Skip to content

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 #51540

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sguilhen wants to merge 4 commits into
base: release/26.6
Choose a base branch
from
Open

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 #51540

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ccac51d
Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563
sguilhen Jul 23, 2026
604cf36
Disable credential delegation test (DIRKRB-458)
sguilhen Jul 24, 2026
47cb8dd
Fix KDC ticket lifetime values for Kerby (seconds, not milliseconds)
sguilhen Jul 24, 2026
a0671d4
Add instrumented StartTLS handler and LDAP server timing logs
sguilhen Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,8 +129,9 @@
<org.snakeyaml.snakeyaml-engine.version>2.6</org.snakeyaml.snakeyaml-engine.version>

<!-- Others -->
<apacheds.version>2.0.0.AM26</apacheds.version>
<apacheds.codec.version>2.0.0</apacheds.codec.version>
<apacheds.version>2.0.0.AM27</apacheds.version>
<apacheds.codec.version>2.1.8</apacheds.codec.version>
<kerby.version>2.1.0</kerby.version>
<google.zxing.version>3.4.0</google.zxing.version>
<freemarker.version>2.3.32</freemarker.version>
<sundrio.version>0.200.0</sundrio.version>
Expand Down Expand Up @@ -700,10 +701,13 @@
<artifactId>apacheds-server-annotations</artifactId>
<version>${apacheds.version}</version>
</dependency>
<!-- POM import to align all API module versions at 2.1.8. -->
<dependency>
<groupId>org.apache.directory.api</groupId>
<artifactId>api-ldap-codec-standalone</artifactId>
<artifactId>api-parent</artifactId>
<version>${apacheds.codec.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>org.apache.jmeter</groupId>
Expand Down
3 changes: 3 additions & 0 deletions ...test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
import org.ietf.jgss.GSSCredential;
import org.jboss.arquillian.graphene.page.Page;
import org.junit.Assume;
import org.junit.Ignore;
import org.junit.Test;

import static org.keycloak.testsuite.admin.ApiUtil.findClientByClientId;
Expand Down Expand Up @@ -174,6 +175,8 @@ public void usernamePasswordLoginTest() throws Exception {
}


@Ignore("Credential delegation not supported: embedded Kerby KDC lacks FORWARDED flag (DIRKRB-458), " +
"and invokeLdap hardcodes localhost — needs rework for external KDCs")
@Test
public void credentialDelegationTest() throws Exception {
Assume.assumeTrue("Ignoring test as the embedded server is not started", getKerberosRule().isStartEmbeddedLdapServer());
Expand Down
6 changes: 5 additions & 1 deletion ...s/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,11 @@ public void beforeAbstractKeycloakTest() throws Exception {

getKerberosRule().setKrb5ConfPath(testingClient.testing());

spnegoSchemeFactory = new KeycloakSPNegoSchemeFactory(getKerberosConfig());
// Kerby KDC doesn't set the FORWARDED flag on TGS-REP (DIRKRB-458), causing
// JDK's KrbKdcRep.check() to reject the response with "Message stream modified (41)".
// Disable credential delegation when using the embedded Kerby KDC; external KDCs (e.g. MSAD) support it.
boolean credDelegEnabled = !getKerberosRule().isStartEmbeddedLdapServer();
spnegoSchemeFactory = new KeycloakSPNegoSchemeFactory(getKerberosConfig(), credDelegEnabled);
initHttpClient(true);
removeAllUsers();

Expand Down
6 changes: 4 additions & 2 deletions ...src/test/java/org/keycloak/testsuite/federation/kerberos/KeycloakSPNegoSchemeFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,14 +43,16 @@
public class KeycloakSPNegoSchemeFactory extends SPNegoSchemeFactory {

private final CommonKerberosConfig kerberosConfig;
private final boolean credDelegEnabled;

private String username;
private String password;


public KeycloakSPNegoSchemeFactory(CommonKerberosConfig kerberosConfig) {
public KeycloakSPNegoSchemeFactory(CommonKerberosConfig kerberosConfig, boolean credDelegEnabled) {
super(true, false);
this.kerberosConfig = kerberosConfig;
this.credDelegEnabled = credDelegEnabled;
}


Expand Down Expand Up @@ -121,7 +123,7 @@ public ByteArrayHolder run() throws Exception {
GSSContext gssContext = manager.createContext(
serverName.canonicalize(oid), oid, null, GSSContext.DEFAULT_LIFETIME);
gssContext.requestMutualAuth(true);
gssContext.requestCredDeleg(true);
gssContext.requestCredDeleg(credDelegEnabled);
byte[] outputToken = gssContext.initSecContext(token, 0, token.length);

ByteArrayHolder result = new ByteArrayHolder();
Expand Down
34 changes: 34 additions & 0 deletions ...ite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos-kc2.ldif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ objectClass: organizationalUnit
objectClass: top
ou: People

# Kerby's LdapIdentityGetHelper requires krb5AccountDisabled, krb5AccountLockedOut,
# krb5AccountExpirationTime, and krb5KDCFlags on each entry — NPEs without them.
dn: uid=krbtgt,ou=People,dc=kc2,dc=com
objectClass: top
objectClass: person
Expand All @@ -21,6 +23,10 @@ uid: krbtgt
userPassword: secret
krb5PrincipalName: krbtgt/KC2.COM@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

# Cross-realm trust support! Realm KEYCLOAK.ORG will trust the realm KC2.COM
dn: uid=krbtgt2,ou=People,dc=kc2,dc=com
Expand All @@ -35,6 +41,10 @@ uid: krbtgt2
userPassword: secret
krb5PrincipalName: krbtgt/KEYCLOAK.ORG@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=ldap,ou=People,dc=kc2,dc=com
objectClass: top
Expand All @@ -48,6 +58,10 @@ uid: ldap
userPassword: randall
krb5PrincipalName: ${ldapSaslPrincipal}
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=HTTP,ou=People,dc=kc2,dc=com
objectClass: top
Expand All @@ -61,6 +75,10 @@ uid: HTTP
userPassword: httppwd
krb5PrincipalName: HTTP/${hostname}@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=hnelson2,ou=People,dc=kc2,dc=com
objectClass: top
Expand All @@ -75,6 +93,10 @@ uid: hnelson2
userPassword: secret
krb5PrincipalName: hnelson2@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=jduke,ou=People,dc=kc2,dc=com
objectClass: top
Expand All @@ -89,6 +111,10 @@ uid: jduke
userPassword: theduke
krb5PrincipalName: jdukekeycloak@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=jduke2,ou=People,dc=kc2,dc=com
objectClass: top
Expand All @@ -103,6 +129,10 @@ uid: jduke2
userPassword: theduke2
krb5PrincipalName: jduke@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=gsstestserver,ou=People,dc=kc2,dc=com
objectClass: top
Expand All @@ -116,3 +146,7 @@ uid: gsstestserver
userPassword: gsstestpwd
krb5PrincipalName: gsstestserver/xxx@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126
34 changes: 34 additions & 0 deletions testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos.ldif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ objectClass: organizationalUnit
objectClass: top
ou: People

# Kerby's LdapIdentityGetHelper requires krb5AccountDisabled, krb5AccountLockedOut,
# krb5AccountExpirationTime, and krb5KDCFlags on each entry — NPEs without them.
dn: uid=krbtgt,ou=People,dc=keycloak,dc=org
objectClass: top
objectClass: person
Expand All @@ -21,6 +23,10 @@ uid: krbtgt
userPassword: secret
krb5PrincipalName: krbtgt/KEYCLOAK.ORG@KEYCLOAK.ORG
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

# Cross-realm trust support! Realm KEYCLOAK.ORG will trust the realm KC2.COM
dn: uid=krbtgt2,ou=People,dc=keycloak,dc=org
Expand All @@ -35,6 +41,10 @@ uid: krbtgt2
userPassword: secret
krb5PrincipalName: krbtgt/KEYCLOAK.ORG@KC2.COM
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=ldap,ou=People,dc=keycloak,dc=org
objectClass: top
Expand All @@ -48,6 +58,10 @@ uid: ldap
userPassword: randall
krb5PrincipalName: ${ldapSaslPrincipal}
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=HTTP,ou=People,dc=keycloak,dc=org
objectClass: top
Expand All @@ -61,6 +75,10 @@ uid: HTTP
userPassword: httppwd
krb5PrincipalName: HTTP/${hostname}@KEYCLOAK.ORG
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=hnelson,ou=People,dc=keycloak,dc=org
objectClass: top
Expand All @@ -75,6 +93,10 @@ uid: hnelson
userPassword: secret
krb5PrincipalName: hnelson@KEYCLOAK.ORG
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=jduke,ou=People,dc=keycloak,dc=org
objectClass: top
Expand All @@ -89,6 +111,10 @@ uid: jduke
userPassword: theduke
krb5PrincipalName: jduke@KEYCLOAK.ORG
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=MyDuke,ou=People,dc=keycloak,dc=org
objectClass: top
Expand All @@ -103,6 +129,10 @@ uid: MyDuke
userPassword: theduke
krb5PrincipalName: MyDuke@KEYCLOAK.ORG
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126

dn: uid=gsstestserver,ou=People,dc=keycloak,dc=org
objectClass: top
Expand All @@ -116,3 +146,7 @@ uid: gsstestserver
userPassword: gsstestpwd
krb5PrincipalName: gsstestserver/xxx@KEYCLOAK.ORG
krb5KeyVersionNumber: 0
krb5AccountDisabled: FALSE
krb5AccountLockedOut: FALSE
krb5AccountExpirationTime: 99991231235959Z
krb5KDCFlags: 126
12 changes: 11 additions & 1 deletion testsuite/utils/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,11 +228,21 @@
<scope>compile</scope>
</dependency>

<!-- Apache DS -->
<!-- Apache DS for embedded LDAP, Apache Kerby for KDC (AM27 removed apacheds-protocol-kerberos) -->
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-util-embedded-ldap</artifactId>
</dependency>
<dependency>
<groupId>org.apache.kerby</groupId>
<artifactId>kerb-simplekdc</artifactId>
<version>${kerby.version}</version>
</dependency>
<dependency>
<groupId>org.apache.kerby</groupId>
<artifactId>ldap-backend</artifactId>
<version>${kerby.version}</version>
</dependency>

<dependency>
<groupId>${ee.maven.groupId}</groupId>
Expand Down
Loading
Loading