keycloak · vilmosnagy · Apr 5, 2023 · Apr 14, 2023 · Sep 1, 2023 · Sep 1, 2023
@@ -58,7 +58,7 @@ public interface FormContext {
     AuthenticationExecutionModel getExecution();
 
     /**
-     * Current user attached to this flow.  It can return null if no uesr has been identified yet
+     * Current user attached to this flow.  It can return null if no user has been identified yet
      *
      * @return
      */

@@ -18,6 +18,8 @@
 package org.keycloak.authentication.forms;
 
 import org.keycloak.Config;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.AuthenticationFlowException;
 import org.keycloak.authentication.FormAction;
 import org.keycloak.authentication.FormActionFactory;
 import org.keycloak.authentication.FormContext;
@@ -111,6 +113,11 @@ public void buildPage(FormContext context, LoginFormsProvider form) {
 
     @Override
     public void success(FormContext context) {
+        if (context.getUser() != null) {
+            // the user probably did some back navigation in the browser, hitting this page in a strange state
+            throw new AuthenticationFlowException(AuthenticationFlowError.EXPIRED_CODE);
+        }
+
         MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
 
         String email = formData.getFirst(UserModel.EMAIL);

@@ -44,6 +44,8 @@
 import org.keycloak.testsuite.federation.UserPropertyFileStorageFactory;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.pages.LoginPasswordResetPage;
+import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.RegisterPage;
 import org.keycloak.testsuite.pages.VerifyEmailPage;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
@@ -116,6 +118,12 @@ public class UserStorageTest extends AbstractAuthTest {
     @Page
     protected RegisterPage registerPage;
 
+    @Page
+    protected LoginPasswordResetPage resetPage;
+
+    @Page
+    protected ErrorPage errorPage;
+
     @Page
     protected VerifyEmailPage verifyEmailPage;
 
@@ -1065,6 +1073,74 @@ public void testCRUDCredentialsOfDifferentUser() {
         Assert.assertTrue(ObjectUtil.isEqualOrBothNull(otpCredential.getPriority(), otpCredentialLoaded.getPriority()));
     }
 
+    @Test
+    public void testRegisterShouldFailBeforeUserCreationWhenUserIsInContext() throws Exception {
+        try (AutoCloseable c = new RealmAttributeUpdater(testRealmResource())
+            .updateWith(r -> {
+                Map<String, String> config = new HashMap<>();
+                config.put("from", "auto@keycloak.org");
+                config.put("host", "localhost");
+                config.put("port", "3025");
+                r.setSmtpServer(config);
+                r.setRegistrationAllowed(true);
+                r.setVerifyEmail(true);
+                r.setResetPasswordAllowed(true);
+                r.setRegistrationEmailAsUsername(true);
+            })
+            .update()) {
+
+            UserRepresentation userWhoPreExistsInRealm = new UserRepresentation();
+            userWhoPreExistsInRealm.setEmail("keycloak-dev@realcity.io");
+            ApiUtil.createUserAndResetPasswordWithAdminClient(testRealmResource(), userWhoPreExistsInRealm, "password");
+
+            loginPage.open();
+            loginPage.clickRegister();
+            registerPage.clickBackToLogin();
+            loginPage.assertCurrent(testRealmResource().toRepresentation().getRealm());
+
+            loginPage.resetPassword();
+            resetPage.assertCurrent();
+            resetPage.changePassword("keycloak-dev@realcity.io");
+
+            driver.navigate().back();
+            driver.navigate().back();
+            driver.navigate().back();
+
+            int greenMailMessageCountBeforeRegistrer = greenMail.getReceivedMessages().length;
+            registerPage.assertCurrent();
+
+            registerPage.registerWithEmailAsUsername(
+                "Vilmos",
+                "Szabó-Nagy",
+                "vilmos.nagy@realcity.io",
+                "TestPassword123",
+                "TestPassword123"
+            );
+
+            if (errorPage.isCurrent()) {
+                // in this case the error page is shown
+                errorPage.assertCurrent();
+
+                // yet, the user is created in the database
+                final UserRepresentation userByUsername = ApiUtil.findUserByUsername(testRealmResource(), "vilmos.nagy@realcity.io");
+                if (userByUsername != null) {
+                    // if the user was created then the user should have a password
+                    assertNotNull("The user is created even when an error page was shown, yet the user has no password", userByUsername.getCredentials());
+                    assertFalse("The user is created even when an error page was shown, yet the user has no password", userByUsername.getCredentials().isEmpty());
+                }
+            } else {
+                verifyEmailPage.assertCurrent();
+
+                Assert.assertEquals(1+greenMailMessageCountBeforeRegistrer, greenMail.getReceivedMessages().length);
+                MimeMessage message = greenMail.getReceivedMessages()[greenMailMessageCountBeforeRegistrer];
+                String verificationUrl = getPasswordResetEmailLink(message);
+
+                driver.navigate().to(verificationUrl.trim());
+                appPage.assertCurrent();
+            }
+        }
+    }
+
 
     private void assertOrder(List<CredentialModel> creds, String... expectedIds) {
         org.keycloak.testsuite.Assert.assertEquals(expectedIds.length, creds.size());