Repository navigation
Adding ConditionalClientScopeAuthenticator - #36020
Conversation
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.broker.KcOidcBrokerTokenExchangeTest#testInternalExternalTokenExchangeStoredToken |
There was a problem hiding this comment.
Copy/paste issue 😄. Just change to for conditional client scope authenticator or similar.
There was a problem hiding this comment.
Yes, Thanks :-) Updated.
closes keycloak#10250 Signed-off-by: mposolda <mposolda@gmail.com>
|
My comment in my related PR was :
So, in order to close the issue #10250, will MFA (step-up authentication) work with acr and acr_values for federated user? Adding a post flow like mentioned in Creating a browser login flow with step-up mechanism will be enough? |
Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com> Signed-off-by: Marek Posolda <mposolda@gmail.com>
|
@rmartinc @andymunro Thanks for the reviews! |
closes #36081
Adding conditional client scope authenticator. It is a new condition in the authentication flow, which evaluates to true if a configured client scope is present as a client scope of the client requesting authentication. Supported both default client scopes and optional client scopes (in the 2nd case client scope need to be requested by the
scopeparameter during authentication).Adding the test in the
KcOidcPostBrokerLoginTestas I've wanted to test the authenticator in the use-case of identity brokering, which was the original use-case in the GH issue. However the authenticator is not specific to identity brokering and it has use-cases for the default flows likebrowseras well (I recall some similar cases in the past when I was thinking that something like this might be useful). I moved some existing tests to the new class fromKcOidcBrokerLoginTest, which was quite big.Adding the documentation. Also added the documentation for
Post login flowas we did yet have any documentation for it and hence this functionality was maybe a bit hidden (Added few examples to it with the example of the new client scope condition used).