Skip to content

Enhance Builtin users SPI security #11763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ofahimIQSS merged 7 commits into from
Sep 4, 2025
Merged

Enhance Builtin users SPI security #11763

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e45d287
Added: idp attribute to Keycloak SPI DataverseUserAdapter
GPortas Aug 25, 2025
799a8d7
Added: idp claim value expected for API_BEARER_AUTH_USE_BUILTIN_USER_…
GPortas Aug 25, 2025
db2d192
Merge branch 'develop' of github.com:IQSS/dataverse into 11689-builti…
GPortas Aug 26, 2025
8601113
Changed: updated Keycloak test-realm.json with idp user attribute cla…
GPortas Aug 26, 2025
543bc7c
Added: doc tweak related to impersonation issues when using API_BEARE…
GPortas Aug 27, 2025
e588be5
Added: release notes for #11689
GPortas Aug 27, 2025
cc6bd1c
Fixed: using two separate realm json files, one with SPI, another wit…
GPortas Aug 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion conf/keycloak/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ COPY --from=builder /app/target/keycloak-dv-builtin-users-authenticator-1.0-SNAP

# Copy additional configurations
COPY ./builtin-users-spi/conf/quarkus.properties /opt/keycloak/conf/
COPY ./test-realm.json /opt/keycloak/data/import/
COPY ./test-realm-include-spi.json /opt/keycloak/data/import/

# Set the Keycloak command
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
Expand Down
4 changes: 4 additions & 0 deletions ...ers-spi/src/main/java/edu/harvard/iq/keycloak/auth/spi/adapters/DataverseUserAdapter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package edu.harvard.iq.keycloak.auth.spi.adapters;

import edu.harvard.iq.keycloak.auth.spi.models.DataverseUser;
import edu.harvard.iq.keycloak.auth.spi.providers.DataverseUserStorageProviderFactory;
import org.keycloak.component.ComponentModel;
import org.keycloak.models.GroupModel;
import org.keycloak.models.KeycloakSession;
Expand All @@ -15,10 +16,13 @@ public class DataverseUserAdapter extends AbstractUserAdapterFederatedStorage {
protected DataverseUser dataverseUser;
protected String keycloakId;

private static final String ATTRIBUTE_NAME_IDP = "idp";

public DataverseUserAdapter(KeycloakSession session, RealmModel realm, ComponentModel model, DataverseUser dataverseUser) {
super(session, realm, model);
this.dataverseUser = dataverseUser;
keycloakId = StorageId.keycloakId(model, dataverseUser.getBuiltinUser().getId().toString());
this.setSingleAttribute(ATTRIBUTE_NAME_IDP, DataverseUserStorageProviderFactory.PROVIDER_ID);
}

@Override
Expand Down
Loading