6/5/2016 12:20:08 PM
endpoint in proxy
|
3/24/2016 5:32:43 AM
which handles token
requests performs blocking IO. However, the exchange is in non-blocking
mode when it reaches this handler in Keycloak proxy.
|
6/5/2016 12:12:05 PM
- Add support for Script-based AuthenticationExecution definitions.
|
2/9/2016 11:02:53 AM
definitions.
This is a POC for script based authenticator support.
Introduced a ScriptBasedAuthenticator that is bootstraped via a
ScriptBasedAuthenticatorFactory can be execute a configured script
against a provided execution context.
Added an alias property to the AuthFlowExecutionRepresentation in order
to be able to differentiate multiple instances of an Authenticator
within the same AuthFlow.
For convenience editing the AngularJS bindings for the ACE editor were
added for fancy script editing - this needs to be cut down a bit wrt to
themes and supported scripts - e.g. we probably don't expect users to write
authenticator scripts in Cobol...
Removed currently not needed ACE sytax highlighting and themes.
Scripting is now available to all keycloak components that have access to the KeycloakSession.
Introduced new Scripting SPI for configurable scripting providers.
|
6/5/2016 12:06:32 PM
Handle ModelException in UsersResource
|
5/6/2016 2:58:36 PM
now handle ModelExceptions thrown while creating and updating
a new User by rolling back the transaction and presenting
an error message with a HTTP 409 (conflict) code.
Previously only ModelDuplicateExceptions were handled and
ModelExceptions, e.g. due to a failed database operation
lead to a HTTP 500 server error.
|
6/5/2016 12:06:11 PM
Add link to OpenID Endpoint Configuration to realm details page.
|
4/21/2016 3:23:12 PM
to realm details page
We now show a link to the OIDC Endpoints configuration in the realm
details page.
This makes it easier for users to find the OIDC endpoints.
|
6/5/2016 12:03:47 PM
Add client mappers to map user roles to token
|
6/3/2016 10:31:16 AM
two new client protocol mappers to propagate assigned user client / realm roles to a JWT ID/Access Token.
Each protocol mapper supports to use a prefix string that is prepended to each role name. The client role protocol mapper can specify from which client the roles should be considered. Composite Roles are resolved recursively.
Background:
Some OpenID Connect integrations like mod_auth_openidc don't support analyzing deeply nested or encoded structures.
In those scenarios it is helpful to be able to define custom client protocol mappers that allow to propagate a users's roles as a flat structure
(e.g. comma separated list) as a top-level (ID/Access) Token attribute that can easily be matched with a regex.
In order to differentiate between client specific roles and realm roles it is possible to configure
both separately to be able to use the same role names with different contexts rendered as separate token attributes.
|
