From 33d9dd017505aa2cf628c7d468f3cc4731583f16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20Vav=C5=99=C3=ADk?= Date: Thu, 30 Jul 2026 00:45:00 +0200 Subject: [PATCH] fix(services): remove db user and url from server info MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit closes: https://github.com/keycloak/keycloak/issues/51139 Signed-off-by: Michal Vavřík --- .../DefaultJpaConnectionProviderFactory.java | 2 -- .../QuarkusJpaConnectionProviderFactory.java | 2 -- .../admin/ServerInfoPermissionsTest.java | 22 +++++++++++++++++++ 3 files changed, 22 insertions(+), 4 deletions(-) diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java index 5cf09aa60d12..57d86c7d39a8 100755 --- a/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java +++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java @@ -280,8 +280,6 @@ protected void prepareOperationalInfo(Connection connection) { try { operationalInfo = new LinkedHashMap<>(); DatabaseMetaData md = connection.getMetaData(); - operationalInfo.put("databaseUrl", md.getURL()); - operationalInfo.put("databaseUser", md.getUserName()); operationalInfo.put("databaseProduct", md.getDatabaseProductName() + " " + md.getDatabaseProductVersion()); operationalInfo.put("databaseDriver", md.getDriverName() + " " + md.getDriverVersion()); diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/QuarkusJpaConnectionProviderFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/QuarkusJpaConnectionProviderFactory.java index 517b52deee4f..0269985c75da 100644 --- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/QuarkusJpaConnectionProviderFactory.java +++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/QuarkusJpaConnectionProviderFactory.java @@ -251,8 +251,6 @@ private void createOperationalInfo(Connection connection) { try { operationalInfo = new LinkedHashMap<>(); DatabaseMetaData md = connection.getMetaData(); - operationalInfo.put("databaseUrl", md.getURL()); - operationalInfo.put("databaseUser", md.getUserName()); operationalInfo.put("databaseProduct", md.getDatabaseProductName() + " " + md.getDatabaseProductVersion()); operationalInfo.put("databaseDriver", md.getDriverName() + " " + md.getDriverVersion()); operationalInfo.put("migrationTimeout", getMigrationTransactionTimeout() + " seconds"); diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/ServerInfoPermissionsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/ServerInfoPermissionsTest.java index 968cdea433bd..15f4d70124f0 100644 --- a/tests/base/src/test/java/org/keycloak/tests/admin/ServerInfoPermissionsTest.java +++ b/tests/base/src/test/java/org/keycloak/tests/admin/ServerInfoPermissionsTest.java @@ -18,10 +18,13 @@ +import java.util.Objects; + import jakarta.ws.rs.ForbiddenException; import org.keycloak.models.AdminRoles; import org.keycloak.representations.info.ServerInfoRepresentation; +import org.keycloak.representations.info.SpiInfoRepresentation; import org.keycloak.testframework.annotations.InjectRealm; import org.keycloak.testframework.annotations.KeycloakIntegrationTest; import org.keycloak.testframework.realm.ManagedRealm; @@ -85,6 +88,25 @@ public void testServerInfo() throws Exception { Assert.assertNull(serverInfo.getSystemInfo().getServerTime()); Assert.assertNull(serverInfo.getCpuInfo()); Assert.assertNull(serverInfo.getMemoryInfo()); + + // databaseUrl and databaseUser are never exposed in server info + assertDatabaseConnectionInfoNotExposed(clients.get("master-admin").serverInfo().getInfo()); + assertDatabaseConnectionInfoNotExposed(clients.get("master-admin-" + AdminRoles.MANAGE_REALM).serverInfo().getInfo()); + } + + private void assertDatabaseConnectionInfoNotExposed(ServerInfoRepresentation serverInfo) { + SpiInfoRepresentation jpa = serverInfo.getProviders().get("connectionsJpa"); + Assert.assertNotNull("connectionsJpa SPI should be present", jpa); + boolean foundDatabaseUrl = jpa.getProviders().values().stream() + .map(p -> p.getOperationalInfo()) + .filter(Objects::nonNull) + .anyMatch(info -> info.containsKey("databaseUrl")); + Assert.assertFalse("connectionsJpa operationalInfo should not contain databaseUrl", foundDatabaseUrl); + boolean foundDatabaseUser = jpa.getProviders().values().stream() + .map(p -> p.getOperationalInfo()) + .filter(Objects::nonNull) + .anyMatch(info -> info.containsKey("databaseUser")); + Assert.assertFalse("connectionsJpa operationalInfo should not contain databaseUser", foundDatabaseUser); } protected static class PermissionsTestRealm extends PermissionsTestRealmConfig1 {