Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Single-character searches such as * or a double quote crash the linked-provider listing because delimiter stripping lacks a minimum-length check.
1 open issue
What changed in this PR
Addresses #52482 by adding a user-specific identity-provider links endpoint, so the Admin UI no longer relies on the first page of realm providers to resolve linked accounts.
Changes:
- Adds linked and available provider listings with provider metadata, search, and pagination.
- Exposes the endpoint through Java and TypeScript admin clients and updates the Admin UI.
- Adds tests for linking behavior and providers beyond the default page size.
| File | Description |
|---|---|
tests/base/src/test/java/org/keycloak/tests/admin/user/UserFedarationTest.java |
Tests linked and available providers, including pagination regression coverage. |
services/src/main/java/org/keycloak/services/resources/admin/UserResource.java |
Implements the links endpoint, filtering, permissions, and metadata resolution. |
js/libs/keycloak-admin-client/src/resources/users.ts |
Adds the TypeScript client method. |
js/libs/keycloak-admin-client/src/defs/federatedIdentityLinkRepresentation.ts |
Defines the enriched link response type. |
js/apps/admin-ui/src/user/UserIdentityProviderLinks.tsx |
Uses the endpoint for provider tables and type badges. |
integration/admin-client-core/src/main/java/org/keycloak/admin/client/resource/UserResource.java |
Adds the Java client method. |
core/src/main/java/org/keycloak/representations/idm/FederatedIdentityLinkRepresentation.java |
Adds the shared response representation with provider metadata. |
Review effort: Balanced
ce827fc to
79d10c7
Compare
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.actions.TermsAndConditionsTest#termsAcceptedKeycloak CI - Forms IT (firefox) org.keycloak.testsuite.actions.TermsAndConditionsTest#termsDeclinedAccountKeycloak CI - Forms IT (firefox) |
79d10c7 to
12da748
Compare
12da748 to
03008f7
Compare
There was a problem hiding this comment.
🟡 Changes recommended
Available-provider filtering ignores resolved display names, so searching for a returned name such as "GitHub" can yield no results and behaves inconsistently with linked-provider searches.
1 open issue
Review effort: Balanced
03008f7 to
b37d60a
Compare
There was a problem hiding this comment.
🟡 Changes recommended
A non-matching paginated search resolves every eligible identity provider, causing database work to scale with the entire realm rather than the requested page size.
1 open issue
1 resolved since last review
Review effort: Balanced
b37d60a to
0606850
Compare
0606850 to
20a6d9c
Compare
There was a problem hiding this comment.
🟡 Changes recommended
Quoted searches use case-insensitive equality for available providers but case-sensitive equality after linking, causing inconsistent results for providers without a configured display name.
1 open issue
1 resolved since last review
Review effort: Balanced
- add GET /admin/realms/{realm}/users/{id}/federated-identity-links,
mirroring the approach already used by the account console's
linked-accounts endpoint
Closes keycloak#52482
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
20a6d9c to
8d41d0f
Compare
There was a problem hiding this comment.
🟡 Changes recommended
Default-locale lowercasing causes resolved-display-name searches for unlinked providers to fail on Turkish JVMs, unlike the linked-provider branch that uses Locale.ROOT.
1 open issue
1 resolved since last review
Review effort: Balanced
| matches = (name, t) -> name.toLowerCase().contains(t.toLowerCase()); | ||
| } else { | ||
| term = search.endsWith("*") ? search.substring(0, search.length() - 1) : search; | ||
| matches = (name, t) -> name.toLowerCase().startsWith(t.toLowerCase()); |
Closes #52482