thomasdarimont

import com.google.auto.service.AutoService;
import jakarta.persistence.EntityManager;
import jakarta.persistence.TypedQuery;
import lombok.extern.jbosslog.JBossLog;
import org.keycloak.Config;
import org.keycloak.connections.jpa.JpaConnectionProvider;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleModel;

thomasdarimont

import com.google.auto.service.AutoService;
import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.models.AuthenticatedClientSessionModel;
import org.keycloak.models.Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.provider.ProviderConfigProperty;
import org.keycloak.representations.RefreshToken;

thomasdarimont

/*
* PATCHED Version of RedirectUtils to work around issue https://github.com/keycloak/keycloak/issues/51712 based on https://github.com/keycloak/keycloak/blob/26.7.2/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java.
* See PATCH:BEGIN / PATCH:END sections for the changes.
*
* To allow OIDC-Parameters in redirect URIs start Keycloak with the env variable KC_PATCH_ALLOW_OIDC_PARAMS_IN_REDIRECT_URIS=true.
*
* Note: These class must be adapted/aligned with every Keycloak version update.
*/
/*
 * Copyright 2016 Red Hat, Inc. and/or its affiliates

thomasdarimont

# Builder image for compiling Keycloak from source, see build-dockerized.sh
ARG JAVA_VERSION=21
FROM eclipse-temurin:${JAVA_VERSION}-jdk

# Node / pnpm versions should match the ones declared in the Keycloak js/pom.xml
# (node.version / pnpm.version) of the version being built.
ARG NODE_VERSION=24.9.0
ARG PNPM_VERSION=10.14.0

RUN apt-get update && \

thomasdarimont

Keycloak + Apple Business Integration

This guide describes how to integrate Keycloak with Apple Business Manager (ABM) as a Custom Identity Provider, using OIDC for authentication and SSF (Shared Signals Framework) for propagating session and credential change events.

Note that the frontend hostname that Keycloak uses as issuer for the ssf-configuration endpoint.

Keycloak Setup

thomasdarimont

#!/usr/bin/env zsh
# Manual end-to-end test for the Identity Assertion JWT (ID-JAG) token-exchange flow.
#
# Prereq: start Keycloak with the experimental feature enabled, e.g.
#   bin/kc.sh start-dev --features=identity-assertion-jwt,token-exchange
#
# Requires: curl, jq, openssl (all standard on macOS).
set -u

BASE=${BASE:-http://localhost:8081}

thomasdarimont

package demo;

import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.events.Event;
import org.keycloak.events.EventListenerProvider;
import org.keycloak.events.EventListenerProviderFactory;
import org.keycloak.events.admin.AdminEvent;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;

thomasdarimont

SSF Transmitter Support in Keycloak

Design-and-scope overview of the Shared Signals Framework (SSF) transmitter feature landed on branch issue/gh-xxx-ssf-tx-support-v1. Keycloak acts as an SSF Transmitter — receivers authenticated via OAuth pull or are pushed signed Security Event Tokens (SETs) describing user / session / credential events that happen in the realm.

Feature flag: Profile.Feature.SSF — experimental, opt-in.

thomasdarimont

<div>
  <span>A</span>
  <input type="text" id="inputWithKeyboard">
</div>

<div>
    <span>B</span>
  <input id="inputWithoutKeyboard" type="text" readonly autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false">
</div>

thomasdarimont

package com.github.thomasdarimont.keycloak.custom.idp.azure;

import com.google.auto.service.AutoService;
import lombok.val;
import org.keycloak.authentication.ClientAuthenticationFlowContext;
import org.keycloak.authentication.authenticators.client.FederatedJWTClientValidator;
import org.keycloak.broker.oidc.OIDCIdentityProvider;
import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
import org.keycloak.broker.provider.IdentityProviderFactory;