Skip to content

Bi sync upstream - #32

Closed
adhurjaty wants to merge 175 commits into
mainfrom
biSyncUpstream
Closed

Bi sync upstream#32
adhurjaty wants to merge 175 commits into
mainfrom
biSyncUpstream

Conversation

@adhurjaty

Copy link
Copy Markdown

What this PR does / why we need it:

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

How this PR was tested:

Screenshots / logs (if relevant):

Special notes for your reviewer:

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

  • tests pass locally (mvn test or relevant subset)
  • added/updated tests for the changes (if applicable)
  • documentation has been updated (if applicable)
  • the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR


@Test
void shouldSanitizePasswordInFormParameters() {
String message = "grant_type=password&username=admin&password=secret123";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ ⚠️ ⚠️ WARNING! ⚠️ ⚠️ ⚠️
Hello fellow developer! Looks like you committed a password.
Remember to keep secrets out of version control. If this was used in production, it needs to be rotated immediately.
If this was used in QA or for unit testing, you can use dynamic passwords.

random_string = SecureRandom.alphanumeric(10)
post sign_in_url, params: { session: { email: 'test1@test.com', password: random_string } }

Please reach out to security in the #fargo-security-alerts Slack channel.

@fargo-app
fargo-app Bot requested a review from a team June 24, 2026 20:52
AssahBismarkabah and others added 27 commits June 24, 2026 14:00
…rns-501-for-keycloak-26.2.0+

feature/Fine-Grained Admin Permissions (FGAP) V2 compatibility with Keycloak 26.2.0+
…lue-proposition-and-enhance-contributingmd

Enhance Readme value proposition and update contribution guidelines
chore: prepare release v6.4.1 and next development iteration
fix: ensure composite realm roles are cleared when empty in configura…
Nkwenti-Severian-Ndongtsop and others added 27 commits June 24, 2026 14:05
…1568-added-baseline-config-from-keycloak

Added baseline config for new keycloak versions
…526-resource-bare-id

fix(authz): preserve full resource names for custom clients in FGAP V2
feat: Improve config validation with JSON schema
Co-authored-by: Ian <ianwallen@hotmail.com>
…514-removing-ldap-default-mappers

removing ldap default mappers
…492-postbrokerlogin-server-error

Resolve post broker login recreate bug
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.0.0 to 7.2.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v7.0.0...v7.2.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps org.mock-server:mockserver-spring-test-listener from 5.15.0 to 6.0.0.

---
updated-dependencies:
- dependency-name: org.mock-server:mockserver-spring-test-listener
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…s/docker/build-push-action-7.2.0

build(deps): bump docker/build-push-action from 7.0.0 to 7.2.0
Bumps [org.keycloak:keycloak-parent](https://github.com/keycloak/keycloak) from 26.5.5 to 26.6.2.
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](keycloak/keycloak@26.5.5...26.6.2)

---
updated-dependencies:
- dependency-name: org.keycloak:keycloak-parent
  dependency-version: 26.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…k-server-mockserver-spring-test-listener-6.0.0

build(deps-dev): bump org.mock-server:mockserver-spring-test-listener from 5.15.0 to 6.0.0
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.2 to 6.0.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5.5.2...v6.0.1)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…cloak-keycloak-parent-26.6.2

build(deps): bump org.keycloak:keycloak-parent from 26.5.5 to 26.6.2
…s/codecov/codecov-action-6.0.1

build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.1
Fix Keycloak FGAP version detection using wrong feature names
* Add subGroup as managed properties

* Update documentation

* Bump softprops/action-gh-release from 2.1.0 to 2.5.0

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.1.0 to 2.5.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2.1.0...v2.5.0)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump azure/setup-helm from 4.2.0 to 4.3.1

Bumps [azure/setup-helm](https://github.com/azure/setup-helm) from 4.2.0 to 4.3.1.
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](Azure/setup-helm@v4.2.0...v4.3.1)

---
updated-dependencies:
- dependency-name: azure/setup-helm
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fixes adorsys#1278: Updating attributes of a user, which has no attributes set, will work now

* [maven-release-plugin] prepare release v6.4.1

* [maven-release-plugin] prepare for next development iteration

* build(deps): bump crazy-max/ghaction-github-runtime from 3.0.0 to 3.1.0

Bumps [crazy-max/ghaction-github-runtime](https://github.com/crazy-max/ghaction-github-runtime) from 3.0.0 to 3.1.0.
- [Release notes](https://github.com/crazy-max/ghaction-github-runtime/releases)
- [Commits](crazy-max/ghaction-github-runtime@v3.0.0...v3.1.0)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-github-runtime
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: ensure composite realm roles are cleared when empty in configuration

* test: relocate RealmRoleCompositeImportServiceTest to main service package

* Edit .gitignore

* Refactor ClientRepository to enhance code readability

* Resolve checksum errors

* enhance/code-readability: Refactor to use idiomatic Optional and Stream API

* test: relocate RealmRoleCompositeImportServiceTest to main service package

* Removed unit and integration test

* Changed the realm name name in the json files to realmwithcompositeroles

* build(deps): bump actions/setup-java from 5.0.0 to 5.2.0

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.0.0 to 5.2.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5.0.0...v5.2.0)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/setup-python from 5.3.0 to 6.2.0

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.3.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5.3.0...v6.2.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix client policies erasure and add regression tests

* feat: get all clients by page of 100 adorsys#1384

* fix: debug log use wrong value adorsys#1387

* fix: Allow to update/set default flow without authenticationFlows: key

    call setupFlowsInRealm when authenticationFlows is null
    Closes adorsys#1387

* fix(client-policies): fix KC 26 compatibility, add idempotency checks, and update test resources

* updated the changelog file with the changes made in this branch

* skip client policies tests on Keycloak < 24

* doc: CHANGELOG add usage of pagination to retrieve Clients adorsys#1384

* feat: add support to workflows

* feat: add support to workflows

* chore: bump testcontainers.version to 1.21.4

* build(deps): bump actions/cache from 4.2.0 to 5.0.3

Bumps [actions/cache](https://github.com/actions/cache) from 4.2.0 to 5.0.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4.2.0...v5.0.3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* feat(import): delete Keycloak state when arrays are empty

- skip group client role lookups when role list is empty
- add client protocol mapper sync helpers (add/remove/update/get)
- always update client protocol mappers and scopes to allow empty-array deletes

* feat(logging): add logging for protocol mapper creation failures in ClientRepository

* build(deps): bump actions/checkout from 4.2.2 to 6.0.2

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.2.2...v6.0.2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump docker/login-action from 3.3.0 to 3.7.0

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.3.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3.3.0...v3.7.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/download-artifact from 4.1.8 to 7.0.0

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.8 to 7.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.1.8...v7.0.0)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* feat: add JavaScript variable substitution support in configuration files and fixed the vulnerabilities in the root pom.xml

* feat: add JavaScript variable substitution support (adorsys#934)

* Edit .gitignore

* Refactor ClientRepository to enhance code readability

* Resolve checksum errors

* enhance/code-readability: Refactor to use idiomatic Optional and Stream API

* doc: CHANGELOG add usage of pagination to retrieve Clients adorsys#1384

* chore(CHANGELOG): remove redundant fixes

* build(deps): bump docker/build-push-action from 6.18.0 to 6.19.2

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6.18.0...v6.19.2)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* feat: implemented organization management

* chore(legacy): added legacy files for backward compatibilty

* fix: org member resource not found in keycloak client version 26.0.2

* fix(compat): keep org condition test + beans on pre-kc26

* fix: added test coverage for jacoco

* fix: remove classes not found in legacy versions

* Fixing typo in README.md file

IMPORT_VARSUBSTITUTION_UNDEFINEDISTERROR -> IMPORT_VARSUBSTITUTION_UNDEFINEDISERROR

Error not Terror ;-)

* fix coverage issue

* Fix JaCoCo complexity coverage and CI compilation

* Fix jakarta.ws.rs dependency scope for main compilation

Remove test scope from jakarta.ws.rs-api dependency since main source code
also needs these JAX-RS classes for compilation

* restore pom version fix

* Fix legacy javax compatibility and Java 17 tests

* Update changelog for organizations support

* refactor(stub): remove stub files and use maven exclude for compatibility

* Fix YAML codePointLimit test

* docs: update changelog

* test: add user update ignored props json

* docs: link issue 910

* feat: user update ignored props

* feat: configurable ignored user fields

* test: default ignored props

* test: ignore configured user fields

* test: it user update ignored props

* test: remove codepoint limit

* Remove CI runs for Keycloak v18 and v19

* fix: ensure user can re-use user update without disabling fields

* build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v6.0.0...v7.0.0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7.0.0...v8.0.0)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Added integration and unit test for composite roles

* Updated change log to remove the change that was previously made

* chore(json): breakdown test json into small json units

* test(auth-flows): add fixture for displayName-only update with flows

* fix(auth-flows): harden used-flow workaround cleanup and temp client flow provider

* test(auth-flows): regression test for stable flow IDs on displayName-only realm update

* fix(auth-flows): normalize execution priorities for stable flow comparison

* docs(changelog): avoid auth flow recreation on realm-only updates

* fix: added tests to meet coverage

* fix version baseline issue

* fix: checksum issue which was causing the flag bug

* remove flag implementation

* fix checksum backward failure

* Fix exception in 'isDefaultRole' when description is null.

* fix checksum check activation

* feat: Catch Keycloak error 500 InternalServerErrorException adorsys#1389

* doc: update CHANGELOG about catching http 500 error when deleting flow failed adorsys#1389

* build(deps): bump docker/login-action from 3.7.0 to 4.0.0

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3.7.0...v4.0.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.0.0

Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.2.0 to 4.0.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@v3.2.0...v4.0.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump docker/setup-buildx-action from 3.11.1 to 4.0.0

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 4.0.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v3.11.1...v4.0.0)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6.19.2...v7.0.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Import stop on missing AuthenticatorConfig

Closes adorsys#1382

* fix: checkstyle order import

* fix: PMD Failure: de.adorsys.keycloak.config.repository.AuthenticatorConfigRepository:62 Rule:EmptyCatchBlock Priority:3 Avoid empty catch blocks.

* doc: CHANGELOG don't stop if authenticator config is already missing on removal adorsys#1382

* fixes adorsys#1397: Avoid export of all groups when importing scope mappings

* feat: increase code point limit to 500MB for import and normalization processes

* Fix YAML codePointLimit test

* docs: update changelog

* fix: update tests to match NormalizationFilesProperties constructor changes

* doc: Update CHANGELOG adorsys#1397

* fixes adorsys#1397: fix expected method calls in unit tests

* build(deps): bump docker/metadata-action from 5.10.0 to 6.0.0

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.0.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5.10.0...v6.0.0)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* feat(client): support standard token exchange settings

* chore(changelog): mention standard token exchange client support

* Update CHANGELOG.md

* fix: align JacksonProvider with Keycloak client compatibility spec

* docs: update changelog for Keycloak client compatibility

* fix: remove NON_NULL from JacksonProvider to fix auth flow overrides

* ci: add Keycloak 26.5.4 + client 26.0.8 to test matrix

* test: cover ClientImportService FGAP V2 branches and JacksonProvider compatibility

* chore: address SonarCloud warnings

* feat: add merge flag for user realmRoles and groups with tests

* test: cover managed sub-group and merge user flags binding

* fix: create authorization scopes before resources to ensure proper binding

- Fix import order in ClientAuthorizationImportService.updateAuthorization()
- Scopes must exist before resources can bind to them
- Prevents HTTP 403 errors when evaluating permissions
- Add test config demonstrating group policy with authorization settings

* docs: update CHANGELOG for authorization import order fix

* updated CHANGELOG.md with optional merge mode

* feat: add support for defaultValue in user profile attributes (Keycloak 26.4+)

- Store userProfile as JsonNode in RealmImport to preserve all fields including defaultValue
- Use raw HTTP call in UserProfileRepository to send JSON directly to Keycloak
- Add integration test for defaultValue user profile attribute
- Update CHANGELOG.md

* fix: use try-finally instead of try-with-resources for javax.ws.rs.client.Client compatibility

* fix: use raw HTTP to get user profile config in test to preserve defaultValue

- The client library UPConfig doesn't have defaultValue field
- Use raw HTTP GET to retrieve the JSON directly from Keycloak
- Fix incorrect check in UserProfileRepository for newUserProfileConfiguration

* feat: track groups in remote-state to prevent deletion of UI-created groups

- Add setGroups() and getGroups() methods to StateService
- Modify GroupImportService to only delete groups tracked in state
- Groups created via Keycloak UI are now preserved when remote-state.enabled=true
- Fixes adorsys#1400

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v8.0.0...v8.0.1)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* [maven-release-plugin] prepare release v6.5.0

* [maven-release-plugin] prepare for next development iteration

* fix(deps): update assertj to 3.27.7 and jackson to 2.21.1

* fix(deps): update multiple dependencies to fix security vulnerabilities

* docs: structured issue & PR templates and contributing guide

* fix(ci): publish Helm chart on tag pushes instead of main branch

* feat(tls): add support for TLS configuration

* docs(changelog): document support for x509 client certificate authentication (mTLS)

* build(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.5.0 to 2.6.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2.5.0...v2.6.1)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* feat: add documentation issue template

* Support for Keycloak 26.5.5 (#2)

* current keycloak version to fix issue 1303

* kleinen Test ergänzt

* Version Upgrade performed with desired script

* updated test

* updated changelog

* current keycloak version to fix issue 1303

* kleinen Test ergänzt

* Version Upgrade performed with desired script

* updated test

* updated changelog

* Passkey-Property Test is excluded in single Testfile to support older Keycloak-Versions with build-excludes in pom.xml

* correct Changelog

* isolate Passkey-Test for all Keycloak-versions prior to 26.4.0

* another try - isolate Passkey-Test for all Keycloak-versions prior to 26.4.0

* Tests extended, final Keycloak Version 26.5.5

* Introduce new maven profile for Keycloak-Versions before 26.4.0

* correct Testclass to exclude in pom.xml

* delete unessesary Testfile

* Polishing

* Fix FGAP IdP resource name sanitization (adorsys#1402)

* Add regression test for IdP resource prefix resolution (adorsys#1402)

* Changelog: note IdP authz resource duplication fix (adorsys#1402)

* Fix PMD warnings in ClientAuthorizationImportService

* Remove 'with' field and update related methods

* Update WorkflowRepositoryTest to use 'with' instead of 'config'

* Update CHANGELOG

Updated CHANGELOG with fix to outdated Keycloak workflow API documentation.

* Add WebAuthn Passwordless Policy updating as Feature

* Revert "Add WebAuthn Passwordless Policy updating as Feature"

This reverts commit b6775cc.

* build(deps): bump azure/setup-helm from 4.3.1 to 5.0.0

Bumps [azure/setup-helm](https://github.com/azure/setup-helm) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](Azure/setup-helm@v4.3.1...v5.0.0)

---
updated-dependencies:
- dependency-name: azure/setup-helm
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* initial circle ci config

* switch master to main for primary branch in this repo

* Add keycloak version build args

* Prevent querying all clients on searching matching client composites

* BOURNE-1686: Avoid fetching all clients when deleting managed clients

When "remote state" is enabled for clients (the default), Keycloak will only delete clients that were listed in the config tool's state. This prevents it from deleting clients that it didn't create.

When deciding what to delete, we can just fetch the clients that were already in the state, rather than listing all the clients in the realm. This should be a much smaller list, and prevents issues where the server cuts off the response when the list is too large.

* BOURNE-1686: Use pagination when fetching all clients

It's difficult to avoid all situations where we need to list all the clients in the realm. If we try fetching them all in one request, it can fail because the response is cut off by the server. As long as we're using reasonably-sized pages, we should avoid resource limits and actually run much faster.

* BOURNE-1686: Paginate group requests, and use API to get group by name

Previously, searchByName() was fetching all groups and filtering. This now uses `?search=<name>&exact=true`.

There is still another place where it is fetching all groups. For now, we'll add pagination, but eventually we'll want to fix this.

* Add logging around expensive calls

* Decrease page size

* Change getAll client methods to returns streams (#9)

* Prevent retrieving all clients in client composite import

* Refactor role import service to avoid fetching all clients (#11)

* Prevent recreating auth flows if priority values changed (but order remains the same) (#15)

* Update custom top-level authentication flows instead of deleting and recreating (#16)

* Retrieve realm-management client authz information in parts to prevent long-running query (#17)

* Limit retrieving existing policies if NO_DELETE (#18)

* Restrict npm servers from docker build

* Upgrade keycloak version in CCI build

* Fix miscellaneous errors after merge conflicts

- Fixes checkstyle violations to get mvn test passing

* Support fine grained admin permissions v2 in our authz fetching

* Bump Keycloak version to 26.5.4

- This will include a RealmRepresentation model with the
needed passkey attributes

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Motouom Victoire <149515567+Motouom@users.noreply.github.com>
Co-authored-by: gdelbos <gael.delbos@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Assah Bismark <134822946+AssahBismarkabah@users.noreply.github.com>
Co-authored-by: Lukas Bard <lukas.bard@init.de>
Co-authored-by: Assah Bismark <assah9799@gmail.com>
Co-authored-by: mbiti2 <louisembiti@gmail.com>
Co-authored-by: msbeigiai <msbeigi83@gmail.com>
Co-authored-by: douph1 <45632394+douph1@users.noreply.github.com>
Co-authored-by: Sergio Artero <sergio.artero@roche.com>
Co-authored-by: Motouom <motouomvictor@gmail.com>
Co-authored-by: Nkwenti-Severian-Ndongtsop <halamadrid651643565@gmail.com>
Co-authored-by: Johannes Schäfer <johannesschaefer@users.noreply.github.com>
Co-authored-by: Randall Naar <rnd.naar@gmail.com>
Co-authored-by: Robert Przewozny <rpr@outermedia.de>
Co-authored-by: Teja <tejasimma033@gmail.com>
Co-authored-by: tegha-romeo <romeotegha@gmail.com>
Co-authored-by: brmrk24 <richard.klassen@barmer.de>
Co-authored-by: Nkwenti-Severian-Ndongtsop <severiannkwenti@gmail.com>
Co-authored-by: Sergio Artero <sergio.artero@gmail.com>
Co-authored-by: dannyrife <danny.rife@appfolio.com>
Co-authored-by: Anil Dhurjaty <anil.dhurjaty@appfolio.com>
Co-authored-by: Tim Yates <tim.yates@appfolio.com>
Co-authored-by: Anil <adhurjaty@gmail.com>
Comment thread README.md
docker run --rm \
-e KEYCLOAK_URL="http://localhost:8080" \
-e KEYCLOAK_USER=admin \
-e KEYCLOAK_PASSWORD=admin123 \

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ ⚠️ ⚠️ WARNING! ⚠️ ⚠️ ⚠️
Hello fellow developer! Looks like you committed a password.
Remember to keep secrets out of version control. If this was used in production, it needs to be rotated immediately.
If this was used in QA or for unit testing, you can use dynamic passwords.

random_string = SecureRandom.alphanumeric(10)
post sign_in_url, params: { session: { email: 'test1@test.com', password: random_string } }

Please reach out to security in the #fargo-security-alerts Slack channel.

@adhurjaty adhurjaty closed this Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.