added AccountResource SPI, Provider and ProviderFactory. #22317

xgp · 2023-08-08T13:45:19Z

updated AccuntLoader to load provider(s) and check if it is compatible with the chosen theme.

…untLoader to load provider(s) and check if it is compatible with the chosen theme.

…. added some debug logging.

ssilvert

It strikes me that the AccountResourceProvider.useWithTheme(Theme theme) probably ends up with code that is hard-coded to a theme name?

So if you wanted your theme to change providers, you would need to rebuild the provider, right?

Maybe we should establish a convention that specifies a property in theme.properties for this.

So theme.properties would just have:
accountResourceProvider=org.myorg.MyAccountResourceProviderImpl

Then the impl would have something like:

public boolean useWithTheme(Theme theme) {
    return theme.getProperties()
               .getProperty("accountResourceProvider") == this.class.getName();
}

WDYT?

xgp · 2023-08-08T19:40:50Z

@ssilvert I was thinking a similar thing. I just updated the code to check getName and getParentName so that it would work for themes of the same name or those using it as a parent. However, yours works for both cases, so I think it's better. I'll make the change.

…key.

xgp · 2023-08-08T20:13:56Z

@ssilvert updated it to be the default impl of the useWithTheme method. Still possible to override if the implementation wants something special.

ssilvert · 2023-08-09T16:56:27Z

services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java

+      // has the flaw that it will only return the first match. no provision for multiple providers
+      // that match the same theme.


I don't see this as an issue. Should be fine.

ssilvert · 2023-08-09T17:00:23Z

I'm pretty happy with this and I'm looking forward to seeing the Quickstart.

@stianst What do you think? Are we missing anything? (Also see #22318)

xgp · 2023-08-09T17:13:42Z

Thanks @ssilvert . For the quickstart, we were thinking of using the https://github.com/xgp/keycloak-account-v1/ repo which has an example of how to build a AccountResourceProvider and brings back the base v1 account theme. Is that an appropriate example, or do you want something simpler?

ssilvert · 2023-08-09T17:23:01Z

Thanks @ssilvert . For the quickstart, we were thinking of using the https://github.com/xgp/keycloak-account-v1/ repo which has an example of how to build a AccountResourceProvider and brings back the base v1 account theme. Is that an appropriate example, or do you want something simpler?

I think bringing back account v1 in a quickstart makes for a very good example. I was thinking that we should put the Quickstart in https://github.com/keycloak/keycloak-quickstarts. Then the tests that run against that repo would serve as a regression test for this PR.

I'm not sure what @stianst thinks about that idea. The main test suite in keycloak/keycloak ensures that this didn't break anything. It makes sense to me for a quickstart to serve as the test suite for an example provider.

xgp · 2023-08-09T17:25:41Z

Ok. I'll do a PR in https://github.com/keycloak/keycloak-quickstarts

xgp · 2023-08-17T19:32:28Z

@ssilvert quickstart done here keycloak/keycloak-quickstarts#478

garronej · 2023-08-18T02:13:23Z

I can't tell both @xgp and @ssilvert just how appreciative I am for your work on this.

stianst

I'd rather see the built-in provider converted to a default provider, then have the ability in the theme to select the theme provider by id. That allows directly retrieving the provider by id, instead of looping through all providers to select by class name.

Code in AccountLoader would be something like:

String accountResourceProviderId = theme.getProperty(accountResourceProvider);
accountResourceProvider accountResourceProvider = accountResourceProviderId != null ? session.getProvider(AccountResourceProvider.class, accountResourceProviderId) : session.getProvider(AccountResourceProvider.class);

A tricky thing that is needed here is we need to be able to test this stuff. Not really sure how we would achieve that as it's a bit complicated. Guess it would need a custom theme + a custom account resource provider of sorts.

One thing this doesn't cover is if there is a want to also provider custom rest endpoints, say for a completely custom SPA based account console that wants to use some custom rest endpoints. That can probably be ignored though, as it is somewhat achievable by disabling the account api feature and deploying a custom RealmResourceProvider.

xgp · 2023-08-29T12:32:07Z

I'd rather see the built-in provider converted to a default provider, then have the ability in the theme to select the theme provider by id. That allows directly retrieving the provider by id, instead of looping through all providers to select by class name.

@stianst This makes sense to me. I'll update the PR to reflect this.

One thing this doesn't cover is if there is a want to also provider custom rest endpoints

Since we are giving the extension author the ability to return a resource for /account, this technically does give them the ability to add their own custom REST endpoints under that path. However, I agree with your statement that it is somewhat moot, given that the author can also bundle a custom RealmResourceProvider to provide REST endpoints.

xgp · 2023-09-06T13:28:07Z

I made the update that makes the AccountConsole the default implementation of AccountResourceProvider.

Regarding testing, I wasn't able to find where the current account console tests are. If you can point me to those, I can write a simple custom provider and add a test.

server-spi-private/src/main/java/org/keycloak/services/resource/AccountResourceSpi.java

...spi-private/src/main/java/org/keycloak/services/resource/AccountResourceProviderFactory.java

ssilvert · 2023-09-07T19:24:18Z

I made the update that makes the AccountConsole the default implementation of AccountResourceProvider.

Regarding testing, I wasn't able to find where the current account console tests are. If you can point me to those, I can write a simple custom provider and add a test.

@xgp With your latest changes the default AccountConsole now uses the provider. So the provider mechanism is already tested by default, right?

xgp · 2023-09-07T19:29:33Z

@xgp With your latest changes the default AccountConsole now uses the provider. So the provider mechanism is already tested by default, right?

@ssilvert That's correct. So that is implicitly tested. Let me know if more needs to be done.

ssilvert · 2023-09-27T18:43:06Z

@xgp What is the status of this? Is there something we are waiting on?

xgp · 2023-09-27T18:44:33Z

@ssilvert Not that I know of. I made all of the suggested changes. AFAIK it is ready.

ssilvert · 2023-09-27T18:46:02Z

@xgp Oh, I didn't see your comment from two days ago. Looks like you are waiting on us.

@pedroigor @stianst I've kicked of CI. Is there anything you need to see before we merge this?

xgp · 2023-09-27T18:47:52Z

@ssilvert No problem. Let me know if anything comes up that you need me to do.

…_KEY in Theme

xgp · 2023-09-27T19:13:35Z

Ah. It looks like I missed pushing up one change. Just did abfc18f. My mistake

xgp · 2023-09-28T15:54:18Z

@ssilvert It looks like there are some things running in CI that I'm missing in my local testing. Is there a guide somewhere on running those same tests locally, so I can make my way through the errors? Or should I just start going through everything that gets run in the ci.yml?

I'm currently doing:

# build everything
mvn clean install -DskipTests=true
cd distribution
mvn clean install

# run testsuite for embedded
cd ..
mvn -f testsuite/integration-arquillian/pom.xml clean install

ssilvert · 2023-09-28T18:20:39Z

@xgp I can see what's wrong with most of these. It's trying to go to the account console V2, which starts with an unsecured page if you hit it before login. Before logging in, go to something like http://localhost:8180/realms/master/account/ and you will see it.

On that page is a title that says, "Welcome to Keycloak account management". That's what these tests are looking for to make sure that the test is starting on the correct page.

But what is happening instead is that it is going to a login page. This likely means that the account console V2 is not active. Probably, your provider is taking over, which immediately needs a login to proceed.

So I think the fix is probably to just make sure that your provider is only active during your specific tests.

pedroigor · 2023-09-28T23:41:18Z

...st/resources/META-INF/services/org.keycloak.services.resource.AccountResourceProviderFactory

@@ -0,0 +1 @@
+org.keycloak.testsuite.theme.CustomAccountResourceProviderFactory


Related to what @ssilvert suggested.

This file should be in the same module where the custom provider is located. I think that is why the server can not find the provider at runtime. The custom providers are only resolved reading service files from JAR files deployed to the providers dir.

Here you have it in the test suite base module.

pedroigor · 2023-09-29T00:49:55Z

...es/src/main/resources/META-INF/services/org.keycloak.services.AccountResourceProviderFactory

This file should be org.keycloak.services.resource.AccountResourceProviderFactory.

… put custom AccountResourceProviderFactory for testing in the same project as the implementation.

xgp · 2023-09-29T19:23:00Z

@ssilvert @pedroigor Thanks for the help! I've made the changes to put the services files in the right places.

I am still struggling a bit to understand how to run the offending tests locally. I have searched around, and other than this guide I can't find great guidance. And when I try what is in the ci.yml I get a lot of failures, even when I go back and run them against main. Any suggestions here would be helpful. TY!

pedroigor · 2023-10-02T14:54:03Z

Try this:

Build the project and skip tests
Run a single test

mvn -f testsuite/integration-arquillian/pom.xml clean install -Pauth-server-quarkus -Denforcer.skip -Dtest=OIDCProtocolMappersTest

Make sure you have auth-server-quarkus-embedded maven profile enabled in your IDE
Run tests from the IDE

ghost

Unreported flaky test detected, please review

ghost · 2023-10-02T16:42:49Z

Unreported flaky test detected

If the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.ui.account2.DeleteAccountTest#navigationTest

Keycloak CI - Account Console IT (chrome)

org.openqa.selenium.NoSuchElementException: 
no such element: Unable to locate element: {"method":"css selector","selector":"#username"}
  (Session info: headless chrome=117.0.5938.92)
For documentation on this error, please visit: http://seleniumhq.org/exceptions/no_such_element.html
Build info: version: '3.14.0', revision: 'aacccce0', time: '2018-08-02T20:19:58.91Z'
...

Report flaky test

pedroigor

@xgp Thanks.

@stianst @ssilvert LGTM. As you are the initial reviewers, waiting for your review too.

ssilvert

LGTM

stianst

Not clear to me how the provider is loaded when a theme doesn't define the account provider to use.

services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java

garronej · 2023-11-28T14:39:24Z

Thank you all for this work on this!

Keycloakify v9 has been released and it brings back support for Account theme in Keycloak 23!

https://github.com/keycloakify/keycloakify

added AccountResource SPI, Provider and ProviderFactory. updated Acco…

dad705c

…untLoader to load provider(s) and check if it is compatible with the chosen theme.

This was referenced Aug 8, 2023

Allow overriding Account Console resources for full control and backwards compatibility #22318

Closed

Account theme not available in Keycloak keycloakify/keycloakify#389

Closed

xgp added a commit to p2-inc/keycloak-account-v1 that referenced this pull request Aug 8, 2023

updated to work with the changes in pr keycloak/keycloak#22317

9729523

added AccountResourceSpi into services org.keycloak.provider.Spi file…

ce72b15

…. added some debug logging.

ssilvert reviewed Aug 8, 2023

View reviewed changes

updated useWithTheme to load from accountResourceProvider properties …

81da383

…key.

ssilvert reviewed Aug 9, 2023

View reviewed changes

ssilvert requested a review from stianst August 9, 2023 17:00

This was referenced Aug 11, 2023

Try with Keycloakify p2-inc/keycloak-account-v1#3

Closed

account resource provider keycloak/keycloak-quickstarts#478

Closed

xgp marked this pull request as ready for review August 28, 2023 18:38

xgp requested a review from a team as a code owner August 28, 2023 18:38

stianst reviewed Aug 29, 2023

View reviewed changes

xgp added 3 commits September 6, 2023 15:09

updated to make AccountConsole the default provider

2cd18e9

removed unused import

2a1d873

added services config for AccountConsoleFactory

3a6c82a

pedroigor reviewed Sep 7, 2023

View reviewed changes

server-spi-private/src/main/java/org/keycloak/services/resource/AccountResourceSpi.java Outdated Show resolved Hide resolved

...spi-private/src/main/java/org/keycloak/services/resource/AccountResourceProviderFactory.java Outdated Show resolved Hide resolved

Merge branch 'main' into xgp/account-resource-spi

9c3df57

removed ThemeProperties in favor of putting ACCOUNT_RESOURCE_PROVIDER…

abfc18f

…_KEY in Theme

ghost added the flaky-test label Sep 28, 2023

ghost mentioned this pull request Sep 28, 2023

Flaky test: org.keycloak.testsuite.model.session.UserSessionProviderOfflineModelTest#testExpired #16511

Closed

pedroigor reviewed Sep 29, 2023

View reviewed changes

moved default AccountResourceProviderFactory to correct service file.…

f49c733

… put custom AccountResourceProviderFactory for testing in the same project as the implementation.

This was referenced Oct 2, 2023

Flaky test: org.keycloak.testsuite.ui.account2.UpdateEmailTest#updateEmailLinkVisibleWithUpdateEmailActionEnabled #23336

Closed

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testReauthenticationBothBrokersWithOTPRequired #21834

Closed

ghost reviewed Oct 2, 2023

View reviewed changes

pedroigor approved these changes Oct 2, 2023

View reviewed changes

ssilvert approved these changes Oct 5, 2023

View reviewed changes

stianst reviewed Oct 5, 2023

View reviewed changes

services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java Show resolved Hide resolved

stianst self-requested a review October 5, 2023 13:03

stianst approved these changes Oct 5, 2023

View reviewed changes

stianst merged commit 2dfbbff into keycloak:main Oct 5, 2023

xgp mentioned this pull request Oct 12, 2023

Case for changes to Keycloak to enable this p2-inc/keycloak-account-v1#1

Closed

xgp mentioned this pull request Feb 13, 2024

Implement as an AccountResourceProvider p2-inc/phasetwo-admin-portal#133

Closed

		// has the flaw that it will only return the first match. no provision for multiple providers
		// that match the same theme.

		@@ -0,0 +1 @@
		org.keycloak.testsuite.theme.CustomAccountResourceProviderFactory No newline at end of file

added AccountResource SPI, Provider and ProviderFactory. #22317

added AccountResource SPI, Provider and ProviderFactory. #22317

Uh oh!

Conversation

xgp commented Aug 8, 2023 • edited by stianst Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ssilvert left a comment

Choose a reason for hiding this comment

Uh oh!

xgp commented Aug 8, 2023

Uh oh!

xgp commented Aug 8, 2023

Uh oh!

ssilvert Aug 9, 2023

Choose a reason for hiding this comment

Uh oh!

ssilvert commented Aug 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xgp commented Aug 9, 2023

Uh oh!

ssilvert commented Aug 9, 2023

Uh oh!

xgp commented Aug 9, 2023

Uh oh!

xgp commented Aug 17, 2023

Uh oh!

garronej commented Aug 18, 2023

Uh oh!

stianst left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xgp commented Aug 29, 2023

Uh oh!

xgp commented Sep 6, 2023

Uh oh!

Uh oh!

Uh oh!

ssilvert commented Sep 7, 2023

Uh oh!

xgp commented Sep 7, 2023

Uh oh!

ssilvert commented Sep 27, 2023

Uh oh!

xgp commented Sep 27, 2023

Uh oh!

ssilvert commented Sep 27, 2023

Uh oh!

xgp commented Sep 27, 2023

Uh oh!

xgp commented Sep 27, 2023

Uh oh!

xgp commented Sep 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ssilvert commented Sep 28, 2023

Uh oh!

pedroigor Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

pedroigor Sep 29, 2023

Choose a reason for hiding this comment

Uh oh!

xgp commented Sep 29, 2023

Uh oh!

pedroigor commented Oct 2, 2023

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost commented Oct 2, 2023

Unreported flaky test detected

org.keycloak.testsuite.ui.account2.DeleteAccountTest#navigationTest

Uh oh!

pedroigor left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xgp commented Aug 8, 2023 •

edited by stianst

Loading

ssilvert commented Aug 9, 2023 •

edited

Loading

stianst left a comment •

edited

Loading

xgp commented Sep 28, 2023 •

edited

Loading

pedroigor left a comment •

edited

Loading

garronej commented Nov 28, 2023 •

edited

Loading