diff --git a/.forgejo/workflows/verify.yaml b/.forgejo/workflows/verify.yaml
index 9f88d22..be66b11 100644
--- a/.forgejo/workflows/verify.yaml
+++ b/.forgejo/workflows/verify.yaml
@@ -1,19 +1,17 @@
on:
pull_request:
push:
- branches:
- - main
jobs:
ansible-lint:
name: Verify
runs-on: docker
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@v6
- name: Install maven
run: |
apt update
apt install -y maven
- name: Run maven verify
run: |
- mvn -f attribute-endpoints-provider --batch-mode --no-transfer-progress verify
+ mvn -f attribute-endpoints-provider verify
diff --git a/attribute-endpoints-provider/pom.xml b/attribute-endpoints-provider/pom.xml
index a6d1663..61cafbb 100644
--- a/attribute-endpoints-provider/pom.xml
+++ b/attribute-endpoints-provider/pom.xml
@@ -17,7 +17,7 @@
UTF-8
17
17
- 26.6.0
+ 26.7.0
@@ -86,7 +86,7 @@
maven-surefire-plugin
- 3.5.6
+ 3.5.5
maven-jar-plugin
@@ -104,7 +104,7 @@
https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
maven-site-plugin
- 3.22.0
+ 3.21.0
maven-project-info-reports-plugin
diff --git a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
index 15303dc..bd98b30 100644
--- a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
+++ b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
@@ -109,7 +109,6 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider
UserModel authUser = auth.getUser();
if (!authUser.hasRole(authRole)) {
- LOG.info("User " + authUser.getUsername() + " does not have required role " + authRole.getName());
throw new ForbiddenException("User does not have required auth role.");
}
diff --git a/testing/README.md b/testing/README.md
index 2c5600e..86ff971 100644
--- a/testing/README.md
+++ b/testing/README.md
@@ -23,26 +23,12 @@ The copying of the database is necessary to avoid locking errors.
docker compose exec -it keycloak sh -c "cp -rp /opt/keycloak/data/h2 /tmp && env -i -- /opt/keycloak/bin/kc.sh export --db dev-file --db-url 'jdbc:h2:file:/tmp/h2/keycloakdb;NON_KEYWORDS=VALUE' --file /opt/keycloak/data/import/testing.json --realm testing"
```
-## Running Integration Tests
-
-This directory also contains shell scripts that exercise the attribute endpoint.
-
-Bring up Keycloak with `docker compose up -d`, then run one of the `client-test-export-`*`.sh` scripts.
-
-```shell
-$ ./client-test-export-dooris.sh
-[
- "hacker-ssh-key-1",
- "hacker-ssh-key-2"
-]
-```
-
-## Realm `testing` Configuration
+## Testing Realm Configuration
The realm contains these objects:
* Clients:
- * `export-dooris-ssh-keys` with secret `export-dooris-ssh-keys-secret` and user `service-account-export-dooris-ssh-keys`
+ * `export-dooris-ssh-keys` with secret `export-dooris-ssh-keys-secret` and role `export-dooris-ssh-keys`
* `export-mailing-list-addresses` with secret `export-mailing-list-addresses-secret` and role `export-mailing-list-addresses`
* Realm Roles:
* `dooris-authorized`
@@ -68,34 +54,3 @@ The realm contains these objects:
* Dooris SSH Keys:
* SSH Key 1: `hacker-ssh-key-1`
* SSH Key 2: `hacker-ssh-key-2`
- * `service-account-export-dooris-ssh-keys`
- * Role `export-dooris-ssh-keys`
- * `service-account-export-mailing-list-addresses`
- * Role `export-mailing-list-addresses`
-* Realm Settings:
- * User Profile:
- * Attribute Groups:
- * `dooris-ssh-keys`
- * `mailing-list-addresses`
- * Attributes:
- * `mailing-list-address-chaos`
- * Attribute Group `mailing-list-addresses`
- * `mailing-list-address-intern`
- * Attribute Group `mailing-list-intern`
- * `ssh-key-1`
- * Attribute Group `dooris-ssh-keys`
- * `ssh-key-2`
- * Attribute Group `dooris-ssh-keys`
-* Custom Attributes:
- * Slug `dooris-ssh-keys`
- * Attribute Group `dooris-ssh-keys`
- * Match Role `dooris-authorized`
- * Auth Role `export-dooris-ssh-keys`
- * Slug `mailing-list-addresses-chaos`
- * Attribute Group `mailing-list-addresses`
- * Match Role `mailing-list-chaos-member`
- * Auth Role `export-mailing-list-addresses`
- * Slug `mailing-list-addresses-intern`
- * Attribute Group `mailing-list-addresses`
- * Match Role `mailing-list-intern-member`
- * Auth Role `export-mailing-list-addresses`
diff --git a/testing/client-test-export-dooris.sh b/testing/client-test-export-dooris.sh
deleted file mode 100755
index b6d4696..0000000
--- a/testing/client-test-export-dooris.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-
-#
-# Use curl to run a test export of Dooris ssh keys
-#
-
-set -e
-
-ACCESS_TOKEN="$(curl -s --request POST \
- --url http://localhost:8080/realms/testing/protocol/openid-connect/token \
- --header 'content-type: application/x-www-form-urlencoded' \
- --data scope=openid \
- --data client_id=export-dooris-ssh-keys \
- --data client_secret=export-dooris-ssh-keys-secret \
- --data grant_type=client_credentials | jq --raw-output .access_token -)"
-
-curl -s --request GET \
- --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys \
- --header "authorization: Bearer ${ACCESS_TOKEN}" \
- --header "content-type: application/json" | jq . -
\ No newline at end of file
diff --git a/testing/compose.yaml b/testing/compose.yaml
index 0311532..ee2a937 100644
--- a/testing/compose.yaml
+++ b/testing/compose.yaml
@@ -1,6 +1,6 @@
services:
keycloak:
- image: quay.io/keycloak/keycloak:26.6.0
+ image: quay.io/keycloak/keycloak:26.7.0
pull_policy: always
command: "start-dev --features=declarative-ui --import-realm"
environment:
diff --git a/testing/import/testing.json b/testing/import/testing.json
index 3744ff8..a91df6c 100644
--- a/testing/import/testing.json
+++ b/testing/import/testing.json
@@ -470,7 +470,7 @@
"credentials" : [ ],
"disableableCredentialTypes" : [ ],
"requiredActions" : [ ],
- "realmRoles" : [ "export-dooris-ssh-keys", "default-roles-testing" ],
+ "realmRoles" : [ "default-roles-testing" ],
"notBefore" : 0,
"groups" : [ ]
}, {
@@ -484,7 +484,7 @@
"credentials" : [ ],
"disableableCredentialTypes" : [ ],
"requiredActions" : [ ],
- "realmRoles" : [ "export-mailing-list-addresses", "default-roles-testing" ],
+ "realmRoles" : [ "default-roles-testing" ],
"notBefore" : 0,
"groups" : [ ]
}, {
@@ -1478,7 +1478,7 @@
"subType" : "authenticated",
"subComponents" : { },
"config" : {
- "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ]
+ "allowed-protocol-mapper-types" : [ "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-property-mapper" ]
}
}, {
"id" : "a49de9bf-462b-4c61-bb52-0373732f4b1b",
@@ -1538,7 +1538,7 @@
"subType" : "anonymous",
"subComponents" : { },
"config" : {
- "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper" ]
+ "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "oidc-address-mapper", "saml-role-list-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-usermodel-property-mapper", "saml-user-attribute-mapper" ]
}
}, {
"id" : "dd4024e9-f080-4319-aeb7-7f9906c345c5",
@@ -1625,8 +1625,8 @@
"subComponents" : { },
"config" : {
"match-role" : [ "mailing-list-chaos-member" ],
- "auth-role" : [ "export-mailing-list-addresses" ],
"attribute-group" : [ "mailing-list-addresses" ],
+ "auth-role" : [ "export-mailing-list-addresses" ],
"slug" : [ "mailing-list-addresses-chaos" ]
}
} ]