initial - #1

initial

Merge

merge updates

KPR-149: JSP version of profile app

KEYCLOAK-3459 Adapt testsuite according to server configuration insid…

Bringing fork up to date

Problem: some smtp as service providers, for example mailgun don't support sslv2 option hello
Due to getSupportedProtocols is called on regular system list looks like this 
```
TLSv1.3 TLSv1.2 TLSv1.1 TLSv1 SSLv3 SSLv2Hello
```
And keycloak tries to establish connectio nwith legacy unsupported SSLv2Hello

```
^Croot@kc1-hc:/opt/keycloak/keycloak/standalone# ssldump -i any port 587
New TCP connection keycloak#1: static.110.5.217.95.clients.your-server.de(45796) <-> ec2-35-157-140-183.eu-central-1.compute.amazonaws.com(587)
1 1  0.1164 (0.1164)  C>S SSLv2 compatible client hello
  Version 3.3            
```

RHBKAAS-28: fix vulnerabilities reported by Snyk

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>

also note that ANY should not be used in production

closes: CVE-2025-3501

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

Add a test for the error (#1)

Signed-off-by: Ricardo Martin <rmartinc@redhat.com>

Update docs/guides/server/keycloak-truststore.adoc

Co-authored-by: Marek Posolda <mposolda@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

also note that ANY should not be used in production

closes: CVE-2025-3501

Add a test for the error (#1)

Signed-off-by: Ricardo Martin <rmartinc@redhat.com>

Update docs/guides/server/keycloak-truststore.adoc

Co-authored-by: Marek Posolda <mposolda@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

also note that ANY should not be used in production

closes: CVE-2025-3501 #39350 #38392



Add a test for the error (#1)



Update docs/guides/server/keycloak-truststore.adoc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Marek Posolda <mposolda@gmail.com>

Clear up comments and add liquibase changelog

Address findings keycloak#1-keycloak#7 from the code review of the sbux branch:

- Default the dedicated account-state message keys (passwordExpired*,
  accountExpired, accountLocked) to the generic invalid-credentials text
  in en/zh-Hans/zh-Hant: a dedicated message confirms a correct-but-expired
  password (AD 532/773) or leaks account existence/state (701/533/775) to
  unauthenticated attackers. Realms opt in via Localization realm overrides;
  document the oracle risk in ldap.adoc
- Consume the UPDATE_PASSWORD_MESSAGE auth note after rendering the
  change-password notice, and clear LOGIN_ERROR_MESSAGE when credentials
  validate successfully, so stale notes cannot mislead later attempts in
  the same auth session
- Set the same auth notes on the LDAP ppolicy path
  (PasswordPolicyPasswordChangeException) as on the MSAD diagnostic-code
  path, so both paths show consistent notices
- Keep the original bind AuthenticationException (carrying AD subcodes)
  when reading ppolicy response controls fails, instead of replacing it
- Enforce ldap-allowed-hosts at runtime in LDAPStorageProviderFactory.create()
  for components persisted before the option was set, and constrain LDAP
  referral targets in ObjectFactoryBuilder (secure-referral, default on)
- Validate ldap-metrics-slos entries as positive milliseconds with a
  fail-fast error naming the option

Tests: 94 federation/ldap tests pass, including new isEnforced, SLO parsing
and referral allow-list cases.