@aifabrix/builder 2.53.0 → 2.54.1

package/templates/applications/keycloak/Dockerfile

@@ -1,13 +1,39 @@
 # Keycloak Identity and Access Management with Custom Themes
-# This Dockerfile extends Keycloak 26.5.2 with custom themes
+# Official 26.7.2 distro + experimental CIMD. Does not compile Keycloak from source.
+# One class is recompiled against this image's jars:
+# - PR 51235: CIMD parse ignores unknown JSON fields (ChatGPT client.json)
+# - #50362: strip jwt-bearer (and other confidential-only grants) on public CIMD
+# 26.7 advertises token_endpoint_auth_methods_supported "none" for Claude CIMD.
 
-FROM quay.io/keycloak/keycloak:26.5.2
+FROM quay.io/keycloak/keycloak:26.7.2 AS keycloak-base
+
+FROM eclipse-temurin:21-jdk-jammy AS cimd-patch
+COPY --from=keycloak-base /opt/keycloak/lib/lib/main /opt/kc-jars/main
+COPY --from=keycloak-base /opt/keycloak/lib/lib/boot /opt/kc-jars/boot
+COPY cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java \
+     /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java
+RUN mkdir -p /tmp/classes \
+ && find /opt/kc-jars -name '*.jar' | paste -sd: - > /tmp/cp.txt \
+ && { \
+      echo --release; echo 21; echo -cp; cat /tmp/cp.txt; echo -d; echo /tmp/classes; \
+      echo /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java; \
+    } > /tmp/javac.args \
+ && javac @/tmp/javac.args \
+ && SERVICES_JAR=$(ls /opt/kc-jars/main/org.keycloak.keycloak-services-*.jar) \
+ && cp "$SERVICES_JAR" /tmp/keycloak-services-patched.jar \
+ && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes .
+
+FROM quay.io/keycloak/keycloak:26.7.2
 
 # Set working directory
 WORKDIR /opt/keycloak
 
 # Copy custom themes from share directory (only if themes/ folder exists)
 USER root
+COPY --from=cimd-patch /tmp/keycloak-services-patched.jar /tmp/keycloak-services-patched.jar
+RUN SERVICES_JAR=$(ls /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-*.jar) \
+ && cp /tmp/keycloak-services-patched.jar "$SERVICES_JAR" \
+ && rm /tmp/keycloak-services-patched.jar
 # Use a shell script approach: copy themes if it exists, otherwise skip
 # First, copy everything from build context to a staging area
 COPY . /tmp/build-context/
@@ -24,7 +50,7 @@ RUN if [ -d "/tmp/build-context/themes" ] && [ "$(ls -A /tmp/build-context/theme
 # Build Keycloak with health checks enabled (similar to Keycloak 24.0)
 # This enables the /health, /health/live, /health/ready, and /health/started endpoints
 # Expose health endpoints on main HTTP port (like 24.0) instead of management port
-RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false
+RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false --features=cimd
 
 # Switch back to keycloak user
 USER keycloak
@@ -34,4 +60,4 @@ EXPOSE 8080
 
 # Default Keycloak command (can be overridden in docker-compose.yaml)
 # Health checks are enabled via the build step above
-CMD ["start-dev"]
+CMD ["start-dev"]

package/templates/applications/keycloak/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'AI Fabrix Keycloak'
   description: 'Identity and Access Management'
   type: webapp
-  version: '26.5.2'
+  version: '26.7.2'
 
 # Image Configuration
 image:
@@ -48,7 +48,7 @@ authentication:
 
 # Build Configuration
 build:
-  context: .. # Docker build context (relative to builder/)
+  context: . # Docker build context: this app dir (CLI copies it to applications-dev-*)
   dockerfile: builder/Dockerfile # Dockerfile name (empty = use template)
   containerPort: 8080 # Container port (different from local port)
   language: typescript # Runtime language for template selection