Skip to content

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51124

Open
sguilhen wants to merge 4 commits into
keycloak:mainfrom
sguilhen:50785-apacheds-am27-upgrade
Open

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51124
sguilhen wants to merge 4 commits into
keycloak:mainfrom
sguilhen:50785-apacheds-am27-upgrade

Conversation

@sguilhen

@sguilhen sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Closes #50785

@sguilhen
sguilhen requested review from a team as code owners July 23, 2026 19:35
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 53419f2 to f0f0bf3 Compare July 23, 2026 19:55
@sguilhen

sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Notes about the changes needed to bump Apache DS to 2.0.0.AM27:

  • bumped apacheds.version to 2.0.0.AM27 and apacheds.codec.version to 2.1.8
  • added Apache Kerby dependencies where necessary (kerb-simplekdc, kerb-client). AM27 removed apacheds-protocol-kerberos; KDC is now provided by Kerby.
  • rewrote embedded KDC from ApacheDS KdcServer to Kerby KdcServer.
  • rewrote KerberosKeytabCreator, moving from ApacheDS KerberosKeyFactory to Kerby EncryptionHandler. The old API was removed in AM27. Explicit enc type list matches what KeyDerivationInterceptor derives.
  • disabled requestCredDeleg (credential delegation) in KeycloakSPNegoSchemeFactory. Kerby KDC doesn't echo the FORWARDED flag in TGS-REP, causing JDK's KrbKdcRep.check() to reject with error 41. (DIRKRB-458).
  • skipped AbsctractKerberosSingleRealmTest.credentialDelegationTestwithAssume.assumeTruebecause Kerby doesn't support theFORWARDED` ticket flag.

Aside from that, there's a minor architectural change between the versions: in AM26, the ApacheDS KDC accessed the DirectoryService in-process (via kdcServer.setDirectoryService()). In AM27 (Kerby), this is no longer possible, and the KDC connects to LDAP over the network via LdapIdentityBackend.

@sguilhen

sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Also worth mentioning: I've had to add krb5AccountDisabled, krb5AccountLockedOut, krb5AccountExpirationTime, and krb5KDCFlags attributes to all krb5kdcentry entries in the kerberos test LDIF files. Kerby's LdapIdentityGetHelper NPEs without them as it calls .getString() on nullable LDAP attributes with no null check.

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 23, 2026
Closed
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 23, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 23, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for value to contain (ignoring case) "sign in to". Current value: "AUTH_RESPONSE" (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

@sguilhen
sguilhen requested review from Copilot and mposolda July 24, 2026 13:14
Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Upgrades ApacheDS and LDAP API dependencies to address CVE-2026-35563 while migrating embedded Kerberos support to Apache Kerby.

Changes:

  • Upgrades ApacheDS to AM27 and LDAP API to 2.1.8.
  • Replaces removed ApacheDS KDC/keytab APIs with Kerby.
  • Updates Kerberos fixtures and delegation behavior.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
pom.xml Updates and aligns ApacheDS/LDAP API versions.
util/embedded-ldap/pom.xml Adds Kerby dependencies.
util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java Migrates keytab generation to Kerby.
util/embedded-ldap/src/main/resources/kerberos/default-users.ldif Adds Kerby-required account attributes.
util/embedded-ldap/src/main/resources/kerberos/default-users-kc2.ldif Adds attributes for the secondary realm.
testsuite/utils/pom.xml Adds Kerby test utilities.
testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java Replaces ApacheDS KDC with Kerby LDAP-backed KDC.
testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos.ldif Updates primary-realm test identities.
testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos-kc2.ldif Updates secondary-realm test identities.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KeycloakSPNegoSchemeFactory.java Makes credential delegation configurable.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java Disables delegation for embedded Kerby.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java Changes delegation-test eligibility.

Comment thread testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java Outdated
Comment thread ...rc/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java
Comment on lines +180 to +181
Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
!getKerberosRule().isStartEmbeddedLdapServer());

@sguilhen sguilhen Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True observation but this condition is pre-existing. The invokeLdap method was never designed for external providers. When the internal MSAD pipeline runs the credential delegation test, it would need the LDAP URL/DN adapted. But this isn't something we introduced, it was already the case before our change.

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 24, 2026
Open
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

Copilot AI review requested due to automatic review settings July 24, 2026 21:22
Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java:181

  • This now skips credentialDelegationTest under every checked-in Kerberos configuration: the connection files either set idm.test.ldap.start.embedded.ldap.server=true or rely on its true default. Credential delegation therefore loses all automated coverage; please add a runnable external-KDC configuration/job (or another fixture) instead of leaving this test permanently skipped.
        Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
                !getKerberosRule().isStartEmbeddedLdapServer());

Copilot AI review requested due to automatic review settings July 24, 2026 22:10
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from f207204 to 82cfd60 Compare July 24, 2026 22:10
@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 24, 2026
Open
@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java
Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/LDAPEmbeddedServer.java Outdated
Copilot AI review requested due to automatic review settings July 24, 2026 22:21
github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 24, 2026
View reviewed changes
Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/LDAPEmbeddedServer.java Fixed
Copilot AI review requested due to automatic review settings July 24, 2026 23:14
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 5e8ea7d to c1cd6b9 Compare July 24, 2026 23:14
@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

  • EncryptionHandler.string2Key initializes EncryptionKey with kvno -1, so passing key.getKvno() makes Kerby's keytab writer serialize version 255. The previous implementation produced kvno 0 (the wildcard version); keep that value explicitly so generated keytabs can match the versioned tickets issued by the LDAP-backed KDC.
                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 25, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 25, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Copilot AI review requested due to automatic review settings July 25, 2026 03:55
Copilot AI reviewed Jul 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

  • EncryptionHandler.string2Key creates keys with Kerby's default kvno of -1, so this writes keytab entries with kvno 255 instead of the previous generator's kvno 0. That no longer matches the LDAP principals' krb5KeyVersionNumber: 0; preserve kvno 0 when constructing each entry.
                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

Comment thread testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 25, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 25, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - FIPS IT (strict)

jakarta.ws.rs.BadRequestException: HTTP 400 Bad Request
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus(ClientInvocation.java:236)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:216)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:59)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:146)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.IllegalStateException: User search expected one result. Found 0 users.
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.findUser(AbstractTestRealmKeycloakTest.java:57)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:148)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.runLDAPLoginTest(LDAPUserLoginTest.java:190)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.loginLDAPUserAuthenticationSimpleEncryptionStartTLS(LDAPUserLoginTest.java:256)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.IllegalStateException: User search expected one result. Found 0 users.
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.findUser(AbstractTestRealmKeycloakTest.java:57)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:148)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.runLDAPLoginTest(LDAPUserLoginTest.java:190)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS(LDAPUserLoginTest.java:319)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenTimeIsValid

Keycloak CI - Adapter IT Strict Cookies

org.jboss.arquillian.graphene.enricher.exception.PageObjectInitializationException: 
Can not instantiate Page Object 
class org.keycloak.testsuite.adapter.page.SalesPostClockSkewServlet
 declared in: 
org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employee2Test

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperUserGroupsAggregate

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperGroupsNoAggregate

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#singleLoginAndLogoutSAMLTest

Keycloak CI - Adapter IT Strict Cookies

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for wrapped: text ('principal=bburke') to be present in text in element found by By.xpath: //body (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: org.openqa.selenium.firefox.FirefoxDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostTestCompositeRoleForUser

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostEmptyConsumerPostURL

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperGroupsAggregate

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testReloginWithInvalidAuthSessionCookie

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostTest

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testUserAttributeStatementMapperUserGroupsNoAggregate

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostSigTest

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#disabledClientTest

Keycloak CI - Adapter IT Strict Cookies

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for wrapped: text ('Login requester not enabled') to be present in text in element found by By.xpath: //body (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: org.openqa.selenium.firefox.FirefoxDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testMultipleTabsParallelLogin

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: Expected page 'login-login' to be loaded, but currently on page 'null' after timeout
	at org.junit.jupiter.api.AssertionUtils.fail(AssertionUtils.java:38)
	at org.junit.jupiter.api.Assertions.fail(Assertions.java:138)
	at org.keycloak.testsuite.pages.AbstractPage.waitForPage(AbstractPage.java:62)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:47)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 17)

java.lang.IllegalStateException: User search expected one result. Found 0 users.
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.findUser(AbstractTestRealmKeycloakTest.java:57)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:148)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.runLDAPLoginTest(LDAPUserLoginTest.java:190)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS(LDAPUserLoginTest.java:319)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

jakarta.ws.rs.BadRequestException: HTTP 400 Bad Request
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus(ClientInvocation.java:236)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:216)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:59)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:146)
...

Report flaky test

Copilot AI review requested due to automatic review settings July 25, 2026 20:50
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 6f9dd67 to 44b66f8 Compare July 25, 2026 20:50
Copilot AI reviewed Jul 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

  • EncryptionHandler.string2Key creates keys with kvno -1; KeytabEntry writes that value into the one-byte keytab field as 255. This differs from the previous creator's kvno 0 and can make generated keytabs fail with implementations that enforce the ticket key version, so preserve the unspecified/wildcard kvno explicitly.
                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/StartTlsHandlerFix.java Outdated
@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 25, 2026
Open
Copilot AI review requested due to automatic review settings July 25, 2026 22:16
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 44b66f8 to 31e342a Compare July 25, 2026 22:16
Copilot AI reviewed Jul 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

  • EncryptionHandler.string2Key returns a Kerby EncryptionKey with the sentinel KVNO -1; passing that to KeytabEntry writes it as byte 255. The previous password-derived KerberosKey used KVNO 0, so generated keytabs can now advertise the wrong key version and fail selection when a ticket carries KVNO 0; write version 0 explicitly.
                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java:146

  • If Kerby initialization or socket binding fails after super.start(), JUnit's ExternalResource.before() exits before after() runs, leaving the LDAP server and its port active for subsequent tests. Roll back any partially initialized KDC and the LDAP server in a catch block before rethrowing the startup failure.
        super.start();

        log.info("Creating KDC server. kerberosRealm: " + kerberosRealm + ", kdcPort: " + kdcPort + ", kdcEncryptionTypes: " + kdcEncryptionTypes);
        createAndStartKdcServer();

sguilhen added 4 commits July 25, 2026 20:23
@sguilhen
Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563
3ce6acd 
Closes keycloak#50785

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
Enable credential delegation test against external KDCs
c2101d2 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
Fix KDC ticket lifetime values for Kerby (seconds, not milliseconds)
31df497 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
Add instrumented StartTLS handler and LDAP server timing logs
993cba1 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 31e342a to 993cba1 Compare July 25, 2026 23:25
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 26, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 26, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@mposolda mposolda Awaiting requested review from mposolda
+2 more reviewers
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

flaky-test team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname

3 participants

@sguilhen @github-advanced-security