keycloak · stianst · Jun 10, 2024 · Jun 10, 2024 · Jun 10, 2024 · Jun 12, 2024
@@ -40,6 +40,7 @@ runs:
       shell: bash
       run: |
         if [ "$RUNNER_OS" == "Windows" ]; then
-          choco install zstandard
+          # zstd binary might be missing in older versions, install only when necessary
+          which zstd > /dev/null || choco install zstandard
         fi
         tar -C ~/ --use-compress-program="zstd -d" -xf m2-keycloak.tzts
@@ -28,18 +28,40 @@ runs:
           ~/.m2/repository/*/*
           !~/.m2/repository/org/keycloak
         key: ${{ steps.weekly-cache-key.outputs.key }}
+        # Enable cross-os archive use the cache on both Linux and Windows
+        enableCrossOsArchive: true
+
+    - id: download-node-for-windows
+      # This is necessary as the build which creates the cache will run on a Linux node and therefore will never download the Windows artifact by default.
+      # If we wouldn't download it manually, it would be downloaded on each Windows build, which proved to be unstable as downloads would randomly fail in the middle of the download.
+      if: inputs.create-cache-if-it-doesnt-exist == 'true' && steps.cache-maven-repository.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        export VERSION=$(mvn help:evaluate -Dexpression=node.version -q -DforceStdout  | cut -c 2-)
+        curl -Lf https://nodejs.org/dist/v${VERSION}/win-x64/node.exe --create-dirs -o ~/.m2/repository/com/github/eirslett/node/${VERSION}/node-${VERSION}-win-x64.exe
+
+    - shell: powershell
+      name: Link the cached Maven repository to the OS-dependent location
+      if: inputs.create-cache-if-it-doesnt-exist == 'false' && runner.os == 'Windows'
+      # The cache restore in the next step uses the relative path which was valid on Linux and that is part of the archive it downloads.
+      # You'll see that path when you enable debugging for the GitHub workflow on Windows.
+      # On Windows, the .m2 folder is in different location, so move all the contents to the right folder here.
+      # Also, not using the C: drive will speed up the build, see https://github.com/actions/runner-images/issues/8755
+      run: |
+        mkdir -p ../../../.m2/repository
+        cmd /c mklink /d $HOME\.m2\repository D:\.m2\repository
 
     - id: restore-maven-repository
       name: Maven cache
       uses: actions/cache/restore@v4
       if: inputs.create-cache-if-it-doesnt-exist == 'false'
       with:
-        # Two asterisks are needed to make the follow-up exclusion work
-        # see https://github.com/actions/toolkit/issues/713 for the upstream issue
+        # This needs to repeat the same path pattern as above to find the matching cache
         path: |
           ~/.m2/repository/*/*
           !~/.m2/repository/org/keycloak
         key: ${{ steps.weekly-cache-key.outputs.key }}
+        enableCrossOsArchive: true
 
     - name: Cache Maven Wrapper
       uses: actions/cache@v4

@@ -12,7 +12,7 @@ REGION=$2
 case $OPERATION in
   requirements)
     ansible-galaxy collection install -r requirements.yml
-    pip3 install --user boto3 botocore
+    pip3 install --user "ansible==9.*" boto3 botocore
   ;;
   create|delete|start|stop)
     if [ -f "env.yml" ]; then ANSIBLE_CUSTOM_VARS_ARG="-e @env.yml"; fi

@@ -1,5 +1,5 @@
 - name: Get Ansible Control Host's public IP
-  shell: curl -ks --ipv4 https://ifconfig.me
+  shell: curl -fks --ipv4 https://ifconfig.me
   register: control_host_ip
   no_log: "{{ no_log_sensitive }}"
 

@@ -14,7 +14,7 @@ check_github_issue_exists() {
     # Extract the CVE ID
     local CVE_ID=$(echo "$issue_title" | grep -oE '(CVE-[0-9]{4}-[0-9]{4,7}|SNYK-[A-Z]+-[A-Z0-9]+-[0-9]{4,7})')
     local search_url="https://api.github.com/search/issues?q=$CVE_ID+is%3Aissue+sort%3Aupdated-desc+repo:$KEYCLOAK_REPO"
-    local response=$(curl -s -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" "$search_url")
+    local response=$(curl -f -s -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" "$search_url")
     local count=$(echo "$response" | jq '.total_count')
 
     # Check for bad credentials
@@ -52,7 +52,7 @@ create_github_issue() {
     local api_url="https://api.github.com/repos/$KEYCLOAK_REPO/issues"
     local data=$(jq -n --arg title "$title" --arg body "$body" --arg branch "backport/$BRANCH_NAME" \
                  '{title: $title, body: $body, labels: ["status/triage", "kind/cve", "kind/bug", $branch]}')
-    local response=$(curl -s -w "%{http_code}" -X POST -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" -d "$data" "$api_url")
+    local response=$(curl -f -s -w "%{http_code}" -X POST -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" -d "$data" "$api_url")
     local http_code=$(echo "$response" | tail -n1)
 
     if [[ $http_code -eq 201 ]]; then
@@ -67,11 +67,11 @@ create_github_issue() {
 update_github_issue() {
     local issue_id="$1"
     local api_url="https://api.github.com/repos/$KEYCLOAK_REPO/issues/$issue_id"
-    local existing_labels=$(curl -s -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" "$api_url" | jq '.labels | .[].name' | jq -s .)
+    local existing_labels=$(curl -f -s -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" "$api_url" | jq '.labels | .[].name' | jq -s .)
     local new_label="backport/$BRANCH_NAME"
     local updated_labels=$(echo "$existing_labels" | jq --arg new_label "$new_label" '. + [$new_label] | unique')
     local data=$(jq -n --argjson labels "$updated_labels" '{labels: $labels}')
-    local response=$(curl -s -w "%{http_code}" -X PATCH -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" -d "$data" "$api_url")
+    local response=$(curl -f -s -w "%{http_code}" -X PATCH -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" -d "$data" "$api_url")
     local http_code=$(echo "$response" | tail -n1)
 
     if [[ $http_code -eq 200 ]]; then

@@ -424,7 +424,6 @@ jobs:
           export CLUSTER_NAME=keycloak_$(git rev-parse --short HEAD)
           echo "ec2_cluster=${CLUSTER_NAME}" >> $GITHUB_OUTPUT
           ./aws_ec2.sh requirements
-          pipx inject ansible-core boto3 botocore
           ./aws_ec2.sh create ${REGION}
           ./keycloak_ec2_installer.sh ${REGION} /tmp/keycloak.zip
           ./mvn_ec2_runner.sh ${REGION} "clean install -B -DskipTests -Pdistribution"
@@ -534,7 +533,7 @@ jobs:
 
       - name: Run cluster tests
         run: |
-          ./mvnw test ${{ env.SUREFIRE_RETRY }} -Pauth-server-cluster-quarkus -Dsession.cache.owners=2 -Dtest=**.cluster.** -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
+          ./mvnw test ${{ env.SUREFIRE_RETRY }} -Pauth-server-cluster-quarkus,db-postgres -Dsession.cache.owners=2 -Dtest=**.cluster.** -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
 
       - name: Upload JVM Heapdumps
         if: always()

@@ -182,8 +182,6 @@ jobs:
 
       - name: Run Playwright tests
         run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test
-        env:
-          KEYCLOAK_SERVER: http://localhost:8080
 
       - name: Upload Playwright report
         uses: actions/upload-artifact@v4
@@ -285,7 +283,6 @@ jobs:
           working-directory: js/apps/admin-ui
         env:
           CYPRESS_BASE_URL: http://localhost:8080/admin/
-          CYPRESS_KEYCLOAK_SERVER: http://localhost:8080
           SPLIT: ${{ strategy.job-total }}
           SPLIT_INDEX: ${{ strategy.job-index }}
           SPLIT_RANDOM_SEED: ${{ needs.generate-test-seed.outputs.seed }}

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak OIDC Client Adapter Modules</name>

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Keycloak Adapters</name>

@@ -6,7 +6,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Client Adapter Modules</name>

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Wildfly Integration</name>

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Client Adapter SPI Modules</name>

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

@@ -22,6 +22,7 @@
 
 import org.jboss.logging.Logger;
 import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.attribute.Attributes.Entry;
 import org.keycloak.authorization.identity.Identity;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
@@ -31,6 +32,8 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserProvider;
+import org.keycloak.representations.JsonWebToken;
 import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
 
 /**
@@ -74,9 +77,8 @@ public void evaluate(Evaluation evaluation) {
 
     private boolean hasRole(Identity identity, RoleModel role, RealmModel realm, AuthorizationProvider authorizationProvider, boolean fetchRoles) {
         if (fetchRoles) {
-            KeycloakSession session = authorizationProvider.getKeycloakSession();
-            UserModel user = session.users().getUserById(realm, identity.getId());
-            return user.hasRole(role);
+            UserModel subject = getSubject(identity, realm, authorizationProvider);
+            return subject != null && subject.hasRole(role);
         }
         String roleName = role.getName();
         if (role.isClientRole()) {
@@ -86,8 +88,26 @@ private boolean hasRole(Identity identity, RoleModel role, RealmModel realm, Aut
         return identity.hasRealmRole(roleName);
     }
 
+    private UserModel getSubject(Identity identity, RealmModel realm, AuthorizationProvider authorizationProvider) {
+        KeycloakSession session = authorizationProvider.getKeycloakSession();
+        UserProvider users = session.users();
+        UserModel user = users.getUserById(realm, identity.getId());
+
+        if (user == null) {
+            Entry sub = identity.getAttributes().getValue(JsonWebToken.SUBJECT);
+
+            if (sub == null || sub.isEmpty()) {
+                return null;
+            }
+
+            return users.getUserById(realm, sub.asString(0));
+        }
+
+        return user;
+    }
+
     @Override
     public void close() {
 
     }
-}
+}
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.keycloak.bom</groupId>
         <artifactId>keycloak-bom-parent</artifactId>
-        <version>999.0.0-SNAPSHOT</version>
+        <version>25.0.4</version>
     </parent>
 
     <groupId>org.keycloak.bom</groupId>