keycloakify 11.5.3 → 11.5.4

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-18.json

@@ -756,6 +756,24 @@
             "fullScopeAllowed": false,
             "nodeReRegistrationTimeout": 0,
             "protocolMappers": [
+                {
+                    "id": "8fd0d584-7052-4d04-a615-d18a71050873",
+                    "name": "allowed-origins",
+                    "protocol": "openid-connect",
+                    "protocolMapper": "oidc-hardcoded-claim-mapper",
+                    "consentRequired": false,
+                    "config": {
+                        "userinfo.token.claim": "true",
+                        "id.token.claim": "false",
+                        "access.token.claim": "true",
+                        "claim.name": "allowed-origins",
+                        "jsonType.label": "JSON",
+                        "access.tokenResponse.claim": "false",
+                        "claim.value": "[\"*\"]",
+                        "introspection.token.claim": "true",
+                        "lightweight.claim": "true"
+                    }
+                },
                 {
                     "id": "7779f8fa-c2fe-4e68-be56-66ee97bf8f13",
                     "name": "locale",
@@ -1336,13 +1354,13 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "saml-user-attribute-mapper",
-                        "oidc-usermodel-property-mapper",
-                        "oidc-full-name-mapper",
                         "saml-user-property-mapper",
-                        "oidc-usermodel-attribute-mapper",
-                        "oidc-address-mapper",
                         "oidc-sha256-pairwise-sub-mapper",
+                        "oidc-address-mapper",
+                        "oidc-full-name-mapper",
+                        "oidc-usermodel-attribute-mapper",
+                        "saml-user-attribute-mapper",
+                        "oidc-usermodel-property-mapper",
                         "saml-role-list-mapper"
                     ]
                 }
@@ -1393,13 +1411,13 @@
                 "config": {
                     "allowed-protocol-mapper-types": [
                         "oidc-full-name-mapper",
-                        "oidc-usermodel-property-mapper",
-                        "saml-user-property-mapper",
-                        "oidc-usermodel-attribute-mapper",
-                        "oidc-sha256-pairwise-sub-mapper",
-                        "saml-role-list-mapper",
                         "oidc-address-mapper",
-                        "saml-user-attribute-mapper"
+                        "saml-role-list-mapper",
+                        "oidc-sha256-pairwise-sub-mapper",
+                        "saml-user-attribute-mapper",
+                        "saml-user-property-mapper",
+                        "oidc-usermodel-property-mapper",
+                        "oidc-usermodel-attribute-mapper"
                     ]
                 }
             },
@@ -1517,7 +1535,7 @@
     "defaultLocale": "en",
     "authenticationFlows": [
         {
-            "id": "223ce532-2038-4f24-a606-2a5c73f7bd65",
+            "id": "f664efe4-102d-4ec1-bf11-11af67e3f178",
             "alias": "Account verification options",
             "description": "Method with which to verity the existing account",
             "providerId": "basic-flow",
@@ -1543,7 +1561,7 @@
             ]
         },
         {
-            "id": "57e47732-79cc-4d60-bee7-4f0b8fd44540",
+            "id": "8a5630c5-eca1-4b6a-8e59-459cb6c84535",
             "alias": "Authentication Options",
             "description": "Authentication options.",
             "providerId": "basic-flow",
@@ -1577,7 +1595,7 @@
             ]
         },
         {
-            "id": "c2735d89-60c0-45a4-9b3c-ae5df17df395",
+            "id": "c1a3eed3-25ce-44ae-93d1-f0b8148a0f8c",
             "alias": "Browser - Conditional OTP",
             "description": "Flow to determine if the OTP is required for the authentication",
             "providerId": "basic-flow",
@@ -1603,7 +1621,7 @@
             ]
         },
         {
-            "id": "11a5a507-2b9a-443f-961b-dffd66f4318d",
+            "id": "6eb188ad-1041-44dd-bf8f-37cae0d98bf1",
             "alias": "Direct Grant - Conditional OTP",
             "description": "Flow to determine if the OTP is required for the authentication",
             "providerId": "basic-flow",
@@ -1629,7 +1647,7 @@
             ]
         },
         {
-            "id": "963bd753-6ea7-4d93-ab56-30f9ab59d597",
+            "id": "4ee215ac-f4e5-4edb-bf76-65dc9e211543",
             "alias": "First broker login - Conditional OTP",
             "description": "Flow to determine if the OTP is required for the authentication",
             "providerId": "basic-flow",
@@ -1655,7 +1673,7 @@
             ]
         },
         {
-            "id": "1db6a489-a3b4-44c4-b480-1d1e8c123d20",
+            "id": "5a1eac7e-06a0-46d8-b9ae-1f2c934331f9",
             "alias": "Handle Existing Account",
             "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
             "providerId": "basic-flow",
@@ -1681,7 +1699,7 @@
             ]
         },
         {
-            "id": "7a38f32d-4f34-450f-8f03-64802d7cb8f1",
+            "id": "ed165166-4521-4a62-b185-c4b51643cbb1",
             "alias": "Reset - Conditional OTP",
             "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
             "providerId": "basic-flow",
@@ -1707,7 +1725,7 @@
             ]
         },
         {
-            "id": "0df88739-3739-4d70-8893-47c546f19003",
+            "id": "4788fb1f-fd81-4f5d-9abe-4199dd641c1e",
             "alias": "User creation or linking",
             "description": "Flow for the existing/non-existing user alternatives",
             "providerId": "basic-flow",
@@ -1734,7 +1752,7 @@
             ]
         },
         {
-            "id": "35025424-e291-4c54-8a29-70aadba549ce",
+            "id": "d778a70f-f472-4dd3-ac40-cb5612ddc171",
             "alias": "Verify Existing Account by Re-authentication",
             "description": "Reauthentication of existing account",
             "providerId": "basic-flow",
@@ -1760,7 +1778,7 @@
             ]
         },
         {
-            "id": "1813b7f2-c3c2-4b92-8ffc-9ff2d12186c6",
+            "id": "9c1ea8ea-7c23-4e60-b02d-1900d9dc4109",
             "alias": "browser",
             "description": "browser based authentication",
             "providerId": "basic-flow",
@@ -1802,7 +1820,7 @@
             ]
         },
         {
-            "id": "954283ac-f1c2-40b6-a39f-bf23ff9f3ce8",
+            "id": "0ebdf418-d57d-4318-9359-7bd0cb2381f2",
             "alias": "clients",
             "description": "Base authentication for clients",
             "providerId": "client-flow",
@@ -1844,7 +1862,7 @@
             ]
         },
         {
-            "id": "52a789ce-2cad-4f0f-93b2-295b7fd519f0",
+            "id": "5cc89293-c72e-4c5e-b31c-15558588a60d",
             "alias": "direct grant",
             "description": "OpenID Connect Resource Owner Grant",
             "providerId": "basic-flow",
@@ -1878,7 +1896,7 @@
             ]
         },
         {
-            "id": "5a6a71e1-9105-45b6-b5f0-52538461357b",
+            "id": "5ae5a321-ccac-449e-9c19-d6dc22ab8085",
             "alias": "docker auth",
             "description": "Used by Docker clients to authenticate against the IDP",
             "providerId": "basic-flow",
@@ -1896,7 +1914,7 @@
             ]
         },
         {
-            "id": "8392b6e7-bdbf-4d7f-97b6-885761c200db",
+            "id": "7737fdd1-0875-47e6-977b-12561cddfdc3",
             "alias": "first broker login",
             "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
             "providerId": "basic-flow",
@@ -1923,7 +1941,7 @@
             ]
         },
         {
-            "id": "52136d70-8d08-42ea-b04b-cf40ea2807aa",
+            "id": "90f975c3-9826-461f-88ca-27c697aff86b",
             "alias": "forms",
             "description": "Username, password, otp and other auth forms.",
             "providerId": "basic-flow",
@@ -1949,7 +1967,7 @@
             ]
         },
         {
-            "id": "26bbc7e6-ef01-4cdb-9dba-520e2f3f8993",
+            "id": "ce2722d5-9f4f-41a2-8f81-e01f7b6cee57",
             "alias": "http challenge",
             "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
             "providerId": "basic-flow",
@@ -1975,7 +1993,7 @@
             ]
         },
         {
-            "id": "f0887979-04eb-4033-8f19-0ffd8c8b7f6a",
+            "id": "31b5bfa7-98ad-47a2-b8e6-0669022cd8cb",
             "alias": "registration",
             "description": "registration flow",
             "providerId": "basic-flow",
@@ -1994,7 +2012,7 @@
             ]
         },
         {
-            "id": "a3b7b94b-bfbf-4760-a8c9-7d9cd98d262e",
+            "id": "bf8a950b-be3b-4e44-8602-64e0bba492eb",
             "alias": "registration form",
             "description": "registration form",
             "providerId": "form-flow",
@@ -2036,7 +2054,7 @@
             ]
         },
         {
-            "id": "dc68a665-2e51-4a22-aaad-bd693ddc77cc",
+            "id": "e3519800-971b-4b1d-b64e-3983ccd02dea",
             "alias": "reset credentials",
             "description": "Reset credentials for a user if they forgot their password or something",
             "providerId": "basic-flow",
@@ -2078,7 +2096,7 @@
             ]
         },
         {
-            "id": "ae6b73aa-1318-4ae8-a3d9-d01b5e7d957e",
+            "id": "9d5a33a2-e777-4beb-95de-b84812f69c56",
             "alias": "saml ecp",
             "description": "SAML ECP Profile Authentication Flow",
             "providerId": "basic-flow",
@@ -2098,14 +2116,14 @@
     ],
     "authenticatorConfig": [
         {
-            "id": "0c18de7f-0714-41f4-9a3f-ed4edd53ae9c",
+            "id": "4901c91d-59bd-4727-b585-8e4e44828d0a",
             "alias": "create unique user config",
             "config": {
                 "require.password.update.after.registration": "false"
             }
         },
         {
-            "id": "65b3c8bb-34a4-4d19-b578-245dc8ff53ea",
+            "id": "5062a078-83a7-4933-b0d5-3f75cc2a5003",
             "alias": "review profile config",
             "config": {
                 "update.profile.on.first.login": "missing"

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-19.json

@@ -764,6 +764,24 @@
             "fullScopeAllowed": false,
             "nodeReRegistrationTimeout": 0,
             "protocolMappers": [
+                {
+                    "id": "8fd0d584-7052-4d04-a615-d18a71050873",
+                    "name": "allowed-origins",
+                    "protocol": "openid-connect",
+                    "protocolMapper": "oidc-hardcoded-claim-mapper",
+                    "consentRequired": false,
+                    "config": {
+                        "userinfo.token.claim": "true",
+                        "id.token.claim": "false",
+                        "access.token.claim": "true",
+                        "claim.name": "allowed-origins",
+                        "jsonType.label": "JSON",
+                        "access.tokenResponse.claim": "false",
+                        "claim.value": "[\"*\"]",
+                        "introspection.token.claim": "true",
+                        "lightweight.claim": "true"
+                    }
+                },
                 {
                     "id": "7779f8fa-c2fe-4e68-be56-66ee97bf8f13",
                     "name": "locale",
@@ -1344,14 +1362,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "saml-user-property-mapper",
                         "saml-user-attribute-mapper",
                         "oidc-full-name-mapper",
-                        "oidc-usermodel-property-mapper",
-                        "oidc-usermodel-attribute-mapper",
                         "oidc-address-mapper",
+                        "saml-user-property-mapper",
+                        "oidc-sha256-pairwise-sub-mapper",
+                        "oidc-usermodel-attribute-mapper",
                         "saml-role-list-mapper",
-                        "oidc-sha256-pairwise-sub-mapper"
+                        "oidc-usermodel-property-mapper"
                     ]
                 }
             },
@@ -1400,14 +1418,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
+                        "saml-user-property-mapper",
                         "oidc-sha256-pairwise-sub-mapper",
                         "oidc-usermodel-attribute-mapper",
-                        "oidc-usermodel-property-mapper",
-                        "saml-role-list-mapper",
                         "oidc-full-name-mapper",
-                        "saml-user-property-mapper",
+                        "saml-user-attribute-mapper",
+                        "oidc-usermodel-property-mapper",
                         "oidc-address-mapper",
-                        "saml-user-attribute-mapper"
+                        "saml-role-list-mapper"
                     ]
                 }
             },
@@ -1525,7 +1543,7 @@
     "defaultLocale": "en",
     "authenticationFlows": [
         {
-            "id": "1f4d4e13-1591-4751-8985-17886a8c98a9",
+            "id": "8ccfe057-5ce6-499b-9fae-3cd89b62bf01",
             "alias": "Account verification options",
             "description": "Method with which to verity the existing account",
             "providerId": "basic-flow",
@@ -1551,7 +1569,7 @@
             ]
         },
         {
-            "id": "126f07c3-1bcb-4a02-bf16-bb44674bf55d",
+            "id": "f3b9ab2e-41c2-4e73-876b-e2c275d6d14e",
             "alias": "Authentication Options",
             "description": "Authentication options.",
             "providerId": "basic-flow",
@@ -1585,7 +1603,7 @@
             ]
         },
         {
-            "id": "eb3a08c8-5f99-49b6-b02b-16b62571f273",
+            "id": "df1329cc-777c-42d8-aa2f-c5d5ddaaf5a4",
             "alias": "Browser - Conditional OTP",
             "description": "Flow to determine if the OTP is required for the authentication",
             "providerId": "basic-flow",
@@ -1611,7 +1629,7 @@
             ]
         },
         {
-            "id": "3dc19838-5025-4bbb-b569-b574bd5a8d90",
+            "id": "f78a4cbc-66ff-4caa-8066-67aff94946f4",
             "alias": "Direct Grant - Conditional OTP",
             "description": "Flow to determine if the OTP is required for the authentication",
             "providerId": "basic-flow",
@@ -1637,7 +1655,7 @@
             ]
         },
         {
-            "id": "70d6fd40-d740-4dae-b0e6-350f8e9d4a1c",
+            "id": "4b20995b-5553-45db-86b0-05c3fe14edb1",
             "alias": "First broker login - Conditional OTP",
             "description": "Flow to determine if the OTP is required for the authentication",
             "providerId": "basic-flow",
@@ -1663,7 +1681,7 @@
             ]
         },
         {
-            "id": "6e24dcb3-5818-483c-8e44-883858171901",
+            "id": "0a7cc6b7-e427-4f72-b44e-a02133241bad",
             "alias": "Handle Existing Account",
             "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
             "providerId": "basic-flow",
@@ -1689,7 +1707,7 @@
             ]
         },
         {
-            "id": "ac6254cd-403b-457b-b308-22a2a0e4f99d",
+            "id": "e24e73c0-dd51-4fdc-a916-284f11f38487",
             "alias": "Reset - Conditional OTP",
             "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
             "providerId": "basic-flow",
@@ -1715,7 +1733,7 @@
             ]
         },
         {
-            "id": "485e74e6-9b3e-4b2c-a9b9-927802dc4f06",
+            "id": "37ee5a12-01c2-41b0-aafa-e9c6661ff544",
             "alias": "User creation or linking",
             "description": "Flow for the existing/non-existing user alternatives",
             "providerId": "basic-flow",
@@ -1742,7 +1760,7 @@
             ]
         },
         {
-            "id": "ff9bb879-1d6a-4d1c-9836-1e4fab6f8997",
+            "id": "8902a1a7-c2ee-4648-869f-dd5ef89184fc",
             "alias": "Verify Existing Account by Re-authentication",
             "description": "Reauthentication of existing account",
             "providerId": "basic-flow",
@@ -1768,7 +1786,7 @@
             ]
         },
         {
-            "id": "af8b2470-d581-401c-9984-762b966ebcc2",
+            "id": "77c78eed-4bcd-4779-b39f-10135be84946",
             "alias": "browser",
             "description": "browser based authentication",
             "providerId": "basic-flow",
@@ -1810,7 +1828,7 @@
             ]
         },
         {
-            "id": "414dbda4-eb3f-4baa-b23a-d3423af1eae6",
+            "id": "c6398883-01e6-47a1-bb97-c09f2983155d",
             "alias": "clients",
             "description": "Base authentication for clients",
             "providerId": "client-flow",
@@ -1852,7 +1870,7 @@
             ]
         },
         {
-            "id": "1cae0c4b-8dfb-4f5d-a781-e74d0a13c940",
+            "id": "78ab5fb8-f35b-4053-b264-94b208000b13",
             "alias": "direct grant",
             "description": "OpenID Connect Resource Owner Grant",
             "providerId": "basic-flow",
@@ -1886,7 +1904,7 @@
             ]
         },
         {
-            "id": "e798b655-7d85-4b6b-aee7-1448a3e1e0ea",
+            "id": "959e154b-034e-413d-9b19-211e7d9ba33d",
             "alias": "docker auth",
             "description": "Used by Docker clients to authenticate against the IDP",
             "providerId": "basic-flow",
@@ -1904,7 +1922,7 @@
             ]
         },
         {
-            "id": "eb94b723-1041-426a-87bf-f7b4bd2f485d",
+            "id": "001e253d-bdbd-41e2-81c7-1c7b239feeb1",
             "alias": "first broker login",
             "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
             "providerId": "basic-flow",
@@ -1931,7 +1949,7 @@
             ]
         },
         {
-            "id": "452d1d5f-7632-44d7-bc89-77ff2b209b3e",
+            "id": "45481bb0-18fe-4a26-a77c-35a5afe58436",
             "alias": "forms",
             "description": "Username, password, otp and other auth forms.",
             "providerId": "basic-flow",
@@ -1957,7 +1975,7 @@
             ]
         },
         {
-            "id": "7c1b9e8f-6b57-49d1-a9a7-494862f93c0f",
+            "id": "bb47b847-5a55-4c08-909e-9f6f8d8a0636",
             "alias": "http challenge",
             "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
             "providerId": "basic-flow",
@@ -1983,7 +2001,7 @@
             ]
         },
         {
-            "id": "2b38f34a-1739-499e-bb24-1dff96f32009",
+            "id": "77e6e169-05b7-4b89-af00-09cfe1604eed",
             "alias": "registration",
             "description": "registration flow",
             "providerId": "basic-flow",
@@ -2002,7 +2020,7 @@
             ]
         },
         {
-            "id": "d26ae72b-a933-44dc-9927-1c82757004b2",
+            "id": "aef03fe8-1a70-40c3-879f-25588f75c119",
             "alias": "registration form",
             "description": "registration form",
             "providerId": "form-flow",
@@ -2044,7 +2062,7 @@
             ]
         },
         {
-            "id": "222ee8d6-1892-4768-9ada-720274b6bf9a",
+            "id": "990abff7-e2ba-4217-984e-8890cbc2b3a9",
             "alias": "reset credentials",
             "description": "Reset credentials for a user if they forgot their password or something",
             "providerId": "basic-flow",
@@ -2086,7 +2104,7 @@
             ]
         },
         {
-            "id": "e8b4d92c-27c1-4a9b-9b16-7ceb810fa230",
+            "id": "d9894cf6-2f99-493e-ac47-853f54bfc9c6",
             "alias": "saml ecp",
             "description": "SAML ECP Profile Authentication Flow",
             "providerId": "basic-flow",
@@ -2106,14 +2124,14 @@
     ],
     "authenticatorConfig": [
         {
-            "id": "e5847a0b-855d-4d93-85fd-94714be3ed92",
+            "id": "101ed8ff-4383-4539-aa52-2d1e69698b78",
             "alias": "create unique user config",
             "config": {
                 "require.password.update.after.registration": "false"
             }
         },
         {
-            "id": "a2a18aa4-bd4c-4c2a-9286-e9d6c64f4812",
+            "id": "049042a5-3551-4c16-81a1-64d86f5aa1e5",
             "alias": "review profile config",
             "config": {
                 "update.profile.on.first.login": "missing"