Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 by sguilhen · Pull Request #51124 · keycloak/keycloak

sguilhen · 2026-07-23T19:35:51Z

sguilhen · 2026-07-23T19:56:40Z

Notes about the changes needed to bump Apache DS to 2.0.0.AM27:

bumped apacheds.version to 2.0.0.AM27 and apacheds.codec.version to 2.1.8
added Apache Kerby dependencies where necessary (kerb-simplekdc, kerb-client). AM27 removed apacheds-protocol-kerberos; KDC is now provided by Kerby.
rewrote embedded KDC from ApacheDS KdcServer to Kerby KdcServer.
rewrote KerberosKeytabCreator, moving from ApacheDS KerberosKeyFactory to Kerby EncryptionHandler. The old API was removed in AM27. Explicit enc type list matches what KeyDerivationInterceptor derives.
disabled requestCredDeleg (credential delegation) in KeycloakSPNegoSchemeFactory. Kerby KDC doesn't echo the FORWARDED flag in TGS-REP, causing JDK's KrbKdcRep.check() to reject with error 41. (DIRKRB-458).
skipped AbsctractKerberosSingleRealmTest.credentialDelegationTestwithAssume.assumeTruebecause Kerby doesn't support theFORWARDED` ticket flag.

Aside from that, there's a minor architectural change between the versions: in AM26, the ApacheDS KDC accessed the DirectoryService in-process (via kdcServer.setDirectoryService()). In AM27 (Kerby), this is no longer possible, and the KDC connects to LDAP over the network via LdapIdentityBackend.

sguilhen · 2026-07-23T20:08:36Z

Also worth mentioning: I've had to add krb5AccountDisabled, krb5AccountLockedOut, krb5AccountExpirationTime, and krb5KDCFlags attributes to all krb5kdcentry entries in the kerberos test LDIF files. Kerby's LdapIdentityGetHelper NPEs without them as it calls .getString() on nullable LDAP attributes with no null check.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-23T21:11:12Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for value to contain (ignoring case) "sign in to". Current value: "AUTH_RESPONSE" (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Copilot

Pull request overview

Upgrades ApacheDS and LDAP API dependencies to address CVE-2026-35563 while migrating embedded Kerberos support to Apache Kerby.

Changes:

Upgrades ApacheDS to AM27 and LDAP API to 2.1.8.
Replaces removed ApacheDS KDC/keytab APIs with Kerby.
Updates Kerberos fixtures and delegation behavior.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`pom.xml`	Updates and aligns ApacheDS/LDAP API versions.
`util/embedded-ldap/pom.xml`	Adds Kerby dependencies.
`util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java`	Migrates keytab generation to Kerby.
`util/embedded-ldap/src/main/resources/kerberos/default-users.ldif`	Adds Kerby-required account attributes.
`util/embedded-ldap/src/main/resources/kerberos/default-users-kc2.ldif`	Adds attributes for the secondary realm.
`testsuite/utils/pom.xml`	Adds Kerby test utilities.
`testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java`	Replaces ApacheDS KDC with Kerby LDAP-backed KDC.
`testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos.ldif`	Updates primary-realm test identities.
`testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos-kc2.ldif`	Updates secondary-realm test identities.
`testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KeycloakSPNegoSchemeFactory.java`	Makes credential delegation configurable.
`testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java`	Disables delegation for embedded Kerby.
`testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java`	Changes delegation-test eligibility.

sguilhen · 2026-07-24T21:25:00Z

+        Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
+                !getKerberosRule().isStartEmbeddedLdapServer());


True observation but this condition is pre-existing. The invokeLdap method was never designed for external providers. When the internal MSAD pipeline runs the credential delegation test, it would need the LDAP URL/DN adapted. But this isn't something we introduced, it was already the case before our change.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-24T20:19:38Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java:181

This now skips credentialDelegationTest under every checked-in Kerberos configuration: the connection files either set idm.test.ldap.start.embedded.ldap.server=true or rely on its true default. Credential delegation therefore loses all automated coverage; please add a runnable external-KDC configuration/job (or another fixture) instead of leaving this test permanently skipped.

        Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
                !getKerberosRule().isStartEmbeddedLdapServer());

keycloak-github-bot · 2026-07-24T22:11:34Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

EncryptionHandler.string2Key leaves Kerby's key version at -1, so this writes 255 into the keytab's one-byte KVNO field instead of the previous generator's KVNO 0. That value will not act as the wildcard KVNO when the embedded KDC issues tickets with KVNO 1; write 0 explicitly to keep generated keytabs usable.

                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java:147

If Kerby initialization or socket binding fails after super.start(), JUnit's ExternalResource does not invoke after() when before() throws, leaving the LDAP server and directory service running and their ports occupied. Wrap KDC startup in rollback logic that stops any partially initialized KDC and calls super.stop() before rethrowing.

        super.start();

        log.info("Creating KDC server. kerberosRealm: " + kerberosRealm + ", kdcPort: " + kdcPort + ", kdcEncryptionTypes: " + kdcEncryptionTypes);
        createAndStartKdcServer();

mposolda

@sguilhen Thanks, it is not ideal that we do not test with credential delegation (and maybe we don't even have a way to test manually with that), but approving to move forward with this PR. I don't recall any issues with credential delegation in the past, so hopefully it is OK to keep it like this.

Would be probably good to have review from QA team as well to avoid some potential issues in the pipeline (however I think it should work just fine).

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Closes keycloak#50785 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

keycloak-github-bot · 2026-07-30T22:23:23Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: Expected error event ==> expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

sguilhen requested review from a team as code owners July 23, 2026 19:35

keycloak-github-bot Bot added the team/core-iam label Jul 23, 2026

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 53419f2 to f0f0bf3 Compare July 23, 2026 19:55

keycloak-github-bot Bot added the flaky-test label Jul 23, 2026

keycloak-github-bot Bot mentioned this pull request Jul 23, 2026

Flaky test: org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess #51064

Closed

keycloak-github-bot Bot reviewed Jul 23, 2026

View reviewed changes

sguilhen requested review from Copilot and mposolda July 24, 2026 13:14

Copilot started reviewing on behalf of sguilhen July 24, 2026 19:17 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

keycloak-github-bot Bot mentioned this pull request Jul 24, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1 #51075

Closed

keycloak-github-bot Bot reviewed Jul 24, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 24, 2026 21:22

Copilot started reviewing on behalf of sguilhen July 24, 2026 21:22 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 24, 2026 22:10

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from f207204 to 82cfd60 Compare July 24, 2026 22:10

Copilot started reviewing on behalf of sguilhen July 24, 2026 22:11 View session

keycloak-github-bot Bot mentioned this pull request Jul 24, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#testEmptyBaseUrl #51101

Closed

keycloak-github-bot Bot reviewed Jul 24, 2026

View reviewed changes

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java

Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/LDAPEmbeddedServer.java Outdated

Copilot AI review requested due to automatic review settings July 24, 2026 22:21

Copilot AI review requested due to automatic review settings July 27, 2026 20:32

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 122e8a4 to bea1556 Compare July 27, 2026 20:32

Copilot started reviewing on behalf of sguilhen July 27, 2026 20:33 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

mposolda previously approved these changes Jul 28, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 29, 2026 20:39

sguilhen dismissed mposolda’s stale review via d6a2878 July 29, 2026 20:39

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from bea1556 to d6a2878 Compare July 29, 2026 20:39

Copilot started reviewing on behalf of sguilhen July 29, 2026 20:40 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from d6a2878 to 0968d3b Compare July 29, 2026 20:52

Copilot AI review requested due to automatic review settings July 29, 2026 22:02

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 0968d3b to 304b96b Compare July 29, 2026 22:02

Copilot started reviewing on behalf of sguilhen July 29, 2026 22:03 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

sguilhen added 4 commits July 30, 2026 18:19

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563

f12874e

Closes keycloak#50785 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Disable credential delegation test (DIRKRB-458)

d4b55db

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Fix KDC ticket lifetime values for Kerby (seconds, not milliseconds)

77dde61

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Add instrumented StartTLS handler and LDAP server timing logs

ca13773

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Copilot AI review requested due to automatic review settings July 30, 2026 21:19

sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 304b96b to ca13773 Compare July 30, 2026 21:19

Copilot started reviewing on behalf of sguilhen July 30, 2026 21:21 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Jul 30, 2026

View reviewed changes

pedroigor approved these changes Aug 4, 2026

View reviewed changes

pedroigor merged commit 1c22632 into keycloak:main Aug 4, 2026
95 checks passed

sguilhen deleted the 50785-apacheds-am27-upgrade branch August 4, 2026 13:51

This was referenced Aug 7, 2026

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 #51539

Open

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563 #51540

Open

		Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
		!getKerberosRule().isStartEmbeddedLdapServer());

Uh oh!

Conversation

sguilhen commented Jul 23, 2026

Uh oh!

sguilhen commented Jul 23, 2026

Uh oh!

sguilhen commented Jul 23, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 23, 2026

Unreported flaky test detected

org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

sguilhen Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 24, 2026

Unreported flaky test detected

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot commented Jul 24, 2026

Unreported flaky test detected

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mposolda left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot commented Jul 30, 2026

Unreported flaky test detected