.xml +++ b/testsuite/integration-arquillian/servers/auth-server/undertow/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-auth-server - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/cache-server/infinispan/datagrid/pom.xml b/testsuite/integration-arquillian/servers/cache-server/infinispan/datagrid/pom.xml index 39ee8e345f63..faf4bcae980d 100644 --- a/testsuite/integration-arquillian/servers/cache-server/infinispan/datagrid/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/infinispan/datagrid/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-cache-server-infinispan - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/cache-server/infinispan/infinispan/pom.xml b/testsuite/integration-arquillian/servers/cache-server/infinispan/infinispan/pom.xml index 493512a20957..b39b4e6218b7 100644 --- a/testsuite/integration-arquillian/servers/cache-server/infinispan/infinispan/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/infinispan/infinispan/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-cache-server-infinispan - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/cache-server/infinispan/pom.xml b/testsuite/integration-arquillian/servers/cache-server/infinispan/pom.xml index 80b68a9d8278..f2b8ab43841e 100644 --- a/testsuite/integration-arquillian/servers/cache-server/infinispan/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/infinispan/pom.xml @@ -24,7 +24,7 @@ org.keycloak.testsuite integration-arquillian-servers-cache-server - 999.0.0-SNAPSHOT + 26.1.2 pom diff --git a/testsuite/integration-arquillian/servers/cache-server/legacy/datagrid/pom.xml b/testsuite/integration-arquillian/servers/cache-server/legacy/datagrid/pom.xml index 56494399a8e5..f68cb5c427a1 100644 --- a/testsuite/integration-arquillian/servers/cache-server/legacy/datagrid/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/legacy/datagrid/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-cache-server-legacy - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/cache-server/legacy/infinispan/pom.xml b/testsuite/integration-arquillian/servers/cache-server/legacy/infinispan/pom.xml index cb0f8056bfb1..7f6b352486f5 100644 --- a/testsuite/integration-arquillian/servers/cache-server/legacy/infinispan/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/legacy/infinispan/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-cache-server-legacy - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/cache-server/legacy/pom.xml b/testsuite/integration-arquillian/servers/cache-server/legacy/pom.xml index d5f7c46fe695..ce153608dd04 100644 --- a/testsuite/integration-arquillian/servers/cache-server/legacy/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/legacy/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers-cache-server - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/cache-server/pom.xml b/testsuite/integration-arquillian/servers/cache-server/pom.xml index 22779a9af5e2..b649e8f52ff2 100644 --- a/testsuite/integration-arquillian/servers/cache-server/pom.xml +++ b/testsuite/integration-arquillian/servers/cache-server/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/migration/pom.xml b/testsuite/integration-arquillian/servers/migration/pom.xml index 94cf6e625c65..b0f5137f2d8e 100644 --- a/testsuite/integration-arquillian/servers/migration/pom.xml +++ b/testsuite/integration-arquillian/servers/migration/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-servers - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/servers/pom.xml b/testsuite/integration-arquillian/servers/pom.xml index de7fc63bcb68..6cc17529a40c 100644 --- a/testsuite/integration-arquillian/servers/pom.xml +++ b/testsuite/integration-arquillian/servers/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/test-apps/pom.xml b/testsuite/integration-arquillian/test-apps/pom.xml index 6364ecbdc80a..e955fa5f5846 100644 --- a/testsuite/integration-arquillian/test-apps/pom.xml +++ b/testsuite/integration-arquillian/test-apps/pom.xml @@ -5,7 +5,7 @@ integration-arquillian org.keycloak.testsuite - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/test-apps/servlets/pom.xml b/testsuite/integration-arquillian/test-apps/servlets/pom.xml index 037e946e8365..e462a048f43e 100644 --- a/testsuite/integration-arquillian/test-apps/servlets/pom.xml +++ b/testsuite/integration-arquillian/test-apps/servlets/pom.xml @@ -5,7 +5,7 @@ integration-arquillian-test-apps org.keycloak.testsuite - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/tests/base/pom.xml b/testsuite/integration-arquillian/tests/base/pom.xml index 4a418afafe31..4a649b343a55 100644 --- a/testsuite/integration-arquillian/tests/base/pom.xml +++ b/testsuite/integration-arquillian/tests/base/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian-tests - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java index b505301e9d46..73435ce5df96 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java @@ -45,10 +45,12 @@ import org.keycloak.representations.idm.ClientRepresentation; import org.keycloak.representations.idm.OAuth2ErrorRepresentation; import org.keycloak.representations.idm.ProtocolMapperRepresentation; +import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.UserRepresentation; import org.keycloak.representations.idm.authorization.PolicyRepresentation; import org.keycloak.representations.idm.authorization.ResourceRepresentation; import org.keycloak.representations.idm.authorization.ResourceServerRepresentation; +import org.keycloak.testsuite.admin.ApiUtil; import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected; import org.keycloak.util.JsonSerialization; @@ -851,4 +853,39 @@ public void registerMultipleClients() { //controls the number of uses of the initial access token assertEquals(initialTokenCounts, createdCount.get()); } + + @Test + public void registerWithLightweightAccessTokenAndTransientSession() throws Exception { + + String TEST_ADMIN_CLIENT = "test-admin-client"; + ClientRepresentation testAdminClient = new ClientRepresentation(); + testAdminClient.setClientId(TEST_ADMIN_CLIENT); + testAdminClient.setSecret(TEST_ADMIN_CLIENT); + testAdminClient.setServiceAccountsEnabled(true); + testAdminClient.setAttributes(new HashMap<>()); + testAdminClient.getAttributes().put(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED, Boolean.TRUE.toString()); + + Response response = adminClient.realm("master").clients().create(testAdminClient); + testAdminClient = adminClient.realm("master").clients().get( ApiUtil.getCreatedId(response)).toRepresentation(); + + UserRepresentation serviceAccountUser = adminClient.realm("master").clients().get(testAdminClient.getId()).getServiceAccountUser(); + RoleRepresentation adminRole = adminClient.realm("master").roles().get("admin").toRepresentation(); + adminClient.realm("master").users().get(serviceAccountUser.getId()).roles().realmLevel().add(List.of(adminRole)); + + oauth.clientId(TEST_ADMIN_CLIENT); + oauth.realm("master"); + String token = oauth.doClientCredentialsGrantAccessTokenRequest(TEST_ADMIN_CLIENT).getAccessToken(); + ClientRegistration masterReg = ClientRegistration.create().url(suiteContext.getAuthServerInfo().getContextRoot() + "/auth", "master").build(); + masterReg.auth(Auth.token(token)); + + ClientRepresentation client = new ClientRepresentation(); + client.setClientId(CLIENT_ID); + client.setSecret(CLIENT_SECRET); + + ClientRepresentation createdClient = masterReg.create(client); + assertNotNull(createdClient); + + adminClient.realm("master").clients().get(testAdminClient.getId()).remove(); + adminClient.realm("master").clients().get(createdClient.getId()).remove(); + } } diff --git a/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml b/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml index a4715a5937be..4b1a2b3f6698 100644 --- a/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml +++ b/testsuite/integration-arquillian/tests/other/jpa-performance/pom.xml @@ -24,7 +24,7 @@ org.keycloak.testsuite integration-arquillian-tests-other - 999.0.0-SNAPSHOT + 26.1.2 integration-arquillian-tests-jpa-performance diff --git a/testsuite/integration-arquillian/tests/other/pom.xml b/testsuite/integration-arquillian/tests/other/pom.xml index 5cd36b348e47..b1a1c703f90c 100644 --- a/testsuite/integration-arquillian/tests/other/pom.xml +++ b/testsuite/integration-arquillian/tests/other/pom.xml @@ -24,7 +24,7 @@ org.keycloak.testsuite integration-arquillian-tests - 999.0.0-SNAPSHOT + 26.1.2 integration-arquillian-tests-other diff --git a/testsuite/integration-arquillian/tests/other/sssd/pom.xml b/testsuite/integration-arquillian/tests/other/sssd/pom.xml index ff80d347fb47..5d0eb4ba70ab 100644 --- a/testsuite/integration-arquillian/tests/other/sssd/pom.xml +++ b/testsuite/integration-arquillian/tests/other/sssd/pom.xml @@ -5,7 +5,7 @@ integration-arquillian-tests-other org.keycloak.testsuite - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml index a22feb05776f..789c946fc29e 100644 --- a/testsuite/integration-arquillian/tests/pom.xml +++ b/testsuite/integration-arquillian/tests/pom.xml @@ -24,7 +24,7 @@ org.keycloak.testsuite integration-arquillian - 999.0.0-SNAPSHOT + 26.1.2 pom diff --git a/testsuite/integration-arquillian/util/pom.xml b/testsuite/integration-arquillian/util/pom.xml index 9ac80456946e..0d4e35acf4a2 100644 --- a/testsuite/integration-arquillian/util/pom.xml +++ b/testsuite/integration-arquillian/util/pom.xml @@ -21,7 +21,7 @@ org.keycloak.testsuite integration-arquillian - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/testsuite/model/pom.xml b/testsuite/model/pom.xml index 9cbeb47de226..429f483dcdcf 100644 --- a/testsuite/model/pom.xml +++ b/testsuite/model/pom.xml @@ -4,7 +4,7 @@ org.keycloak keycloak-testsuite-pom - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml diff --git a/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java b/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java index 641aa34b77d1..277fbf9579c7 100644 --- a/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java +++ b/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java @@ -2,7 +2,6 @@ import java.io.IOException; import java.util.List; -import java.util.concurrent.ThreadLocalRandom; import java.util.concurrent.TimeUnit; import java.util.stream.Stream; @@ -13,11 +12,6 @@ import org.infinispan.configuration.cache.BackupFailurePolicy; import org.infinispan.configuration.cache.CacheMode; import org.infinispan.configuration.cache.ConfigurationBuilder; -import org.infinispan.container.versioning.IncrementableEntryVersion; -import org.infinispan.container.versioning.NumericVersion; -import org.infinispan.container.versioning.VersionGenerator; -import org.infinispan.factories.ComponentRegistry; -import org.infinispan.factories.KnownComponentNames; import org.infinispan.manager.DefaultCacheManager; import org.infinispan.server.hotrod.HotRodServer; import org.infinispan.server.hotrod.configuration.HotRodServerConfiguration; @@ -89,42 +83,12 @@ public void createEmbeddedHotRodServer(Config.Scope config) { // create remote keycloak caches createKeycloakCaches(config.getBoolean("async", false) ? CacheMode.REPL_ASYNC : CacheMode.REPL_SYNC); - replaceVersionGenerator(); // Use Keycloak time service in remote caches InfinispanUtil.setTimeServiceToKeycloakTime(hotRodCacheManager); InfinispanUtil.setTimeServiceToKeycloakTime(hotRodCacheManager2); } - // ----- WORKAROUND FOR https://github.com/infinispan/infinispan/issues/13191 -----// - private void replaceVersionGenerator() { - CACHES_NAME.stream() - .flatMap(name -> Stream.of(hotRodCacheManager.getCache(name), hotRodCacheManager2.getCache(name))) - .map(ComponentRegistry::of) - .forEach(cr -> cr.registerComponent(RANDOM_GENERATOR, KnownComponentNames.HOT_ROD_VERSION_GENERATOR, false)); - } - - private static final NumericVersion NON_EXISTING = new NumericVersion(0); - private static final VersionGenerator RANDOM_GENERATOR = new VersionGenerator() { - @Override - public IncrementableEntryVersion generateNew() { - var version = ThreadLocalRandom.current().nextLong(); - return version == 0 ? new NumericVersion(1L) : new NumericVersion(version); - } - - @Override - public IncrementableEntryVersion increment(IncrementableEntryVersion initialVersion) { - // not used by hot rod - throw new IllegalStateException(); - } - - @Override - public IncrementableEntryVersion nonExistingVersion() { - return NON_EXISTING; - } - }; - // ----- END OF WORKAROUND -----// - private void createKeycloakCaches(CacheMode cacheMode) { var builder = createCacheConfigurationBuilder(); builder.clustering().cacheMode(cacheMode); diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java index 24827a71da19..3f2a2c8fa397 100644 --- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java +++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java @@ -15,6 +15,7 @@ import java.util.Collection; import java.util.List; +import java.util.Random; import java.util.UUID; import java.util.concurrent.atomic.AtomicReference; import java.util.stream.Collectors; @@ -28,6 +29,7 @@ import static org.hamcrest.Matchers.empty; import static org.hamcrest.Matchers.hasSize; import static org.hamcrest.Matchers.is; +import static org.hamcrest.Matchers.notNullValue; import static org.hamcrest.Matchers.nullValue; @RequireProvider(RealmProvider.class) @@ -305,6 +307,93 @@ public void getRolePathTraversal() { }); } + @Test + public void getRoleByNameFromTheDatabaseAndTheCache() { + String roleName = "role-" + new Random().nextInt(); + + // Look up a non-existent role from the database + withRealm(realmId, (session, realm) -> { + RoleModel role = session.roles().getRealmRole(realm, roleName); + assertThat(role, nullValue()); + return null; + }); + + // Look up a non-existent role from the cache + withRealm(realmId, (session, realm) -> { + RoleModel role = session.roles().getRealmRole(realm, roleName); + assertThat(role, nullValue()); + return null; + }); + + // Create the role, and invalidate the cache + withRealm(realmId, (session, realm) -> { + RoleModel role = session.roles().addRealmRole(realm, roleName); + assertThat(role, notNullValue()); + return null; + }); + + // Find the role from the database + withRealm(realmId, (session, realm) -> { + RoleModel role = session.roles().getRealmRole(realm, roleName); + assertThat(role, notNullValue()); + return null; + }); + + // Find the role from the cache + withRealm(realmId, (session, realm) -> { + RoleModel role = session.roles().getRealmRole(realm, roleName); + assertThat(role, notNullValue()); + return null; + }); + + } + + @Test + public void getClientRoleByNameFromTheDatabaseAndTheCache() { + String roleName = "role-" + new Random().nextInt(); + + // Look up a non-existent role from the database + withRealm(realmId, (session, realm) -> { + ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME); + RoleModel role = session.roles().getClientRole(client, roleName); + assertThat(role, nullValue()); + return null; + }); + + // Look up a non-existent role from the cache + withRealm(realmId, (session, realm) -> { + ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME); + RoleModel role = session.roles().getClientRole(client, roleName); + assertThat(role, nullValue()); + return null; + }); + + // Create the role, and invalidate the cache + withRealm(realmId, (session, realm) -> { + ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME); + RoleModel role = session.roles().addClientRole(client, roleName); + assertThat(role, notNullValue()); + return null; + }); + + // Find the role from the database + withRealm(realmId, (session, realm) -> { + ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME); + RoleModel role = session.roles().getClientRole(client, roleName); + assertThat(role, notNullValue()); + return null; + }); + + // Find the role from the cache + withRealm(realmId, (session, realm) -> { + ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME); + RoleModel role = session.roles().getClientRole(client, roleName); + assertThat(role, notNullValue()); + return null; + }); + + } + public void testRolesWithIdsPaginationSearchQueries(GetResult resultProvider) { // test all parameters together List result = resultProvider.getResult("1", 4, 3); diff --git a/testsuite/pom.xml b/testsuite/pom.xml index 11f6fdd0ae1b..a7bed97598b3 100755 --- a/testsuite/pom.xml +++ b/testsuite/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml 4.0.0 diff --git a/testsuite/utils/pom.xml b/testsuite/utils/pom.xml index 16b5964c773d..3d6a178dc3fd 100755 --- a/testsuite/utils/pom.xml +++ b/testsuite/utils/pom.xml @@ -21,7 +21,7 @@ keycloak-testsuite-pom org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/themes/pom.xml b/themes/pom.xml index 4577f0d05fcb..5e29b1fbe642 100755 --- a/themes/pom.xml +++ b/themes/pom.xml @@ -3,7 +3,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 4.0.0 diff --git a/util/embedded-ldap/pom.xml b/util/embedded-ldap/pom.xml index 1e10ff4e357b..cef1a4d7f407 100644 --- a/util/embedded-ldap/pom.xml +++ b/util/embedded-ldap/pom.xml @@ -21,7 +21,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../../pom.xml 4.0.0 diff --git a/util/pom.xml b/util/pom.xml index 8b716dbbd2e5..fac1f7178c8a 100644 --- a/util/pom.xml +++ b/util/pom.xml @@ -20,7 +20,7 @@ keycloak-parent org.keycloak - 999.0.0-SNAPSHOT + 26.1.2 ../pom.xml