Fix account console for usage with secure-session client-policy (#37447) #38476
Conversation
…loak#37447) Previously the missing state parameter caused issues when the client policy `secure-session` was enabled for the realm. This adds a dummy state parameter for the initial server-side auth redirect when we check for an authenticated user in the account-console backend. If the user is successfully authenticated the account-console backend will bootstrap the actual account-console frontend, which will then perform the actual auth code flow with a proper state handling. Fixes keycloak#37447 Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
b31094e to
a465416
Compare
There was a problem hiding this comment.
@thomasdarimont Thanks!
I think test failures are unrelated to your changes. I hope that after rebase (which I did), the PR can be merged.
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#categoriesTestKeycloak CI - WebAuthn IT (firefox) |
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#categoriesTestKeycloak CI - WebAuthn IT (firefox) |
|
@thomasdarimont I've sent another PR #39539 , which fixes the test and also adds an automated test. Can you please review the other PR? If you agree, we can close this PR then. |
|
Closing as this was replaced by #39539 , which was merged already. |
Previously the missing state parameter caused issues when the client policy
secure-sessionwas enabled for the realm.This adds a dummy state parameter for the initial server-side auth redirect when we check for an authenticated user in the account-console backend.
If the user is successfully authenticated the account-console backend will bootstrap the actual account-console frontend, which will then
perform the actual auth code flow with a proper state handling.
Fixes #37447