Treat a malformed username domain as no matching organization - #53122
Open
cipherprofessor wants to merge 1 commit into
Open
cipherprofessor wants to merge 1 commit into
cipherprofessor wants to merge 1 commit into
Conversation
A typo in the domain part of the username at the organization identity-first step made getByDomainName() throw ModelValidationException, which ended in the generic error page instead of continuing to the password step. Treat it as no match, as LoginActionsService already does for broker emails. Closes keycloak#53100 Signed-off-by: Mohsin Manzoor Bhat <mohsinmanzoor1913@gmail.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved issues were identified, and the regression paths are covered by tests.
Review effort: Balanced
Findings: None
What changed in this PR
Treats malformed username domains as having no matching organization, allowing authentication to continue normally.
Changes:
- Handles domain validation failures as lookup misses.
- Adds regression coverage for malformed domains,
login_hint, and organizations without domains.
| File | Description |
|---|---|
tests/base/src/test/java/org/keycloak/tests/organization/authentication/OrganizationAuthenticationTest.java |
Tests malformed-domain authentication scenarios. |
services/src/main/java/org/keycloak/organization/utils/Organizations.java |
Converts invalid domain lookup failures into no-match results. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #53100
A malformed domain in the username at the organization identity-first step (
user@example;com,user@example.com., and so on) madegetByDomainName()throwModelValidationException, and the user got the generic error page. With this change it's treated as no matching organization, the wayLoginActionsService.configureOrganization()already handles broker emails, so the flow continues to the password step as it did in 26.6.The catch is only at the lookup in
Organizations.resolveOrganization. Admin-side domain validation is unchanged. The same line also covers the untrimmedlogin_hintpath and users whose stored email has a malformed domain.Tests added to
OrganizationAuthenticationTest: the five typo shapes from the issue, the organization-without-domain case, andlogin_hint. They fail without the fix and pass with it.AI disclosure: this change (code and tests) was produced with Claude Code (an AI agent) from a prompt, then reviewed and verified locally.