-
Realm Roles
+
+ - {{realm.realm}}
+ - Settings
+ - Roles
+
+
{{realm.realm}} Roles
- Table of realm roles
+ Table of realm roles
No configured realm roles...
-
- |
-
-
-
-
- |
-
-
- | Role Name |
- Description |
-
+
+ |
+
+ |
+
+
+ |
+
+
+
+
+ |
+
+
+ | Role Name |
+ Description |
+
diff --git a/admin-ui/src/main/resources/META-INF/resources/admin/partials/role-mappings.html b/admin-ui/src/main/resources/META-INF/resources/admin/partials/role-mappings.html
index d4ffcceb352..902394db626 100755
--- a/admin-ui/src/main/resources/META-INF/resources/admin/partials/role-mappings.html
+++ b/admin-ui/src/main/resources/META-INF/resources/admin/partials/role-mappings.html
@@ -4,36 +4,48 @@
-
User Role Mappings for {{user.username}}
-
+
+ - {{realm.realm}}
+ - Users
+ - {{user.username}}
+ - Role Mappings
+
+
{{user.username}}'s Role Mappings
+
All fields required
<#elseif section = "info">
diff --git a/forms/src/main/resources/META-INF/resources/forms/theme/default/template-login.ftl b/forms/src/main/resources/META-INF/resources/forms/theme/default/template-login.ftl
index d8cca1f1c7f..de023e1bfb8 100644
--- a/forms/src/main/resources/META-INF/resources/forms/theme/default/template-login.ftl
+++ b/forms/src/main/resources/META-INF/resources/forms/theme/default/template-login.ftl
@@ -31,17 +31,16 @@
+
+ If the totp authentication is required by the realm and you remove your configured authenticator,
+ you will have to reconfigure it immediately or on the next login.
+
diff --git a/forms/src/main/resources/org/keycloak/forms/messages.properties b/forms/src/main/resources/org/keycloak/forms/messages.properties
index 92722f94e7f..03943dc0e16 100644
--- a/forms/src/main/resources/org/keycloak/forms/messages.properties
+++ b/forms/src/main/resources/org/keycloak/forms/messages.properties
@@ -37,6 +37,9 @@ invalidPasswordExisting=Invalid existing password
invalidPasswordConfirm=Password confirmation doesn't match
invalidTotp=Invalid authenticator code
+successTotp=Google authenticator configured.
+successTotpRemoved=Google authenticator removed.
+
usernameExists=Username already exists
error=A system error has occured, contact admin
@@ -50,4 +53,5 @@ emailForgotHeader=Forgot Your Password?
emailUpdateHeader=Update password
emailSent=You should receive an email shortly with further instructions.
emailError=Invalid username or email.
+emailErrorInfo=Please, fill in the fields again.
emailInstruction=Enter your username and email address and we will send you instructions on how to create a new password.
\ No newline at end of file
diff --git a/services/src/main/java/org/keycloak/services/resources/AccountService.java b/services/src/main/java/org/keycloak/services/resources/AccountService.java
index b78d9edc4ec..2874971439d 100755
--- a/services/src/main/java/org/keycloak/services/resources/AccountService.java
+++ b/services/src/main/java/org/keycloak/services/resources/AccountService.java
@@ -164,6 +164,15 @@ public class AccountService {
return accessCodeEntry;
}
+ @Path("totp-remove")
+ @GET
+ public Response processTotpRemove() {
+ UserModel user = getUserFromAuthManager();
+ user.setTotp(false);
+ return Flows.forms(realm, request, uriInfo).setError("successTotpRemoved").setErrorType(FormFlows.ErrorType.SUCCESS)
+ .setUser(user).forwardToTotp();
+ }
+
@Path("totp")
@POST
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
@@ -206,7 +215,8 @@ public class AccountService {
if (accessCodeEntry != null) {
return redirectOauth(user, accessCodeEntry);
} else {
- return Flows.forms(realm, request, uriInfo).setUser(user).forwardToTotp();
+ return Flows.forms(realm, request, uriInfo).setError("successTotp").setErrorType(FormFlows.ErrorType.SUCCESS)
+ .setUser(user).forwardToTotp();
}
}
diff --git a/services/src/main/java/org/keycloak/services/resources/TokenService.java b/services/src/main/java/org/keycloak/services/resources/TokenService.java
index d3322d4bf92..89742bf7528 100755
--- a/services/src/main/java/org/keycloak/services/resources/TokenService.java
+++ b/services/src/main/java/org/keycloak/services/resources/TokenService.java
@@ -192,6 +192,11 @@ public class TokenService {
String username = formData.getFirst("username");
UserModel user = realm.getUser(username);
+ if (user == null){
+ return Flows.forms(realm, request, uriInfo).setError(Messages.INVALID_USER).setFormData(formData)
+ .forwardToLogin();
+ }
+
isTotpConfigurationRequired(user);
isEmailVerificationRequired(user);
diff --git a/services/src/main/java/org/keycloak/services/resources/flows/Urls.java b/services/src/main/java/org/keycloak/services/resources/flows/Urls.java
index 1da6a61ef36..b6a86a2cd4b 100755
--- a/services/src/main/java/org/keycloak/services/resources/flows/Urls.java
+++ b/services/src/main/java/org/keycloak/services/resources/flows/Urls.java
@@ -55,6 +55,10 @@ public class Urls {
return accountBase(baseUri).path(AccountService.class, "totpPage").build(realmId);
}
+ public static URI accountTotpRemove(URI baseUri, String realmId) {
+ return accountBase(baseUri).path(AccountService.class, "processTotpRemove").build(realmId);
+ }
+
public static URI accountEmailVerification(URI baseUri, String realmId) {
return accountBase(baseUri).path(AccountService.class, "emailVerification").build(realmId);
}
diff --git a/testsuite/integration/pom.xml b/testsuite/integration/pom.xml
index f0f3eeab35a..3614016c9b6 100644
--- a/testsuite/integration/pom.xml
+++ b/testsuite/integration/pom.xml
@@ -200,6 +200,13 @@
1.6
+
+ org.codehaus.mojo
+ exec-maven-plugin
+
+ ${project.basedir}
+
+
diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java b/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java
index b7f23186683..17e755ee7fb 100755
--- a/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java
@@ -112,17 +112,27 @@ public class KeycloakServer {
if (System.getProperties().containsKey("resources")) {
String resources = System.getProperty("resources");
- if (resources == null || resources.equals("")) {
- for (String c : System.getProperty("java.class.path").split(File.pathSeparator)) {
- if (c.contains("keycloak" + File.separator + "testsuite" + File.separator + "integration")) {
- config.setResourcesHome(c.replaceFirst("testsuite.integration.*", ""));
+ if (resources == null || resources.equals("") || resources.equals("true")) {
+ if (System.getProperties().containsKey("maven.home")) {
+ resources = System.getProperty("user.dir").replaceFirst("testsuite.integration.*", "");
+ } else {
+ for (String c : System.getProperty("java.class.path").split(File.pathSeparator)) {
+ if (c.contains(File.separator + "testsuite" + File.separator + "integration")) {
+ resources = c.replaceFirst("testsuite.integration.*", "");
+ }
}
}
- } else {
- config.setResourcesHome(resources);
}
+
+ File dir = new File(resources).getAbsoluteFile();
+ if (!dir.isDirectory() || !new File(dir, "admin-ui").isDirectory()) {
+ throw new RuntimeException("Invalid resources directory");
+ }
+
+ config.setResourcesHome(dir.getAbsolutePath());
}
+
final KeycloakServer keycloak = new KeycloakServer(config);
keycloak.sysout = true;
keycloak.start();
@@ -291,9 +301,9 @@ public class KeycloakServer {
if (path.startsWith("/forms")) {
file = file(resourcesHome, "forms", "src", "main", "resources", "META-INF", "resources", path.replace('/', File.separatorChar));
} else if (path.startsWith("/admin")) {
- file = file(resourcesHome, "admin-ui", "src", "main", "resources", "META-INF", "resources", path.replace('/', File.separatorChar));
+ file = file(resourcesHome, "admin-ui", "src", "main", "resources", "META-INF", "resources", path.replace('/', File.separatorChar));
if (!file.isFile()) {
- file = file(resourcesHome, "admin-ui-styles", "src", "main", "resources", "META-INF", "resources", path.replace('/', File.separatorChar));
+ file = file(resourcesHome, "admin-ui-styles", "src", "main", "resources", "META-INF", "resources", path.replace('/', File.separatorChar));
}
} else {
throw new IOException("Unknown resource " + path);
@@ -305,10 +315,9 @@ public class KeycloakServer {
private static File file(String... path) {
StringBuilder s = new StringBuilder();
- s.append(path[0]);
- for (int i = 1; i < path.length; i++) {
+ for (String p : path) {
s.append(File.separator);
- s.append(path[i]);
+ s.append(p);
}
return new File(s.toString());
}
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java
index 916513d7ea4..bb70d976cfe 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java
@@ -30,6 +30,8 @@ import org.keycloak.services.managers.RealmManager;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.UserModel.RequiredAction;
+import org.keycloak.testsuite.OAuthClient;
+import org.keycloak.testsuite.pages.AccountTotpPage;
import org.keycloak.testsuite.pages.AppPage;
import org.keycloak.testsuite.pages.AppPage.RequestType;
import org.keycloak.testsuite.pages.LoginConfigTotpPage;
@@ -54,9 +56,6 @@ public class RequiredActionTotpSetupTest {
public void config(RealmManager manager, RealmModel defaultRealm, RealmModel appRealm) {
appRealm.addRequiredCredential(CredentialRepresentation.TOTP);
appRealm.setResetPasswordAllowed(true);
-
- UserModel user = appRealm.getUser("test-user@localhost");
- user.addRequiredAction(RequiredAction.CONFIGURE_TOTP);
}
});
@@ -76,6 +75,12 @@ public class RequiredActionTotpSetupTest {
@WebResource
protected LoginConfigTotpPage totpPage;
+ @WebResource
+ protected AccountTotpPage accountTotpPage;
+
+ @WebResource
+ protected OAuthClient oauth;
+
@WebResource
protected RegisterPage registerPage;
@@ -101,9 +106,69 @@ public class RequiredActionTotpSetupTest {
totpPage.assertCurrent();
- totpPage.configure(totp.generate(totpPage.getTotpSecret()));
+ String totpSecret = totpPage.getTotpSecret();
+
+ totpPage.configure(totp.generate(totpSecret));
+
+ Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+
+ oauth.openLogout();
+
+ loginPage.open();
+ loginPage.loginTotp("test-user@localhost", "password", totp.generate(totpSecret));
Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
}
+ @Test
+ public void setupTotpRegisteredAfterTotpRemoval() {
+ // Register new user
+ loginPage.open();
+ loginPage.clickRegister();
+ registerPage.register("firstName2", "lastName2", "email2", "setupTotp2", "password2", "password2");
+
+ // Configure totp
+ totpPage.assertCurrent();
+
+ String totpCode = totpPage.getTotpSecret();
+ totpPage.configure(totp.generate(totpCode));
+
+ // After totp config, user should be on the app page
+ Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+
+ // Logout
+ oauth.openLogout();
+
+ // Try to login after logout
+ loginPage.open();
+ loginPage.login("setupTotp2", "password2");
+
+ // Totp is already configured, thus one-time password is needed, login page should be loaded
+ Assert.assertTrue(loginPage.isCurrent());
+ Assert.assertFalse(totpPage.isCurrent());
+
+ // Login with one-time password
+ loginPage.loginTotp("setupTotp2", "password2", totp.generate(totpCode));
+
+ // Open account page
+ accountTotpPage.open();
+ accountTotpPage.assertCurrent();
+
+ // Remove google authentificator
+ accountTotpPage.removeTotp();
+
+ // Logout
+ oauth.openLogout();
+
+ // Try to login
+ loginPage.open();
+ loginPage.login("setupTotp2", "password2");
+
+ // Since the authentificator was removed, it has to be set up again
+ totpPage.assertCurrent();
+ totpPage.configure(totp.generate(totpPage.getTotpSecret()));
+
+ Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+
+ }
}
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/AccountTotpPage.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/AccountTotpPage.java
index 32cfb806899..11cc502362d 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/AccountTotpPage.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/AccountTotpPage.java
@@ -41,6 +41,9 @@ public class AccountTotpPage extends Page {
@FindBy(css = "button[type=\"submit\"]")
private WebElement submitButton;
+ @FindBy(linkText = "Remove Google")
+ private WebElement removeLink;
+
public void configure(String totp) {
totpInput.sendKeys(totp);
submitButton.click();
@@ -51,11 +54,15 @@ public class AccountTotpPage extends Page {
}
public boolean isCurrent() {
- return driver.getPageSource().contains("Google Authenticator Setup");
+ return driver.getTitle().contains("Edit Account - Google Authenticator");
}
public void open() {
driver.navigate().to(PATH);
}
+ public void removeTotp() {
+ removeLink.click();
+ }
+
}
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/LoginPage.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/LoginPage.java
index 1d9c94998d4..d0996907636 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/LoginPage.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/LoginPage.java
@@ -41,6 +41,9 @@ public class LoginPage extends Page {
@FindBy(id = "password")
private WebElement passwordInput;
+ @FindBy(id = "totp")
+ private WebElement totp;
+
@FindBy(css = "input[type=\"submit\"]")
private WebElement submitButton;
@@ -63,6 +66,19 @@ public class LoginPage extends Page {
submitButton.click();
}
+ public void loginTotp(String username, String password, String code) {
+ usernameInput.clear();
+ usernameInput.sendKeys(username);
+
+ passwordInput.clear();
+ passwordInput.sendKeys(password);
+
+ totp.clear();
+ totp.sendKeys(code);
+
+ submitButton.click();
+ }
+
public String getError() {
return loginErrorMessage != null ? loginErrorMessage.getText() : null;
}
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/Page.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/Page.java
index cb56000a99a..d38e2acfc14 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/Page.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/pages/Page.java
@@ -35,7 +35,7 @@ public abstract class Page {
public void assertCurrent() {
String name = getClass().getSimpleName();
- Assert.assertTrue("Exptected " + name + " but was " + driver.getTitle() + " (" + driver.getCurrentUrl() + ")",
+ Assert.assertTrue("Expected " + name + " but was " + driver.getTitle() + " (" + driver.getCurrentUrl() + ")",
isCurrent());
}