Skip to content

Disallow protocol change via Registration Access Token #51419

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rmartinc merged 2 commits into from
Aug 7, 2026
+64 −0
Merged

Disallow protocol change via Registration Access Token #51419

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
549a3f7
Closes #51340, Disallow protocol switch using Registration access token
msdaly200 Jul 31, 2026
a8a35de
Closes #51340, added check to prevent protocol switch using RAT in DCR
msdaly200 Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions ...ain/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,18 @@ public ClientRepresentation update(String clientId, ClientRegistrationContext co
throw new ErrorResponseException(ErrorCodes.INVALID_CLIENT_METADATA, "Client Identifier modified", Response.Status.BAD_REQUEST);
}

if (auth.isRegistrationAccessToken()) {
String existingProtocol = client.getProtocol();
String requestedProtocol = rep.getProtocol();
if (requestedProtocol != null && !requestedProtocol.equals(existingProtocol)) {
throw new ErrorResponseException(
ErrorCodes.INVALID_CLIENT_METADATA,
"Protocol cannot be changed via registration access token",
Response.Status.BAD_REQUEST
);
}
}

ClientResource.updateClientServiceAccount(session, client, rep.isServiceAccountsEnabled());
RepresentationToModel.updateClient(rep, client, session);
RepresentationToModel.updateClientProtocolMappers(rep, client);
Expand Down
52 changes: 52 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/client/ClientRegistrationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,58 @@ public void testUpdateAuthorizationSettings() throws ClientRegistrationException
assertFalse(authzSettings.getPolicies().isEmpty());
}

//#51340
@Test
public void updateProtocolViaRegistrationTokenShouldBeRejected() throws ClientRegistrationException {
// Register an OIDC client using manage-clients bearer token; capture the RAT.
authManageClients();
ClientRepresentation created = registerClient(buildClient(), true);
assertEquals("openid-connect", created.getProtocol());
reg.auth(Auth.token(created.getRegistrationAccessToken()));

// Attempt to change protocol to saml (should be rejected with 400)
ClientRepresentation update = new ClientRepresentation();
update.setClientId(created.getClientId());
update.setProtocol(SamlProtocol.LOGIN_PROTOCOL);

try {
reg.update(update);
fail("Expected ClientRegistrationException — protocol change via RAT must be rejected");
} catch (ClientRegistrationException e) {
Comment thread
msdaly200 marked this conversation as resolved.
HttpErrorException cause = (HttpErrorException) e.getCause();
assertThat(cause.getStatusLine().getStatusCode(), is(400));

OAuth2ErrorRepresentation errorRep;
try {
errorRep = JsonSerialization.readValue(cause.getErrorResponse(), OAuth2ErrorRepresentation.class);
} catch (IOException ex) {
throw new RuntimeException(ex);
}
assertThat(errorRep.getError(), is(INVALID_CLIENT_METADATA));
assertThat(errorRep.getErrorDescription(), CoreMatchers.containsString("Protocol cannot be changed"));
}

// Verify the protocol is still openid-connect
reg.auth(Auth.token(created.getRegistrationAccessToken()));
ClientRepresentation afterAttempt = reg.get(created.getClientId());
assertThat(afterAttempt.getProtocol(), is("openid-connect"));
}

@Test
public void updateProtocolViaAdminTokenShouldSucceed() throws ClientRegistrationException {
authManageClients();
ClientRepresentation created = registerClient(buildClient(), true);
assertEquals("openid-connect", created.getProtocol());

// Re-auth as manage-clients admin, not via RAT.
authManageClients();
ClientRepresentation update = reg.get(created.getClientId());
update.setProtocol(SamlProtocol.LOGIN_PROTOCOL);

ClientRepresentation updated = reg.update(update);
assertThat(updated.getProtocol(), is(SamlProtocol.LOGIN_PROTOCOL));
}

private void testClientUriValidation(String expectedRootUrlError, String expectedBaseUrlError, String expectedBackchannelLogoutUrlError, String expectedRedirectUrisError, String... testUrls) {
testClientUriValidation(true, expectedRootUrlError, expectedBaseUrlError, expectedBackchannelLogoutUrlError, expectedRedirectUrisError, testUrls);
testClientUriValidation(false, expectedRootUrlError, expectedBaseUrlError, expectedBackchannelLogoutUrlError, expectedRedirectUrisError, testUrls);
Expand Down
Loading