8000 Step up authentication for saml by rmartinc · Pull Request #44185 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Step up authentication for saml - #44185

Merged
mposolda merged 5 commits into
keycloak:mainfrom
rmartinc:issue-10155
Feb 23, 2026
Merged

Step up authentication for saml#44185
mposolda merged 5 commits into
keycloak:mainfrom
rmartinc:issue-10155

Conversation

@rmartinc
@rmartinc rmartinc commented Nov 13, 2025
Copy link
Copy Markdown
Contributor

Closes #10155

This is the initial idea for SAML step-up authentication. It's incomplete because I have not done the mapping at realm level. This PR just uses the mapping at client level. In saml we use the authentication context class ref (which is an uri, for example urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport) and I suppose it will be different to the OIDC name. So in the client is the same map {"uri":"loa",...} but we have to think something for the realm.

What do you prefer?

  1. Do more or less like it's in the PR and always override at client level. The realm will use the same OIDC names.
  2. Add another mapping at realm level (something like saml.acr.loa.map or similar), but it's very convoluted for the admins.
  3. Change the current map to an array, for example [{"acr":"silver","uri":"urn:oasis:names:...","loa":"1"},...]. But this needs to convert the current realm values on the fly or at upgrade.

Suggestions?

@mposolda The spec says that requesting an incorrect authn context returns an error in saml protocol (second status). So I need to implement a sendProtocolError in the bindings that uses the protocol. But I discovered the inResponseTo was not properly set for errors. I added this ID in the client data. Is this OK? Or better we just use the inResponseTo in the methods that the auth session is available?

Draft for the moment because, we need to manage mapping at realm level before.

@rmartinc rmartinc mentioned this pull request Nov 13, 2025
Closed
@rmartinc
rmartinc commented Nov 19, 2025
Copy link
Copy Markdown
Contributor Author

OK, I have implemented the realm map. Finally it is the following:

  • The realm has another attribute acr.uri.map than contains the map between OIDC acr and SAML uri acr.
  • But this is presented in the realm as a table ACR, URI, LoA. There is a new element RealmLoAMapping in the UI only for this. The uri in that table is optional, so an ACR can have only ACR and LoA and then it is not valid for SAML.

The rest is more or less the same but I have extended testing and polished some corner cases. For me it's OK and it's fully functional (see the tests) and cover everything. The only missing piece is the documentation. Maybe I would manage it as a follow-up.

@mposolda mposolda self-assigned this Dec 12, 2025
@rmartinc
rmartinc commented Dec 15, 2025
Copy link
Copy Markdown
Contributor Author

Moving to ready for review. The JS CI will be fixed by #44883.

@rmartinc
rmartinc marked this pull request as ready for review December 15, 2025 09:29
@rmartinc
rmartinc requested review from a team as code owners December 15, 2025 09:29
@darius-m darius-m mentioned this pull request Jan 15, 2026
Closed
@rmartinc
rmartinc commented Jan 15, 2026
Copy link
Copy Markdown
Contributor Author

Rebased again. 😄

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jan 15, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
keycloak-github-bot Bot commented Jan 15, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testTokenScriptMapping

Keycloak CI - Base IT (6)

java.lang.RuntimeException: java.lang.IllegalStateException: Keycloak unexpectedly died :(
	at org.keycloak.testsuite.arquillian.containers.KeycloakQuarkusServerDeployableContainer.start(KeycloakQuarkusServerDeployableContainer.java:72)
	at org.jboss.arquillian.container.impl.ContainerImpl.start(ContainerImpl.java:185)
	at org.jboss.arquillian.container.impl.client.container.ContainerLifecycleController$8.perform(ContainerLifecycleController.java:137)
	at org.jboss.arquillian.container.impl.client.container.ContainerLifecycleController$8.perform(ContainerLifecycleController.java:133)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserGroupRoleToAttributeMappersScopedClientNotSet

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeUserOneGroupMultivalueNoAggregate

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserGroupRoleToAttributeMappersNotScopedOtherApp

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeOneGroupMultiValueNoAggregate

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testAddressMappingWithAdditionalMapper

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testClaimFromUserPropertyMapperWithDefaultProfileScope

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testSingleValuedRoleMapping

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeTwoGroupHierarchyMultiValueNoAggregate

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeTwoGroupHierarchyNoMultivalueNoAggregateFromParent

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testRoleMapperWithRoleInheritedFromMoreGroups

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testTokenMapping

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserRolesMovedFromAccessTokenProperties

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testAddressMappingWithoutPresentAddress

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserRoleToAttributeMappers

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testAddressMappingWithAdditionalMapperReversedOrder

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testTokenPropertiesMapping

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeOneGroupMultiValueAggregate

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testHardcodeRoleAll

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testStaticScopeUsingDynamicScopeFormatPrefixedWithScopeAsOptionalScope

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeTwoGroupMultiValueNoAggregate

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserGroupRoleToAttributeMappers

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserGroupRoleToAttributeMappersScoped

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testUserGroupRoleToAttributeMappersScopedWithDifferentClient

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testGroupAttributeUserOneGroupMultivalueAggregate

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testRoleNameMapperAll

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

org.keycloak.testsuite.oauth.OIDCProtocolMappersTest#testNullOrEmptyTokenMapping

Keycloak CI - Base IT (6)

jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8543 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:364)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:144)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

mposolda
mposolda reviewed Feb 19, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rmartinc Thanks! Added only one note inline regarding docs. Also there is conflict introduced in the meantime, but hopefully that can be addressed later.

Comment thread docs/documentation/server_admin/topics/authentication/flows.adoc

:tech_feature_name: Step-up Authentication for SAML
:tech_feature_id: step-up-authentication-saml
include::../../topics/templates/techpreview.adoc[]
@mposolda mposolda Feb 19, 2026
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This adds the "preview" warning in the documentation, however the feature is enabled as "experimental" in this PR. It seems the options are:

  1. Mark the feature as "preview" instead of "experimental" . Which IMO is OK as it is small feature and isolated

  2. Update this documentation to mark as feature as "Experimental" . It should be either some "hand-written warning" or a template for experimental features (Something like include::../../topics/templates/techexperimental.adoc ).

My vote is (1) ATM .

@rmartinc rmartinc Feb 20, 2026
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved to preview.

@rmartinc
Step up authentication for saml
e03f00d 
Closes keycloak#10155

Signed-off-by: rmartinc <rmartinc@redhat.com>
@rmartinc
Step up authentication admin ui changes
d6b9fb6 
Closes keycloak#10155

Signed-off-by: rmartinc <rmartinc@redhat.com>
@rmartinc
Integrating step-up SAML with the realm configuration.
25f55d1 
Polishing of the feature.
Closes keycloak#10155

Signed-off-by: rmartinc <rmartinc@redhat.com>
@rmartinc
Documentation for the new step-up authentication for SAML
39b7afe 
Closes keycloak#10155

Signed-off-by: rmartinc <rmartinc@redhat.com>
@rmartinc
Promote the feature to preview
9ad0a9a 
Closes keycloak#10155

Signed-off-by: rmartinc <rmartinc@redhat.com>
@rmartinc
rmartinc commented Feb 20, 2026
Copy link
Copy Markdown
Contributor Author

@mposolda Rebased. Promoted to preview. I have added the release note and also prepared the migration to include the client scope when supported.

mposolda
mposolda approved these changes Feb 23, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rmartinc Thanks!

@mposolda
mposolda merged commit 2bd3868 into keycloak:main Feb 23, 2026
82 checks passed
@kfaseela kfaseela mentioned this pull request May 4, 2026
Closed
1 of 2 tasks
sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026
@rmartinc @sashyo
Step up authentication for saml - preview (keycloak#44185)
337a219 
Closes keycloak#10155


Signed-off-by: rmartinc <rmartinc@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mposolda mposolda mposolda approved these changes
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

Labels

flaky-test team/cloud-native team/core-clients team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Step-up authentication for SAML clients

2 participants

@rmartinc @mposolda
0