fix(broker): Allows cross session email validation (#52604) by olivierboudet · Pull Request #52626 · keycloak/keycloak

olivierboudet · 2026-09-10T13:31:26Z

Allows cross session email validation when using IdpDetectExistingBrokerUserAuthentication instead of IdpCreateUserIfUniqueAuthenticator

Copilot

🟡 Changes recommended

The new cross-session path needs a dedicated regression test.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Enables cross-session email verification for detect-existing-user broker flows.

Changes:

Consumes the verified-user marker.
Restores the user and verification state before continuing account linking.

File summaries

File	Description
`IdpDetectExistingBrokerUserAuthenticator.java`	Handles cross-session verification for existing broker users.

Review details

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+            runIfUserVerified(context.getSession(), user, broker, brokerContext.getBrokerUserId(),
+                    () -> {
+                        context.setUser(user);
+                        context.getAuthenticationSession().setAuthNote(
+                                IdpEmailVerificationAuthenticator.VERIFY_ACCOUNT_IDP_USERNAME,
+                                brokerContext.getUsername()
+                        );
+                    });


Copilot

🟡 Changes recommended

The test places email verification after auto-linking, so it does not reproduce the reported flow ordering.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 2/2 changed files
Comments generated: 1
Review effort level: Balanced

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-09-11T07:49:10Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BruteForceTest#testCacheExpiryForTemporaryLockout

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: cache entry should have expired ==> expected: <null> but was: <org.keycloak.loginfailures.jpa.UserLoginFailureAdapter@95e6f76d>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertNull.failNotNull(AssertNull.java:50)
	at org.junit.jupiter.api.AssertNull.assertNull(AssertNull.java:35)
...

org.opentest4j.AssertionFailedError: cache entry should have expired ==> expected: <null> but was: <org.keycloak.loginfailures.jpa.UserLoginFailureAdapter@af9edbf7>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertNull.failNotNull(AssertNull.java:50)
	at org.junit.jupiter.api.AssertNull.assertNull(AssertNull.java:35)
...

Report flaky test

Copilot

🟢 Approval recommended

No unresolved review issues were identified.

Review details

Files reviewed: 2/2 changed files
Comments generated: 0 new
Review effort level: Lite

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-09-11T09:39:43Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BruteForceTest#testCacheExpiryForTemporaryLockout

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: cache entry should have expired ==> expected: <null> but was: <org.keycloak.loginfailures.jpa.UserLoginFailureAdapter@47378b0f>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertNull.failNotNull(AssertNull.java:50)
	at org.junit.jupiter.api.AssertNull.assertNull(AssertNull.java:35)
...

Report flaky test

vaceksimon · 2026-10-05T15:38:10Z

Hi @olivierboudet. The fix looks ok to me. Can you please rebase the PR on main?

Please keep in mind that in the meantime, the KcOidcFirstBrokerLoginDetectExistingUserTest was migrated from the legacy test suite to the new one in #52787. This might mean re-writing the test.

Refer to the test framework documentation, or ask away if you need any help.

Allows cross session email validation when using IdpDetectExistingBrokerUserAuthentication instead of IdpCreateUserIfUniqueAuthenticator Signed-off-by: Olivier Boudet <o.boudet@gmail.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

olivierboudet · 2026-10-07T09:15:41Z

hi @vaceksimon thank you, I have rebased the branch and fix updated the test 👍

vaceksimon

LGTM, thank you @olivierboudet

msdaly200

Just one comment about priorities of the steps being set for the test.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Signed-off-by: Olivier Boudet <o.boudet@gmail.com>

msdaly200

LGTM

rmartinc

Thanks @olivierboudet, @vaceksimon and @msdaly200! LGTM too!

…eycloak#52626) * fix(broker): Allows cross session email validation (keycloak#52604) Allows cross session email validation when using IdpDetectExistingBrokerUserAuthentication instead of IdpCreateUserIfUniqueAuthenticator Signed-off-by: Olivier Boudet <o.boudet@gmail.com> * fix priority Signed-off-by: Olivier Boudet <o.boudet@gmail.com> --------- Signed-off-by: Olivier Boudet <o.boudet@gmail.com>

Copilot AI balanced review requested due to automatic review settings September 10, 2026 13:31

olivierboudet requested a review from a team as a code owner September 10, 2026 13:31

olivierboudet force-pushed the fix/issue-52604 branch from 60576f4 to 2b74f81 Compare September 10, 2026 13:33

Copilot started reviewing on behalf of olivierboudet September 10, 2026 13:33

View session

Copilot AI reviewed Sep 10, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 11, 2026 07:00

olivierboudet force-pushed the fix/issue-52604 branch from 2b74f81 to c6ddf4a Compare September 11, 2026 07:00

olivierboudet requested review from a team as code owners September 11, 2026 07:00

Copilot started reviewing on behalf of olivierboudet September 11, 2026 07:01

View session

Copilot AI reviewed Sep 11, 2026

View reviewed changes

Comment thread ...rc/test/java/org/keycloak/testsuite/broker/KcOidcFirstBrokerLoginDetectExistingUserTest.java Resolved

keycloak-github-bot Bot added the flaky-test label Sep 11, 2026

keycloak-github-bot Bot reviewed Sep 11, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 11, 2026 08:50

Copilot started reviewing on behalf of olivierboudet September 11, 2026 08:50

View session

Copilot AI reviewed Sep 11, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Sep 11, 2026

View reviewed changes

vaceksimon self-assigned this Oct 5, 2026

fix(broker): Allows cross session email validation (keycloak#52604)

06079c6

Allows cross session email validation when using IdpDetectExistingBrokerUserAuthentication instead of IdpCreateUserIfUniqueAuthenticator Signed-off-by: Olivier Boudet <o.boudet@gmail.com>

Copilot AI balanced review requested due to automatic review settings October 7, 2026 07:56

olivierboudet force-pushed the fix/issue-52604 branch from c8bd7ea to 06079c6 Compare October 7, 2026 07:56

Copilot AI reviewed Oct 7, 2026

vaceksimon approved these changes Oct 7, 2026

View reviewed changes

msdaly200 reviewed Oct 7, 2026

View reviewed changes

Comment thread ...se/src/test/java/org/keycloak/tests/broker/KcOidcFirstBrokerLoginDetectExistingUserTest.java Resolved

msdaly200 reviewed Oct 7, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 7, 2026 15:54

Copilot AI reviewed Oct 7, 2026

fix priority

467756b

Signed-off-by: Olivier Boudet <o.boudet@gmail.com>

olivierboudet force-pushed the fix/issue-52604 branch from 375909e to 467756b Compare October 7, 2026 15:55

msdaly200 approved these changes Oct 8, 2026

View reviewed changes

rmartinc approved these changes Oct 8, 2026

View reviewed changes

rmartinc merged commit ad732f9 into keycloak:main Oct 8, 2026
97 checks passed

Conversation

olivierboudet commented Sep 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Sep 11, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BruteForceTest#testCacheExpiryForTemporaryLockout

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Sep 11, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BruteForceTest#testCacheExpiryForTemporaryLockout

Uh oh!

vaceksimon commented Oct 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

olivierboudet commented Oct 7, 2026

Uh oh!

vaceksimon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msdaly200 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

msdaly200 left a comment

Choose a reason for hiding this comment

Uh oh!

rmartinc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants