Skip to content

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 - #51539

Open
sguilhen wants to merge 4 commits into
keycloak:release/26.7from
sguilhen:backport-51124-26.7
Open

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51539
sguilhen wants to merge 4 commits into
keycloak:release/26.7from
sguilhen:backport-51124-26.7

Conversation

@sguilhen

@sguilhen sguilhen commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Closes #50785

sguilhen added 4 commits August 7, 2026 10:19
@sguilhen
Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563
f57ff73 
Closes keycloak#50785

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
(cherry picked from commit 531a84b)
@sguilhen
Disable credential delegation test (DIRKRB-458)
c8024f0 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
(cherry picked from commit 04563ad)
@sguilhen
Fix KDC ticket lifetime values for Kerby (seconds, not milliseconds)
8a4de43 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
(cherry picked from commit 1b0a0a5)
@sguilhen
Add instrumented StartTLS handler and LDAP server timing logs
e694b24 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
(cherry picked from commit 1c22632)
@sguilhen
sguilhen requested review from a team as code owners August 7, 2026 13:21
@sguilhen sguilhen changed the title Backport 51124 26.7 LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname Aug 7, 2026
@sguilhen sguilhen changed the title LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 Aug 7, 2026
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Aug 7, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Aug 7, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested

Keycloak CI - Base IT (6)

java.lang.NullPointerException: Cannot read field "features" because the return value of "org.keycloak.common.Profile.getInstance()" is null
	at org.keycloak.common.Profile.isFeatureEnabled(Profile.java:532)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.<init>(OIDCClientSecretConfigWrapper.java:41)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.fromClientRepresentation(OIDCClientSecretConfigWrapper.java:49)
	at org.keycloak.testsuite.oauth.ClientAuthPostMethodTest.testPostAuthenticationNotAllowedWhenBasicRequested(ClientAuthPostMethodTest.java:141)
...

Report flaky test

org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested

Keycloak CI - Base IT (6)

java.lang.NullPointerException: Cannot read field "features" because the return value of "org.keycloak.common.Profile.getInstance()" is null
	at org.keycloak.common.Profile.isFeatureEnabled(Profile.java:532)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.<init>(OIDCClientSecretConfigWrapper.java:41)
	at org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper.fromClientRepresentation(OIDCClientSecretConfigWrapper.java:49)
	at org.keycloak.testsuite.oauth.ClientAuthPostMethodTest.testBasicAuthenticationNotAllowedWhenPostRequested(ClientAuthPostMethodTest.java:112)
...

Report flaky test

org.keycloak.testsuite.cluster.ClientScopeInvalidationClusterTest#crudWithoutFailover

Keycloak CI - Clustering IT

org.opentest4j.AssertionFailedError: expected: <false> but was: <true>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertFalse.failNotFalse(AssertFalse.java:63)
	at org.junit.jupiter.api.AssertFalse.assertFalse(AssertFalse.java:36)
...

Report flaky test

org.keycloak.testsuite.cluster.ClientScopeInvalidationClusterTest#crudWithFailover

Keycloak CI - Clustering IT

jakarta.ws.rs.WebApplicationException: Create method returned status Forbidden (Code: 403); expected status: Created (201). Response body: {"error":"HTTP 403 Forbidden"}
	at org.keycloak.testsuite.admin.ApiUtil.getCreatedId(ApiUtil.java:38)
	at org.keycloak.testsuite.cluster.ClientScopeInvalidationClusterTest.createEntity(ClientScopeInvalidationClusterTest.java:56)
	at org.keycloak.testsuite.cluster.ClientScopeInvalidationClusterTest.createEntity(ClientScopeInvalidationClusterTest.java:32)
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.createEntityOnCurrentFailNode(AbstractInvalidationClusterTest.java:111)
...

Report flaky test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

flaky-test team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sguilhen