Restrict defaultRoles and full scope via client registration policies by edewit · Pull Request #54887 · keycloak/keycloak

edewit · 2026-11-09T08:05:02Z

Summary

Backports the CVE-2026-109081 fix from 26.8.2 onto main so Dynamic Client Registration cannot inject realm default-role composites or enable full scope unless an admin removes the new client registration policies.

MigrateTo26_8_2 now combines the existing Admin API audience/scope migration on main with the client registration policy installation from the backport. The upgrade note is documented under 27.0.0.

Closes #54702

Copilot

🟡 Changes recommended

Migration-only manifests leave compatibility metadata unchanged, preventing required recreate-upgrade enforcement, while missing baseline classes cause the test-phase compatibility verifier to fail.

2 open issues

What changed in this PR

Ports the CVE-2026-109081 fix to main, restricting Dynamic Client Registration from changing realm default roles or enabling full scope unless an administrator removes the corresponding policies.

Changes:

Adds default-role protection and enables the existing full-scope restriction for authenticated registration.
Installs policies in existing realms and declares the migration incompatible with rolling upgrades.
Adds regression tests and documents the restrictions and administrator opt-out.

File	Description
`tests/base/src/test/java/org/keycloak/tests/client/ClientRegistrationTest.java`	Tests policy enforcement and removal.
`tests/base/src/test/java/org/keycloak/tests/client/AbstractClientRegistrationTest.java`	Adds a realm-management user and authentication helper.
`services/src/test/java/org/keycloak/services/clientregistration/policy/impl/DefaultRolesClientRegistrationPolicyTest.java`	Tests rejection of nonempty and null-element default roles.
`services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyFactory`	Registers the new policy factory.
`services/src/main/java/org/keycloak/services/clientregistration/policy/impl/DefaultRolesClientRegistrationPolicyFactory.java`	Defines the default-role policy provider.
`services/src/main/java/org/keycloak/services/clientregistration/policy/impl/DefaultRolesClientRegistrationPolicy.java`	Rejects registration requests that change default roles.
`services/src/main/java/org/keycloak/services/clientregistration/policy/DefaultClientRegistrationPolicies.java`	Enables the restrictions by default.
`services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java`	Skips null role names during updates.
`services/src/main/java/org/keycloak/protocol/oauth2/cimd/provider/AbstractPersistentClientIdMetadataDocumentProvider.java`	Removes default-role creation from metadata registration.
`model/storage-private/src/main/resources/META-INF/rolling-upgrades-unsupported-changes.json`	Marks the policy migration as rolling-upgrade incompatible.
`model/storage-private/src/main/resources/META-INF/rolling-upgrades-supported-changes.json`	Records the supported migration baseline.
`model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java`	Registers the new migrator.
`model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_8_2.java`	Installs missing policies in existing realms.
`docs/guides/securing-apps/client-registration.adoc`	Describes policy defaults and removal.
`docs/documentation/upgrading/topics/changes/changes-27_0_0.adoc`	Documents behavior changes and cluster upgrade requirements.

_{Review effort: Balanced}

Replace hardcoded manage-realm/RAT checks with Default Roles Disabled and authenticated Full Scope Disabled policies so admins can opt back in. Closes CVE-2026-109081 Closes keycloak#54702 Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

Main requires both supported and unsupported JSON inventories for the db-compatibility verifier; mark the new policy migrator as unsupported. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

Include Migration helper classes and OidcIssuerMigration in the supported baseline, and hash unsupported migration-only manifests so recreate upgrades are required. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

Copilot

🔵 Needs a closer look

The security-sensitive upgrade path requires runtime validation that existing realms receive the policies and packaged Quarkus discovers the migration-only manifest to reject rolling upgrades.

No open issues 🎉

2 resolved since last review

_{Review effort: Balanced}

Drop SPI helper classes the Maven plugin does not discover so the supported/unsupported inventories match the module classpath. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

Copilot

🔵 Needs a closer look

The security backport changes persisted realm policies and rolling-upgrade compatibility, requiring runtime validation of affected-release upgrades and mixed-version cluster rejection that is unavailable in this review.

No open issues 🎉

_{Review effort: Balanced}

mposolda

I am not sure why this PR needs to do any updates of the file rolling-upgrades-suported-changes.json considering that the original PR does not have anything like that. Also not sure about introducing the file rolling-upgrades-unsupported-changes.json .

Looks like the files were removed from main on purpose and they are not needed anymore?
@ahus1 Could you please confirm?

ahus1 · 2026-11-10T12:14:50Z

@edewit: Please remove the files rolling-upgrades-suported-changes.json and rolling-upgrades-unsupported-changes.json from the PR. The only exist in release branches where we do support rolling updates between patch releases.

cc: @mposolda

These inventories are only used on release branches that support rolling updates between patch releases, so drop them from the main backport along with the related compatibility hashing change. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

edewit · 2026-11-10T13:53:35Z

Removed rolling-upgrades-supported-changes.json and rolling-upgrades-unsupported-changes.json from this PR, and reverted the related DatabaseCompatibilityMetadataProvider hashing change. Those inventories stay on release branches only, as discussed.

Copilot

🔵 Needs a closer look

Security-sensitive DCR authorization and existing-realm migration still require integration validation, including upgrades from 26.8.2 and clustered upgrade compatibility, which could not be exercised in this review environment.

No open issues 🎉

_{Review effort: Balanced}

mposolda

@edewit Thanks!

keycloak-github-bot Bot added the team/core-protocols label Nov 9, 2026

edewit marked this pull request as ready for review November 9, 2026 09:06

edewit requested a review from a team as a code owner November 9, 2026 09:06

Copilot AI balanced review requested due to automatic review settings November 9, 2026 09:06

Copilot started reviewing on behalf of edewit November 9, 2026 09:07

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Comment thread model/storage-private/src/main/resources/META-INF/rolling-upgrades-supported-changes.json Resolved

Comment thread model/storage-private/src/main/resources/META-INF/rolling-upgrades-unsupported-changes.json Resolved

edewit and others added 3 commits November 10, 2026 09:21

Record MigrateTo26_8_2 as rolling-upgrade unsupported

75885ef

Main requires both supported and unsupported JSON inventories for the db-compatibility verifier; mark the new policy migrator as unsupported. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

Complete rolling-upgrade inventory after rebase onto main

bb235de

Include Migration helper classes and OidcIssuerMigration in the supported baseline, and hash unsupported migration-only manifests so recreate upgrades are required. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

edewit force-pushed the backport-54702-main branch from 277a95a to bb235de Compare November 10, 2026 08:29

Copilot AI balanced review requested due to automatic review settings November 10, 2026 08:29

edewit requested a review from a team as a code owner November 10, 2026 08:29

Copilot started reviewing on behalf of edewit November 10, 2026 08:30

View session

Copilot AI reviewed Nov 10, 2026

View reviewed changes

Fix rolling-upgrade baseline for storage-private verifier

cd28a2c

Drop SPI helper classes the Maven plugin does not discover so the supported/unsupported inventories match the module classpath. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>

Copilot AI balanced review requested due to automatic review settings November 10, 2026 08:41

Copilot started reviewing on behalf of edewit November 10, 2026 08:42

View session

Copilot AI reviewed Nov 10, 2026

View reviewed changes

mposolda self-assigned this Nov 10, 2026

mposolda reviewed Nov 10, 2026

View reviewed changes

mposolda mentioned this pull request Nov 10, 2026

Record existing AES key sizes to prevent key regeneration #54910

Merged

Copilot AI balanced review requested due to automatic review settings November 10, 2026 13:53

Copilot started reviewing on behalf of edewit November 10, 2026 13:55

View session

Copilot AI reviewed Nov 10, 2026

View reviewed changes

mposolda approved these changes Nov 11, 2026

View reviewed changes

mposolda merged commit 8aabe42 into keycloak:main Nov 12, 2026
127 of 136 checks passed

Navigation Menu

Repository navigation

Restrict defaultRoles and full scope via client registration policies - #54887

Restrict defaultRoles and full scope via client registration policies#54887
mposolda merged 5 commits into
keycloak:mainfrom
edewit:backport-54702-main

edewit commented Nov 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

mposolda left a comment

Uh oh!

ahus1 commented Nov 10, 2026

Uh oh!

edewit commented Nov 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mposolda left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

edewit commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

mposolda left a comment

Choose a reason for hiding this comment

Uh oh!

ahus1 commented Nov 10, 2026

Uh oh!

edewit commented Nov 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

mposolda left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

edewit commented Nov 9, 2026 •

edited

Loading