mirror/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2025-12-21 06:20:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

Always allow to setup JWKS URL in oidc idp

Browse Source 
Closes #44217

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
This commit is contained in:
Giuseppe Graziano
2025-11-21 16:39:44 +01:00
committed by Marek Posolda
parent d5a507e90d
commit b323fea8bc
4 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
View File

@@ -2456,7 +2456,7 @@ targetContextAttributes=Target Context Attributes
targetContextAttributesHelp=Defines the evaluation of context attributes (claims) instead of identity attributes
filteredByClaim=Verify essential claim
rowCancelBtnAriaLabel=Cancel edits for {{messageBundle}}
validateSignatureHelp=Enable/disable signature validation of external IDP signatures.
validateSignatureHelp=Enable/disable signature validation of external IDP signatures. For Federated Client Authentication and JWT Authorization Grant the signature validation must be enabled.
searchForFlow=Search for flow
verifyEmail=Verify email
addressClaim.locality.label=User Attribute Name for Locality

1
js/apps/admin-ui/src/identity-providers/add/DiscoverySettings.tsx
View File

@@ -89,6 +89,7 @@ const Fields = ({ readOnly, isOIDC }: DiscoverySettingsProps) => {
<DefaultSwitchControl
name="config.validateSignature"
label={t("validateSignature")}
labelIcon={t("validateSignatureHelp")}
isDisabled={readOnly}
stringify
/>

4
services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java
View File

@@ -1077,6 +1077,10 @@ public class OIDCIdentityProvider extends AbstractOAuth2IdentityProvider<OIDCIde
throw new IdentityBrokerException("JWT Authorization Granted is not enabled for the identity provider");
}
if (!getConfig().isValidateSignature()) {
throw new IdentityBrokerException("Signature validation not enabled for issuer");
}
// verify signature
if (!verify(context.getJws())) {
throw new IdentityBrokerException("Invalid signature");

11
tests/base/src/test/java/org/keycloak/tests/oauth/OIDCIdentityProviderJWTAuthorizationGrantTest.java
View File

@@ -32,6 +32,17 @@ public class OIDCIdentityProviderJWTAuthorizationGrantTest extends AbstractJWTAu
assertFailure("JWT Authorization Granted is not enabled for the identity provider", response, events.poll());
}
@Test
public void testValidateSignatureDisabled() {
realm.updateIdentityProviderWithCleanup(IDP_ALIAS, rep -> {
rep.getConfig().put(OIDCIdentityProviderConfig.VALIDATE_SIGNATURE, "false");
});
String jwt = getIdentityProvider().encodeToken(createAuthorizationGrantToken("basic-user-id", oAuthClient.getEndpoints().getIssuer(), IDP_ISSUER));
AccessTokenResponse response = oAuthClient.jwtAuthorizationGrantRequest(jwt).send();
assertFailure("Signature validation not enabled for issuer", response, events.poll());
}
public static class JWTAuthorizationGrantRealmConfig extends AbstractJWTAuthorizationGrantTest.JWTAuthorizationGrantRealmConfig {
@Override