Link authentication flow UsedBy clients to client settings by singhvishalkr · Pull Request #48841 · keycloak/keycloak

singhvishalkr · 2026-05-08T14:48:21Z

Problem:
The authentication flows table can show which clients override a flow, but the Admin UI only had the clientId label and could not link directly to the client settings page.

Root cause:
The existing used-by payload exposed display labels but not the internal client UUID required by the client settings route.

Solution:

Include client references with internal id and clientId in the flows payload for client-specific used-by hints.
Return neutral { id, label } rows from the paginated used-by endpoint so both client and identity-provider results have a clear contract.
Link client used-by rows when an internal id is available and keep identity-provider rows as plain labels.
Preserve pagination while searching by applying skip(first) after filtering client rows.

Verification:

corepack pnpm exec prettier --check apps/admin-ui/src/authentication/components/UsedBy.tsx apps/admin-ui/src/components/role-mapping/resource.ts
corepack pnpm --filter @keycloak/keycloak-admin-ui build
.\mvnw.cmd -pl rest/admin-ui-ext -am -DskipTests -DskipITs compile
git diff --check

edewit

This introduces a lot of queries, it would be better to change the endpoint to return the uuid and the clientId.

singhvishalkr · 2026-05-11T09:33:26Z

Pushed ec66b12: ui-ext /flows now includes clientRefs (internal id + clientId) for SPECIFIC_CLIENTS, and the paginated authentication-management used-by clients response returns the same object shape so UsedBy.tsx no longer calls clients.find per row. I did not run mvn here because JAVA_HOME is not set on the agent.

singhvishalkr · 2026-05-18T12:51:23Z

@edewit On current head the realm authentication table already gets clientRefs built in AuthenticationMapper (internal id + clientId), and GET .../authentication/{type}/{id} maps clients to UsedByClientRef(c.getId(), c.getClientId()). If you still see extra client lookups in the network panel, point at the call path you want collapsed and I will trim it. Otherwise I would treat the earlier review as addressed and need a fresh review when you have a moment.

singhvishalkr · 2026-05-18T18:05:56Z

Visibility ping: ready to address comments whenever reviewers post them.

singhvishalkr · 2026-05-20T15:52:35Z

HEAD ec66b12 already extends UsedBy payloads with clientRefs (realm uuid + clientId) per your 2026-05-11 note (clients.find resolution removed from UsedBy.tsx). CHANGES_REQUESTED still pins 2cd8e8e; can you dismiss or approve on ec66b12? (@edewit**)

singhvishalkr · 2026-05-20T15:52:41Z

Typo repair: tagging @edewit explicitly for visibility on **ec66b12.

singhvishalkr · 2026-05-25T16:52:46Z

I checked the current head and it now returns uuid and clientId without the earlier query fan-out. That matches the review request, so I am asking for another pass on the branch as it stands now.

edewit · 2026-05-26T08:52:02Z

@singhvishalkr it's got a build error:

[INFO] src/authentication/components/UsedBy.tsx(185,43): error TS2322: Type 'string | null | undefined' is not assignable to type 'string | undefined'.
[INFO]   Type 'null' is not assignable to type 'string | undefined'.
[INFO] ❌ 1 script failed.

singhvishalkr · 2026-06-11T16:08:38Z

Updated the branch. The popover path now normalizes ref.id with ?? undefined before passing it to ClientUsedByLink, matching the table renderer and fixing the reported string | null | undefined prop mismatch.

singhvishalkr · 2026-06-16T14:31:44Z

Current head already returns UsedByClientRef objects from the backend, carries clientRefs through usedBy, and uses
ef.id ?? undefined on the UI link path. That removes the client-side lookup fan-out and fixes the null typing issue in UsedBy.tsx. Happy to adjust further if there is another call path you want collapsed.

edewit · 2026-06-18T07:54:34Z

@singhvishalkr there another build issue

singhvishalkr · 2026-06-18T16:10:02Z

Updated the branch. The Admin UI failure was Prettier on UsedBy.tsx, so I split the two ClientUsedByLink prop lists that CI flagged.

Validated with:

corepack pnpm exec prettier --check apps/admin-ui/src/authentication/components/UsedBy.tsx
git diff --check

I also tried corepack pnpm --filter @keycloak/keycloak-admin-ui lint locally, but on this Windows checkout it fails on CRLF Prettier errors across many untouched files. I left those unrelated files unchanged.

Copilot

Pull request overview

Adds linkable client references to the “Used by” hints for authentication flows in the Admin UI, enabling direct navigation to a client’s settings page by using the internal client UUID.

Changes:

Introduces a UsedByClientRef DTO and extends UsedBy to optionally include clientRefs for SPECIFIC_CLIENTS.
Updates backend mapping and the authentication-management/{type}/{id} endpoint to return { id, clientId } objects instead of plain strings.
Updates the Admin UI to render client entries as links (when an internal id is available) in both the popover and the modal.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/model/UsedByClientRef.java	New DTO to carry internal client id + `clientId` label.
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/model/UsedBy.java	Adds optional `clientRefs` field for linkable client references.
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/model/AuthenticationMapper.java	Populates `clientRefs` for `SPECIFIC_CLIENTS` used-by info.
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AuthenticationManagementResource.java	Changes “list used-by” endpoint to return `UsedByClientRef` objects (clients + idp).
js/apps/admin-ui/src/components/role-mapping/resource.ts	Updates `fetchUsedBy()` return type to `UsedByClientRef[]`.
js/apps/admin-ui/src/authentication/constants.ts	Extends `AuthenticationType.usedBy` to include optional `clientRefs`.
js/apps/admin-ui/src/authentication/components/UsedBy.tsx	Renders linkable client entries in popover + modal using internal client id.

+                    .map(c -> new UsedByClientRef(c.getId(), c.getClientId())).filter(ref -> ref.getClientId().contains(search))
                    .skip("".equals(search) ? first : 0).limit(max).collect(Collectors.toList());


        if ("idp".equals(type)) {
-            return session.identityProviders().getByFlow(flow.getId(), search, first, max).toList();
+            return session.identityProviders().getByFlow(flow.getId(), search, first, max)
+                    .map(alias -> new UsedByClientRef(null, alias)).collect(Collectors.toList());


+  const clientRefs = usedBy?.clientRefs;
+  const clientsOrFallback: FlowUsedByRow[] = useMemo(() => {
+    if (!usedBy || usedBy.type !== "SPECIFIC_CLIENTS") {
+      return [];
+    }
+    if (clientRefs && clientRefs.length > 0) {
+      return clientRefs;
+    }
+    return usedBy.values.map((clientId) => ({ clientId }));
+  }, [usedBy, clientRefs]);


singhvishalkr · 2026-06-18T16:43:46Z

Updated the branch for the latest review comments.

Changes made:

search pagination now applies skip(first) after filtering client rows, so page 2+ works with a search term
the paginated used-by endpoint now returns a neutral { id, label } row instead of using the client-specific DTO for IdP rows
the Admin UI maps those rows back to client links only for client results and renders IdP results as labels
the PR description now matches the current backend-provided reference approach

Validated with:

corepack pnpm exec prettier --check apps/admin-ui/src/authentication/components/UsedBy.tsx apps/admin-ui/src/components/role-mapping/resource.ts
corepack pnpm --filter @keycloak/keycloak-admin-ui build
.\mvnw.cmd -pl rest/admin-ui-ext -am -DskipTests -DskipITs compile
git diff --check

…ings Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>

…rnal ids Extend ui-ext /flows UsedBy for SPECIFIC_CLIENTS with clientRefs (realm internal id plus clientId). Return the same shape from paginated authentication-management used-by clients rows. Drop clients.find resolution from UsedBy.tsx. Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>

Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-25T08:12:03Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

singhvishalkr requested review from a team as code owners May 8, 2026 14:48

keycloak-github-bot Bot added the team/ui label May 8, 2026

singhvishalkr force-pushed the fix-40211-usedby-client-links branch from 95a32b1 to 2cd8e8e Compare May 9, 2026 04:25

edewit requested changes May 11, 2026

View reviewed changes

stianst added team/core-protocols and removed team/ui labels May 21, 2026

singhvishalkr force-pushed the fix-40211-usedby-client-links branch from ec66b12 to dbc79e4 Compare June 11, 2026 16:08

Copilot AI review requested due to automatic review settings June 18, 2026 16:09

Copilot started reviewing on behalf of singhvishalkr June 18, 2026 16:10 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

singhvishalkr force-pushed the fix-40211-usedby-client-links branch from 96987c3 to bdb2294 Compare June 18, 2026 16:44

singhvishalkr added 4 commits July 23, 2026 10:29

fix(admin-ui): link authentication flow UsedBy clients to client sett…

9ab96ed

…ings Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>

fix(admin-ui): format used-by client links

deffbb1

Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>

fix(admin-ui): clarify used-by references

85fc9da

Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>

edewit approved these changes Jul 23, 2026

View reviewed changes

edewit enabled auto-merge (squash) July 23, 2026 08:29

Copilot AI review requested due to automatic review settings July 23, 2026 08:43

edewit force-pushed the fix-40211-usedby-client-links branch from bdb2294 to 85fc9da Compare July 23, 2026 08:43

Copilot started reviewing on behalf of edewit July 23, 2026 08:44 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

edewit merged commit cab9b92 into keycloak:main Jul 25, 2026
91 checks passed

keycloak-github-bot Bot added the flaky-test label Jul 25, 2026

keycloak-github-bot Bot reviewed Jul 25, 2026

View reviewed changes

		.map(c -> new UsedByClientRef(c.getId(), c.getClientId())).filter(ref -> ref.getClientId().contains(search))
		.skip("".equals(search) ? first : 0).limit(max).collect(Collectors.toList());

Conversation

singhvishalkr commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

edewit left a comment

Choose a reason for hiding this comment

Uh oh!

singhvishalkr commented May 11, 2026

Uh oh!

singhvishalkr commented May 18, 2026

Uh oh!

singhvishalkr commented May 18, 2026

Uh oh!

singhvishalkr commented May 20, 2026

Uh oh!

singhvishalkr commented May 20, 2026

Uh oh!

singhvishalkr commented May 25, 2026

Uh oh!

edewit commented May 26, 2026

Uh oh!

singhvishalkr commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

singhvishalkr commented Jun 16, 2026

Uh oh!

edewit commented Jun 18, 2026

Uh oh!

singhvishalkr commented Jun 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

singhvishalkr commented Jun 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 25, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

singhvishalkr commented May 8, 2026 •

edited

Loading

singhvishalkr commented Jun 11, 2026 •

edited

Loading