Thanks to visit codestin.com
Credit goes to Github.com

Skip to content

Added RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST - Fixes policy enforcement gap for direct access grant flows #46283

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
msdaly200 wants to merge 57 commits into
base: main
Choose a base branch
from
Open

Added RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST - Fixes policy enforcement gap for direct access grant flows #46283

msdaly200 wants to merge 57 commits into from
+4,276 −1,461

Conversation

@msdaly200
Copy link
Contributor

@msdaly200 msdaly200 commented Feb 12, 2026

Apply ClientAccessTypeCondition to password grant requests

Add RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST event handling to
ClientAccessTypeCondition for consistent policy enforcement.

Closes #45740

@msdaly200
Added RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST - Fixes policy enfo…
e92c53c 
…rcement gap for direct access grant flows.

Signed-off-by: Marie Daly <[email protected]>
@msdaly200
Updates to test
09cca36 
Signed-off-by: Marie Daly <[email protected]>
@msdaly200 msdaly200 requested review from a team as code owners February 12, 2026 11:58
phantomion and others added 19 commits February 12, 2026 15:12
@phantomion @msdaly200
fix: decode URI path before opening JAR file (keycloak#45972)
070e99d 
fix: use getSchemeSpecificPart

updating how we determine the script jar file

Signed-off-by: Steve Hawkins <[email protected]>
Co-authored-by: Konstantinos Kyriakou <[email protected]>
@pruivo @msdaly200
Use cached realm attributes for PAR and CIBA config
a248e36 
Closes keycloak#46100

Signed-off-by: Pedro Ruivo <[email protected]>
Co-authored-by: Pedro Ruivo <[email protected]>
@rmartinc @msdaly200
Check SubjectConfirmationData element for bearer type
7eda811 
Closes keycloak#45646

Signed-off-by: rmartinc <[email protected]>
@rmartinc @msdaly200
Move upgrading note for SAML to 26.5.4
ce3826a 
Closes keycloak#46150

Signed-off-by: rmartinc <[email protected]>
@vramik @msdaly200
Add cashing for groups by member method
1240db6 
Closes keycloak#46115

Signed-off-by: vramik <[email protected]>
@tdiesler @msdaly200
[OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest()
23ba056 
Signed-off-by: Thomas Diesler <[email protected]>
@vramik @msdaly200
Organization group path handling
ac5ba5b 
Closes keycloak#46025

Signed-off-by: vramik <[email protected]>
@msdaly200
Redirect Wildcard changes and more https checks to secure-client-exec…
bc6102d 
…utor (keycloak#46082)

Closes keycloak#45587


Signed-off-by: Marie Daly <[email protected]>
@graziang @msdaly200
Check if idp is enabled for JWT Auth Grant and Federated Client Auth (k…
4022f2f 
…eycloak#46148)

Closes keycloak#46146

Signed-off-by: Giuseppe Graziano <[email protected]>
@graziang @msdaly200
Doc for JWT auth grant with Google (keycloak#45895)
fccfc41 
Closes keycloak#45654


Signed-off-by: Giuseppe Graziano <[email protected]>
@ValeriaEpifanova @msdaly200
Patch CVE-2026-0707. Add validation on Authorization Header with Bear…
f1daa4a 
…er, add tests (keycloak#45787)

Closes keycloak#45649

Signed-off-by: Valeria Epifanova <[email protected]>
@tdiesler @msdaly200
[OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest()
ff9747e 
Signed-off-by: Thomas Diesler <[email protected]>
@pedroigor @msdaly200
Make sure registration tokens are verified before processing registra…
132f3c6 
…tion (keycloak#46155)

Closes keycloak#46145

Signed-off-by: Pedro Igor <[email protected]>
@graziang @msdaly200
User validation in JWT Authorization Grant (keycloak#46149)
77b1019 
Closes keycloak#46144

Signed-off-by: Giuseppe Graziano <[email protected]>
@lhanusov @msdaly200
[Test Framework] Removing JUnit4 dependency. (keycloak#46174)
ab258f8 
Signed-off-by: Lukas Hanusovsky <[email protected]>
@pedroigor @msdaly200
Make sure updates do not allow updating the resource associated with …
897a861 
…the uma policy (keycloak#46154)

Closes keycloak#46147

Signed-off-by: Pedro Igor <[email protected]>
@shawkins @msdaly200
fix: adding a basic saml client test (keycloak#46098)
6ee8a5b 
closes: keycloak#46042

Signed-off-by: Steve Hawkins <[email protected]>
@mabartos @msdaly200
Use Expressly dependency for Hibernate Validator
4080dbf 
Closes keycloak#46121

Signed-off-by: Martin Bartoš <[email protected]>
@stianst @msdaly200
Fix NPE in test framework registry (keycloak#46163)
d968c34 
Closes keycloak#46162

Signed-off-by: stianst <[email protected]>
tdiesler and others added 12 commits February 12, 2026 15:12
@tdiesler @msdaly200
[OID4VCI] Revisit and fix OAuthClient.credentialRequest()
eed882b 
Signed-off-by: Thomas Diesler <[email protected]>
@rmartinc @msdaly200
Show button in tokens tab when openId4vci is not enabled
cebcb60 
Closes keycloak#45818

Signed-off-by: rmartinc <[email protected]>
@sguilhen @msdaly200
Decode objectGUID when it is imported as a group attribute
11af127 
Closes keycloak#45917

Signed-off-by: Stefan Guilhen <[email protected]>
@shawkins @msdaly200
fix: document passthrough backchannel limitation (keycloak#45915)
3b2f671 
closes: keycloak#45606

Signed-off-by: Steve Hawkins <[email protected]>
@shawkins @msdaly200
fix: refining how the junit Keycloak is launched (keycloak#46182)
99e2e1e 
closes: keycloak#46160

Signed-off-by: Steve Hawkins <[email protected]>
@mabartos @msdaly200
[client-v2] Create tests for checking permissions (keycloak#45981)
072aab7 
* [client-v2] Create tests for checking permissions

Closes keycloak#45975

Signed-off-by: Martin Bartoš <[email protected]>

* Simplify admin client creation, test abstraction

Signed-off-by: Martin Bartoš <[email protected]>

* Address Vasek's comments

Signed-off-by: Martin Bartoš <[email protected]>

---------

Signed-off-by: Martin Bartoš <[email protected]>
@shawkins @msdaly200
fix: updating the fix for docker ulimits (keycloak#46254)
88ac130 
it will now be applied by default

closes: keycloak#44232

Signed-off-by: Steve Hawkins <[email protected]>
@mabartos @msdaly200
[quick-theme] Merge the dark/light selector tabs (keycloak#46247)
6ee5430 
Closes keycloak#45528

Signed-off-by: Martin Bartoš <[email protected]>
@shawkins @msdaly200
fix: normalizing the baseUri to end with / (keycloak#46253)
53a4911 
closes: keycloak#46235

Signed-off-by: Steve Hawkins <[email protected]>
@Pepo48 @msdaly200
Upgrade to Quarkus 3.32.0.CR1 (keycloak#46256)
df11810 
Closes: keycloak#46255

Signed-off-by: Peter Zaoral <[email protected]>
@vramik @msdaly200
Ability to add attributes to organization groups
c8d492c 
Closes keycloak#46263

Signed-off-by: vramik <[email protected]>
@rmartinc @msdaly200
Move upgrading note for the serverinfo to 26.5.4
a9be624 
Closes keycloak#46267

Signed-off-by: rmartinc <[email protected]>
@mposolda mposolda self-assigned this Feb 12, 2026
@ahus1 ahus1 changed the title 45750 Added RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST - Fixes policy enforcement gap for direct access grant flows Feb 12, 2026
rmartinc and others added 10 commits February 13, 2026 13:25
@rmartinc @msdaly200
Check SubjectConfirmationData element for bearer type
19149fb 
Closes keycloak#45646

Signed-off-by: rmartinc <[email protected]>
@rmartinc @msdaly200
Move upgrading note for SAML to 26.5.4
3d7ac02 
Closes keycloak#46150

Signed-off-by: rmartinc <[email protected]>
@tdiesler @msdaly200
[OID4VCI] Revisit and fix OAuthClient.credentialOfferUriRequest()
72af163 
Signed-off-by: Thomas Diesler <[email protected]>
@vramik @msdaly200
Organization group path handling
6392f32 
Closes keycloak#46025

Signed-off-by: vramik <[email protected]>
@graziang @msdaly200
Check if idp is enabled for JWT Auth Grant and Federated Client Auth (k…
b1397fe 
…eycloak#46148)

Closes keycloak#46146

Signed-off-by: Giuseppe Graziano <[email protected]>
@tdiesler @msdaly200
[OID4VCI] Revisit and fix OAuthClient.credentialOfferRequest()
66a7633 
Signed-off-by: Thomas Diesler <[email protected]>
@graziang @msdaly200
User validation in JWT Authorization Grant (keycloak#46149)
8f07c41 
Closes keycloak#46144

Signed-off-by: Giuseppe Graziano <[email protected]>
@tdiesler @msdaly200
[OID4VCI] Revisit and fix OAuthClient.credentialRequest()
ce98393 
Signed-off-by: Thomas Diesler <[email protected]>
@vramik @msdaly200
Ability to add attributes to organization groups
b9959a8 
Closes keycloak#46263

Signed-off-by: vramik <[email protected]>
@rmartinc @msdaly200
Move upgrading note for the serverinfo to 26.5.4
ac1f98f 
Closes keycloak#46267

Signed-off-by: rmartinc <[email protected]>
@msdaly200 msdaly200 requested review from a team as code owners February 13, 2026 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mposolda mposolda

Labels

team/cloud-native team/core-clients team/core-iam team/sre team/ui

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

client-access-type condition in Client Policy does not trigger for token request events