Expose device info in Admin API UserSessionRepresentation - #51517
Expose device info in Admin API UserSessionRepresentation#51517markstos wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Exposes session device metadata through Admin API representations.
Changes:
- Adds OS, browser, device, and mobile fields.
- Maps stored device notes into session responses.
- Updates TypeScript definitions, documentation, and tests.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
core/.../UserSessionRepresentation.java |
Adds device fields and accessors. |
server-spi-private/.../ModelToRepresentation.java |
Maps attached device metadata. |
js/.../userSessionRepresentation.ts |
Updates TypeScript API types. |
docs/.../admin-rest-api.adoc |
Documents response fields. |
tests/.../SessionTest.java |
Adds device-field assertions. |
Closes keycloak#47980 Signed-off-by: Mark Stosberg <mstosberg@thunderbird.net>
c237e15 to
e4c3c5b
Compare
|
Copilot feedback has been addressed with amended commit. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (2)
tests/base/src/test/java/org/keycloak/tests/admin/client/SessionTest.java:135
- These non-null checks would still pass if the new fields were mapped incorrectly (for example, if OS and device were swapped) or reduced to placeholder values. Assert the known parser output for this fixed user agent so the test verifies each API field's value.
assertNotNull(rep.getOs());
assertNotNull(rep.getOsVersion());
assertNotNull(rep.getBrowser());
assertNotNull(rep.getDevice());
tests/base/src/test/java/org/keycloak/tests/admin/client/SessionTest.java:117
- The new assertions exercise the client-scoped
/clients/{id}/user-sessionsAPI, not the/users/{user-id}/sessionsendpoint this change documents and targets. Keep the existing client-session coverage, but retrieveuser.admin().getUserSessions()and apply the device assertions to that response as well.
List<UserSessionRepresentation> sessions = account.getUserSessions(0, 5);
|
See my comment #47980 (comment) - this might not be the API you are looking for / should be looking for if you want to use it for the same reasons as the original author of the issue. Can you please confirm your use case? Given that it was rejected by @pedroigor in #6127 in 2017, let me double-check: A lot of time has passed, and it hasn't been added. Do we want to be pragmatic to add it now? Either as properties (as suggested here), or as a nested class with the device info (preferred). In addition to this, there would more items to fix: Recent browsers don't send all the high-entropy data by default any more. The new "Sec-UA" headers sent by Chrome are still experimental and Keycloak does not support them (until someone adds support for it). When adding device info to the responses, it, it might be good to add it to |
|
@ahus1 Thanks for the reply.
The end goal is to build a "Connected Apps" interface which lists details like app name and IP of client which use You are right call out that a user self-service API is a more secure design than using the admin API. We may have landed on looking a the Admin API because it's the only one documented under "API documentation" on the Keycloak website: https://www.keycloak.org/documentation By exploring the codebase some more, I've found |
Expose device info (OS, browser, device) in Admin API UserSessionRepresentation,
addressing #47980.
This is also a feature we'd like downstream in the Mozilla Thundermail project.
In addition the automated test coverage added, additional manual testing was performed, as below in the QA Log.
This PR was generated with GenAI and includes test coverage and docs.
Thanks!
QA Log
Manual testeing result: