8000 [26.6] Enforce the essential acr level when the flow finishes without a step-up by michalvavrik · Pull Request #54346 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[26.6] Enforce the essential acr level when the flow finishes without a step-up - #54346

Merged
rmartinc merged 4 commits into
keycloak:release/26.6from
michalvavrik:backports-26.6/53157
Nov 12, 2026
Merged

[26.6] Enforce the essential acr level when the flow finishes without a step-up#54346
rmartinc merged 4 commits into
keycloak:release/26.6from
michalvavrik:backports-26.6/53157

Conversation

@michalvavrik
@michalvavrik michalvavrik commented Oct 26, 2026
Copy link
Copy Markdown
Member

@michalvavrik
[26.6] fix: enforce the essential acr level when the flow finishes wi…
d35f428 
…thout a step-up

closes: keycloak#53157
backports: keycloak#53587

Signed-off-by: Michal Vavřík <dev@michalvavrik.net>
@michalvavrik
michalvavrik requested review from a team as code owners October 26, 2026 15:42
@michalvavrik
michalvavrik commented Oct 26, 2026
Copy link
Copy Markdown
Member Author

I think the JS failure is just flaky and unrelated.

@michalvavrik michalvavrik mentioned this pull request Oct 26, 2026
Merged
@michalvavrik
michalvavrik requested a review from rmartinc October 26, 2026 17:23
@mabartos mabartos linked an issue Oct 27, 2026 that may be closed by this pull request
[CVE-2026-97176] Essential (forced) acr requirement silently bypassed when a browser flow re-evaluates an already active session with no interactive step #53157
Closed
mabartos
mabartos previously approved these changes Oct 27, 2026
View reviewed changes
@mabartos mabartos left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michalvavrik LGTM, even the TX rollback for the exception. Thanks!

However, it seems the JS job is quite unstable for 26.6

@michalvavrik
michalvavrik commented Oct 27, 2026
Copy link
Copy Markdown
Member Author

However, it seems the JS job is quite unstable for 26.6

yeah, I thought it would be better if someone who can (like you) triggered re-running only the failed job. rebasing or new commit is bit lottery and more work for PR CI (resources)

rmartinc
rmartinc previously approved these changes Nov 12, 2026
View reviewed changes
@rmartinc rmartinc left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @michalvavrik and @mabartos! I have resolved the conflict in the notes and activated auto-merge.

@rmartinc
rmartinc enabled auto-merge (squash) November 12, 2026 15:15
@rmartinc
rmartinc disabled auto-merge November 12, 2026 16:19
@rmartinc
Merge branch 'release/26.6' into backports-26.6/53157
d69b1dc 
Signed-off-by: Ricardo Martin <rmartinc@redhat.com>
@rmartinc
rmartinc enabled auto-merge (squash) November 12, 2026 16:22
@rmartinc
rmartinc commented Nov 12, 2026
Copy link
Copy Markdown
Contributor 8000

Fixing again the conflict.

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Nov 12, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
keycloak-github-bot Bot commented Nov 12, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.ResetPasswordTest#resetPasswordTryAnotherWay

Keycloak CI - Forms IT (firefox)

java.lang.AssertionError: Expected SelectAuthenticatorPage but was Sign in to test (https://localhost:8543/auth/realms/test/login-actions/reset-credentials?client_id=test-app&tab_id=uL4m2TM5Yyw&client_data=eyJydSI6Imh0dHBzOi8vbG9jYWxob3N0Ojg1NDMvYXV0aC9yZWFsbXMvbWFzdGVyL2FwcC9hdXRoIiwicnQiOiJjb2RlIn0)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:39)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
...

Report flaky test

@rmartinc
rmartinc merged commit 97281c0 into keycloak:release/26.6 Nov 12, 2026
82 checks passed
@michalvavrik
michalvavrik deleted the backports-26.6/53157 branch November 12, 2026 18:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rmartinc rmartinc rmartinc approved these changes
@mabartos mabartos mabartos left review comments
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test team/core-authn team/core-protocols

Projects

None yet

Milestone

No milestone

3 participants

@michalvavrik @rmartinc @mabartos
0