From bbca6116b08865444f423fb3571f3ef9fe659ad4 Mon Sep 17 00:00:00 2001 From: Ricardo Martin Date: Thu, 12 Dec 2024 11:16:30 +0100 Subject: [PATCH] Implement a conditional authenticator to check if a sub-flow was executed or not previously in the process (#35668) Closes #35231 Signed-off-by: rmartinc Co-authored-by: Marek Posolda Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com> --- .../release_notes/topics/26_1_0.adoc | 4 + .../server_admin/images/2fa-example1.png | Bin 0 -> 42082 bytes .../images/2fa-example2-config.png | Bin 0 -> 29815 bytes .../server_admin/images/2fa-example2.png | Bin 0 -> 60698 bytes .../server_admin/images/2fa-example3.png | Bin 0 -> 59280 bytes .../topics/authentication/conditions.adoc | 48 +++- ...nditionalSubFlowExecutedAuthenticator.java | 113 +++++++++ ...alSubFlowExecutedAuthenticatorFactory.java | 118 +++++++++ .../AuthenticationManagementResource.java | 3 +- ...ycloak.authentication.AuthenticatorFactory | 3 +- .../admin/authentication/ProvidersTest.java | 1 + ...ionalSubFlowExecutedAuthenticatorTest.java | 227 ++++++++++++++++++ 12 files changed, 513 insertions(+), 4 deletions(-) create mode 100644 docs/documentation/server_admin/images/2fa-example1.png create mode 100644 docs/documentation/server_admin/images/2fa-example2-config.png create mode 100644 docs/documentation/server_admin/images/2fa-example2.png create mode 100644 docs/documentation/server_admin/images/2fa-example3.png create mode 100644 services/src/main/java/org/keycloak/authentication/authenticators/conditional/ConditionalSubFlowExecutedAuthenticator.java create mode 100644 services/src/main/java/org/keycloak/authentication/authenticators/conditional/ConditionalSubFlowExecutedAuthenticatorFactory.java create mode 100644 testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/login/ConditionalSubFlowExecutedAuthenticatorTest.java diff --git a/docs/documentation/release_notes/topics/26_1_0.adoc b/docs/documentation/release_notes/topics/26_1_0.adoc index b0e0dbe6b6d9..623afce4352e 100644 --- a/docs/documentation/release_notes/topics/26_1_0.adoc +++ b/docs/documentation/release_notes/topics/26_1_0.adoc @@ -51,6 +51,10 @@ by the LDAP provider. As OpenShift v3 reached end-of-life a while back, support for identity brokering with OpenShift v3 has been removed from Keycloak. += New conditional authenticator `Condition - sub-flow executed` + +The `Condition - sub-flow executed` is a new conditional authenticator in {project_name}. The condition checks if a previous sub-flow was executed (or not executed) successfully during the authentication flow execution. For more details, see link:{adminguide_link}#conditions-in-conditional-flows[Conditions in conditional flows]. + = Defining dependencies between provider factories When developing extensions for {project_name}, developers can now specify dependencies between provider factories classes by implementing the method `dependsOn()` in the `ProviderFactory` interface. diff --git a/docs/documentation/server_admin/images/2fa-example1.png b/docs/documentation/server_admin/images/2fa-example1.png new file mode 100644 index 0000000000000000000000000000000000000000..6da90fb4fea8405c16a79bbb70650f461dfd148a GIT binary patch literal 42082 zcmd?R2T+ySwl%udHnfTER#ZR%l^{tJ1Oy3YBr7=xG?D}al%!;Avw&m}5KzfkiIP>6 z93)Ft$vNlr#7EGt2AdR%06qMDZjp@}zSX`Z`ud=4OnFMyC3dixx(V$M_k~>+3S|9OF5` zc>K7~F@B+Af{bTm7|&f$Ov_#QMxiiLB+j2vyz^qX-BwkpXR&C4Zrx|wi&r)&?6>%M z`P1cJuH4#wtD=JK_%7Dne024~I)VmIb^ERd_Ij#UJq;?XzPnrI0;eV8wv)vNcRV_= z-=&jbbK@-z#)vKN3c`kdWVe~**^d}hG_gpYqpO|MScD!@qm~{n!6Hex=r9MLt}0{7_SJpVhA= z51#Jj4y|LRP+U&@Mn1OQ;q|`@KmN9x;?m~YC9J9Z#_s_2ka@s6($^%7>G0OZjlv-Q3>M_8i)iH(#==Bqi)TAQT~JQ0B|ll5Wz( zo6N)Y_vg=*(st0#dLqiuqGH@;rx&K>`2czD<% z`^D9JLqFr-k}EDvD!FN&NQrcaAYG!dQr*sNye$DL>V;rO8F6cJUYQ9P9vQLjDWhg)W;Xiq=}DYsPDY$! z>}%yj^#Obgm21~tA9tGStu$^-2;9Gae|?0+E-vl-wr*kdj2p2RT=&Gvg^7}dNVlIe z^I4(M48ZE*A}J z?#|`XY2`b4-B;N;^=PzI=@;_T{me5Q$sOkq@NPvb9&>fEb>0zNI;WTe){z%~R5QDzqeCm0-&B6$$LE;_742BZrP-DY z)8IJ8g-*^Kd}A~-*ubt7=lij+kb2*~n4H^VgYE(ym+{v#$<8ZMg%5Y|7GXu3EG#VK zeOP2tmb1u>zk2mW(X#{b8kuGTb#h{rR|y*S~E=9FTZpV77;<< zI5otp$Vm=3+u$C4E-sGOEA@W*__1edYAUvN_-EI>LrY@?O`#(8ifPxctc({@sb`vn z{IP47zL8NZ?u=1wghbGB-G_sXiSY;vjw44dWtw*?udS}Q3k7g#L6=;k+K@54O7Y5ULPF{d zaZ2U&d7E*^g-x*q1#Cl_oT^$GoGx?ZYaN!b8)-Od{G;Ybw3OW;s@1kU!!f7!cefPQ znNODuq%cYBVwGz`QsLd7%6#L|l>(;bX1}Jdw=as^8w_Qv6;V5h+CW%0!mS95G+u!9vIY^CPmb864F&c4<4P;_aSS1IYLTBKBf^5x5( zLN>!O19j2CZjMVMnM!erY!cp&9z8--N0$1q(%o%xUY%k%AY@gtufS?Re&a8{2v77G z6n*<}ui@P-U1|6xLXrl-^#X^u-aNL#eJWap}AJ1TkW>FB(Y6J0ouTiqCQC0sG% zh8kX80t>5zZHOJoEHODbS)1>;#3WI$x)?v%SDoz7r9slKcf^LxJ4?#TrM#z+jACU& zgxD3L+_vsM!bn9$B@-f~v@q4Df}lEk_UsA6s{MRsZK~M3e$mmhE2uk zdR<{j_MrDTarU&{KMKmz;|jyy4OWay1;l&G0~FTs^U`ik$ZNj4IpMYYopYxayLSH7 zXN~hG$kjJCHfG=a{#Tqz^6J-#-+%voa%RR47hgJSGt$C#^5n_FIXhe10mSapXV3Wk zyO80oj*gCQrJ^E{RFC=?y_ywxCF!bQR#w))`1eAKTerOAlPU}O9L7IvW@*JDG-O+w z;HF>7vzze_2ngtKoYQR2xh;o{p@QtGlw)IR+L|GwnQc|Gy0XM)(S1pxb||?ZiQM-q zSFVuPi;s_2PdAQyeZh6GHd5-TySox%t+bDsm6hZ8@hcM(6Bj9JDSD-xVPoG5A1R@@ ziHA-$N6FCT%`|E}b#?U#57&+I&_>L#=^OkgY{jOH+)B-U9aV91dfFEeiWJVqz`)R@ zzTuepxko!2P$Uu&i$f^t{LQxqYMEE&yF6H0tHQ*Rg9XfK*EyN}#=wy5!zx!+S6BBn z!=gvhad9BJCFgcB;>t68W*sF$+u5}S^|7b_&t#O>l_jyg^fak9D=ZiGub%Pu_ka4t zy{`Y8PF#2Q^TRViK9w4o1FCwy>lbHhU;BoARv4iYi)qpt@eZGnDBH#RarJ2Gj?(LG zVS-ef_3dOg@JOVjq>!~#PS)ZwHyu zu2p(>^EY|9*J-hb#AB-dsnWJDtEZ zGBS-AMd;M2p)aq_k%*Ojaq<-wg@cLdJf45-S*A|mCO-p z)7B{LI-}xeYbzEbpZ97jF3pboT0&tAm^T=4ZvE@iry~86qaVhHgVX6wSj>CgNUnS# z^3KAf=0~K*FZ!k$nHAr+t{L9E-1t{YR%%NAARFuR5eq5WIYTYu%Laxjt64irLU%YWng z4U?9%*pDAST1|FKU~|Nx{KQ?&N&&!Q-Me=$HM?TTJ`;WY$cyf@M(%?F8sT{+=7SD1;RVf3>Dr;M@ez*zpu zNmm28!Zt9DsiqtIIXF6!y=2;)aseAeP_tH{>&K7Rx4MdYtY|0{iANs$8@T(NWh}!? zMD}JiO4&as#J3IK4~wT}2~GLYdhR$d?H?zkQiEOY{<5MfDYqrVEHHlY6E&OnY{av) z-AAt;*%fZF`R};oLz<}@KX`X5J%2xz+ILcH;?=8HTX*hke0k*E=y;ULc<^?N_su!Od1Gxz~E~b&4ij;4R zoM|`Lep|+0dUmiuiotQ(OUr3N-zRE~s=N#pB+aNU&Ad~zJ>OA-RrbXfl06VmamZi; z`K%{Ts-mRUR0Q%8Ecf}-Cjtve{mr%>GH{!kooz&3A^5ZFsz%!NSEvT@Ms-m|?*uJ- z`+ej@Yk(8{Uc5+HS(+Pa%d(79hxvHi{ctLJof?%X+8 z7wus;H=2lQPs=NaFb{vLTa2t5z0}kVP||>BK6vzK2tYO4X(b!wD>6XKZXniar%SG3 zsWAo-N z_o7>Vu4b)?iuR8f7XdrAZ|+)KX(#))as*_jE5&-(9d5P!SkvXjBKJdjNa88gn3$a~ zPo-|prr33AVOq%p0aJbMoQL?1&@ENPT&4Dukgs`tfmeh-Pf0$@tNEc`N%o-&TZ1c> zZMCci>m>lmy-}3_nR~V zC&5#vg7>EaV3O7jH7@DNF4n<9DltW*NSPu8jn>>)r(C9vb6kRhnZfjEyT-OXoR`rX zOfL>4m)F%Pq#9ONjf=?2%C@|_6~2>R_=tdjK>Celd6Z4{9Gk>a`Jf_qx}lCdd*hDW zthb5CVfe!Wx2P5GX~g*vAU07^QJ~&hphG^ui*SLf<^EjhfIp=B0m@X0mJQJ}GFr&2 z65!g!Dys;@!uRKUN<)&S1_`n0fx3ps@;dD??QAQf^y@Web&H=V0R%R@(K$zbi^~u#JpkC-02E+`5PJh>D7eg#78#ryt5`*jQRB0Agp`j2KVLT`h3R^PO}Fpb}fY zjQ6RR6I+QuQ)IL_J-{NzrChelUi{g9k`if5HxaxEY=V$bVwDT^MQep;>E;#}6VCcUX786Ui z%8}YPeqw%MLI103n%&GG%Q_}Xx3zw`Z=;J#K1(Yy&6V`HwWSM=>2XT*12rOyFO$ps z*;XnBD@tB-`_szFIgE2CsW0tue0xINM7BDLYi&n~&_cm$^n#+3zBK_?2fI~GY1q6U zeBX7kr{$ZsdZ0ht0RKch*DxT6ey0Bv2n6Sjo*{pb0*cM$QZ8 z&kN5qOHo{2+*(<*rsmdKe%rNa2Q3pfH+PrBM@h95QO89q-A#?yY%^7-#`^nf*0`)` zgsfsD1CA!5(Y(Ya)lYZg`pb>m_LNjsR_@D0??IXqvDNu-PEOAH6n!ZY#CPwmEv>ys zd*-|_sZZ`N&=&eh`JnV_bcNr)f4>-$Y0*mQ$f1z6@(z=DQ|I;tZxH34+XWT4z?ZrgjbqJD!T4@c_UFBHAZ&GwR6jh0v5 z(?!W$)|&n-@6)W36&tOnyrdIZCez0#ffl04|ILVTQ<2JpZPc}K=8b{F)uvLM4AbK) zUS2}!#>U@VrZu+qu$&mJ?zUmfY0I@$Fsu%3sE<{k-o5+$=}i;^7Ew_xIsvo#hdbz` z{VQ3~D9rHEMbtEul8wQS`+LchJFEPx~Wf~$;S zcDhMdd`6<9WkP;&sia)W*#}z zLCt2Rn87*b%)L!&LAJi_a=&Q3yZMUWv?T&;0-D69La zXTlTlaPbV0wgAq|s`s@U)&qZAS!bH