fix: using inputstream to represent patches by shawkins · Pull Request #47953 · keycloak/keycloak

shawkins · 2026-04-10T14:24:26Z

closes: #47913

There's a couple of changes here:

updated the schema for a patch to an object
expanded the checks for whether it's a valid patch. The alternative is add additional checks to the existing code or to switch from JsonNode to JsonObject.
changed the patch type to InputStream. We no longer need a databind dependency (for the api, it will still be used by the java client), and there's an improvement in the memory handling

Pepo48

Thanks Steve, overall LGTM, just two nitpicks below.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-04-14T18:53:24Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employee2Test

Keycloak CI - Adapter IT Strict Cookies

java.lang.AssertionError
	at org.junit.Assert.fail(Assert.java:87)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.junit.Assert.assertTrue(Assert.java:53)
	at org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest.assertForbiddenLogin(SAMLServletAdapterTest.java:558)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperUserGroupsAggregate

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/employee2/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperGroupsNoAggregate

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/employee2/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#singleLoginAndLogoutSAMLTest

Keycloak CI - Adapter IT Strict Cookies

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for wrapped: text ('principal=bburke') to be present in text in element found by By.xpath: //body (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '21.0.10'
Driver info: org.openqa.selenium.firefox.FirefoxDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostTestCompositeRoleForUser

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a La
8000
mbda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostEmptyConsumerPostURL

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperGroupsAggregate

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/employee2/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testReloginWithInvalidAuthSessionCookie

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostTest

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperUserGroupsNoAggregate

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/employee2/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostSigTest

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post-sig/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#disabledClientTest

Keycloak CI - Adapter IT Strict Cookies

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for wrapped: text ('Login requester not enabled') to be present in text in element found by By.xpath: //body (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '21.0.10'
Driver info: org.openqa.selenium.firefox.FirefoxDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testMultipleTabsParallelLogin

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post/ within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#idpInitiatedUnauthorizedLoginTest

Keycloak CI - Adapter IT Strict Cookies

java.lang.AssertionError
	at org.junit.Assert.fail(Assert.java:87)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.junit.Assert.assertTrue(Assert.java:53)
	at org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest.idpInitiatedUnauthorizedLoginTest(SAMLServletAdapterTest.java:1176)
...

Report flaky test

Pepo48

LGTM now, thanks Steve!

closes: keycloak#47913 Signed-off-by: Steve Hawkins <shawkins@redhat.com>

vmuzikar

LGTM

vmuzikar · 2026-04-15T14:20:54Z

We'll remove this as a follow-up:

keycloak/rest/admin-v2/rest/src/main/java/org/keycloak/admin/internal/openapi/OASModelFilter.java

Lines 132 to 157 in 953cd26

    
               /** 
        
                * Currently, if endpoint consumes 'application/merge-patch+json' and the request object is 'JsonNode', 
        
                * SmallRye OpenAPI generates array type schema for the endpoint. 
        
                * See <a href="https://github.com/smallrye/smallrye-open-api/issues/2494">issue 2494</a> for more context. 
        
                * What we need is either no schema, or an object with additional properties, so that the generated client 
        
                * doesn't have empty body. This method removes schema. 
        
                */ 
        
               private void fixJsonMergePatchRequestObject(OpenAPI openAPI) { 
        
                   if (openAPI.getPaths() == null) { 
        
                       return; 
        
                   } 
        
                   openAPI.getPaths().getPathItems().forEach((path, pathItem) -> { 
        
                       if (pathItem.getPATCH() != null && pathItem.getPATCH().getRequestBody() != null) { 
        
                           var patchOp = pathItem.getPATCH(); 
        
                           var requestBody = patchOp.getRequestBody(); 
        
                           if (requestBody.getContent() != null && requestBody.getContent().getMediaType(JSON_MERGE) != null 
        
                                   && hasJsonNodeParameter(patchOp.getOperationId())) { 
        
                               var mediaTypeObject = requestBody.getContent().getMediaType(JSON_MERGE); 
        
                               mediaTypeObject.setSchema(null); 
        
                               log.debugf("Removed request body schema from PATCH path '%s' operation '%s' using content type '%s'", path, patchOp.getOperationId(), JSON_MERGE); 
        
                           } 
        
                       } 
        
                   }); 
        
               }

closes: keycloak#47913 Signed-off-by: Steve Hawkins <shawkins@redhat.com>

< 8000 div class="flex-shrink-0 mr-1">

shawkins marked this pull request as ready for review April 10, 2026 16:09

shawkins requested review from a team as code owners April 10, 2026 16:09

keycloak-github-bot Bot added team/ui team/cloud-native labels Apr 10, 2026

Pepo48 reviewed Apr 10, 2026

View reviewed changes

shawkins force-pushed the iss47913 branch 4 times, most recently from 429b214 to 3f9803f Compare April 13, 2026 13:03

keycloak-github-bot Bot added the flaky-test label Apr 13, 2026

keycloak-github-bot Bot mentioned this pull request Apr 13, 2026

Flaky test: org.keycloak.testsuite.forms.AuthenticatorSubflowsTest2#testSubflow2 #47477

Closed

keycloak-github-bot Bot reviewed Apr 14, 2026

View reviewed changes

shawkins force-pushed the iss47913 branch from e3cdb00 to 162b605 Compare April 14, 2026 22:48

Pepo48 previously approved these changes Apr 15, 2026

View reviewed changes

shawkins dismissed Pepo48’s stale review via 06737a3 April 15, 2026 11:36

shawkins force-pushed the iss47913 branch 2 times, most recently from 06737a3 to 306c54e Compare April 15, 2026 12:08

fix: using inputstream to represent patches

934c176

closes: keycloak#47913 Signed-off-by: Steve Hawkins <shawkins@redhat.com>

shawkins force-pushed the iss47913 branch from 306c54e to 934c176 Compare April 15, 2026 12:45

vmuzikar approved these changes Apr 15, 2026

View reviewed changes

vmuzikar merged commit 4fd3b00 into keycloak:main Apr 15, 2026
85 checks passed

stianst mentioned this pull request Jun 1, 2026

js deps uuid 26.6 #49539

Closed

sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026

fix: using inputstream to represent patches (keycloak#47953)

b343ae6

closes: keycloak#47913 Signed-off-by: Steve Hawkins <shawkins@redhat.com>

Navigation Menu

Repository navigation

fix: using inputstream to represent patches - #47953

fix: using inputstream to represent patches#47953
vmuzikar merged 1 commit into
keycloak:mainfrom
shawkins:iss47913

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employee2Test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperUserGroupsAggregate

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperGroupsNoAggregate

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#singleLoginAndLogoutSAMLTest

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostTestCompositeRoleForUser

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostEmptyConsumerPostURL

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperGroupsAggregate

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testReloginWithInvalidAuthSessionCookie

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostTest

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperUserGroupsNoAggregate

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostSigTest

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#disabledClientTest

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testMultipleTabsParallelLogin

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#idpInitiatedUnauthorizedLoginTest

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants