Repository navigation
Conversation
Closes keycloak#52974 Closes keycloak#52972 Signed-off-by: stianst <stianst@gmail.com>
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenTimeIsValidKeycloak CI - Adapter IT Strict Cookies org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employeeSigPostNoIdpKeyTestCertSubjectAsKeyNameInKeyInfoKeycloak CI - Adapter IT Strict Cookies |
rmartinc
force-pushed
the
pr-53090
branch
2 times, most recently
from
September 24, 2026 16:31
7e1739a to
95f904c
Compare
Signed-off-by: rmartinc <rmartinc@redhat.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The dependency, expected-output, documentation, and certificate-fixture updates are consistent, and the relevant FIPS checks pass.
Review effort: Balanced
Findings: None
What changed in this PR
Upgrades Bouncy Castle FIPS to address CVE-2026-13505 and CVE-2026-8798, while refreshing certificate fixtures for stricter hostname validation.
Changes:
- Upgrades the compatible Bouncy Castle FIPS dependency set.
- Updates expected provider-version output in tests and documentation.
- Reissues test certificates with a localhost SAN and refreshes dependent stores.
| File | Description |
|---|---|
pom.xml |
Upgrades FIPS dependencies. |
docs/guides/server/fips.adoc |
Updates documented provider version. |
quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java |
Updates expected provider version. |
tests/base/src/test/resources/keycloak.bcfks |
Refreshes the server certificate store. |
tests/base/src/test/resources/keycloak-truststore.bcfks |
Refreshes the associated truststore. |
tests/base/src/test/resources/keycloak-truststore.pem |
Adds the reissued localhost certificate. |
tests/base/src/test/resources/org/keycloak/tests/cli/keycloak.truststore |
Refreshes the CLI truststore fixture. |
testsuite/integration-arquillian/servers/app-server/jboss/common/keystore/keycloak.truststore |
Refreshes the application-server truststore. |
testsuite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.keystore.bcfks |
Refreshes the FIPS BCFKS keystore. |
testsuite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.keystore.pkcs12 |
Refreshes the FIPS PKCS12 keystore. |
testsuite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.truststore.bcfks |
Refreshes the FIPS BCFKS truststore. |
testsuite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.truststore.pkcs12 |
Refreshes the FIPS PKCS12 truststore. |
testsuite/integration-arquillian/servers/auth-server/common/keystore/keycloak.jks |
Refreshes the authentication-server keystore. |
testsuite/integration-arquillian/servers/auth-server/common/keystore/keycloak.truststore |
Refreshes the authentication-server truststore. |
testsuite/integration-arquillian/tests/base/src/test/resources/keystore/keycloak.jks |
Refreshes the test keystore. |
testsuite/integration-arquillian/tests/base/src/test/resources/keystore/keycloak.truststore |
Refreshes the test truststore. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
|
Closing in favour of #53182 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #52974
Closes #52972