Skip to content

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51124

Open
sguilhen wants to merge 1 commit into
keycloak:mainfrom
sguilhen:50785-apacheds-am27-upgrade
Open

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51124
sguilhen wants to merge 1 commit into
keycloak:mainfrom
sguilhen:50785-apacheds-am27-upgrade

Conversation

@sguilhen

@sguilhen sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Closes #50785

@sguilhen
sguilhen requested review from a team as code owners July 23, 2026 19:35
@sguilhen
Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563
f0f0bf3 
Closes keycloak#50785

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 53419f2 to f0f0bf3 Compare July 23, 2026 19:55
@sguilhen

sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Notes about the changes needed to bump Apache DS to 2.0.0.AM27:

  • bumped apacheds.version to 2.0.0.AM27 and apacheds.codec.version to 2.1.8
  • added Apache Kerby dependencies where necessary (kerb-simplekdc, kerb-client). AM27 removed apacheds-protocol-kerberos; KDC is now provided by Kerby.
  • rewrote embedded KDC from ApacheDS KdcServer to Kerby KdcServer.
  • rewrote KerberosKeytabCreator, moving from ApacheDS KerberosKeyFactory to Kerby EncryptionHandler. The old API was removed in AM27. Explicit enc type list matches what KeyDerivationInterceptor derives.
  • disabled requestCredDeleg (credential delegation) in KeycloakSPNegoSchemeFactory. Kerby KDC doesn't echo the FORWARDED flag in TGS-REP, causing JDK's KrbKdcRep.check() to reject with error 41. (DIRKRB-458).
  • skipped AbsctractKerberosSingleRealmTest.credentialDelegationTestwithAssume.assumeTruebecause Kerby doesn't support theFORWARDED` ticket flag.

Aside from that, there's a minor architectural change between the versions: in AM26, the ApacheDS KDC accessed the DirectoryService in-process (via kdcServer.setDirectoryService()). In AM27 (Kerby), this is no longer possible, and the KDC connects to LDAP over the network via LdapIdentityBackend.

@sguilhen

sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Also worth mentioning: I've had to add krb5AccountDisabled, krb5AccountLockedOut, krb5AccountExpirationTime, and krb5KDCFlags attributes to all krb5kdcentry entries in the kerberos test LDIF files. Kerby's LdapIdentityGetHelper NPEs without them as it calls .getString() on nullable LDAP attributes with no null check.

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 23, 2026
Open
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 23, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 23, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for value to contain (ignoring case) "sign in to". Current value: "AUTH_RESPONSE" (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

@sguilhen
sguilhen requested a review from mposolda July 24, 2026 13:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mposolda mposolda Awaiting requested review from mposolda
1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

flaky-test team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname

1 participant

@sguilhen