Added eclipse files to .gitignore - #7

Added eclipse files to .gitignore

use real IP instead of localhost, no cert validation

* Avoid path traversal vis double-url encoding of redirect URI (#8)

(cherry picked from commit a2128fb9e940d96c2f9a64edcd4fbcc768eedb4f)

* Do not resolve user session if corresponding auth session does not exist (#7)

* Stabilizing the ConcurrentLoginTest when running with JPA map storage by locking user sessions (#9)

Co-authored-by: Marek Posolda <mposolda@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>

* Avoid path traversal vis double-url encoding of redirect URI (#8)

(cherry picked from commit a2128fb9e940d96c2f9a64edcd4fbcc768eedb4f)

* Do not resolve user session if corresponding auth session does not exist (#7)

* Stabilizing the ConcurrentLoginTest when running with JPA map storage by locking user sessions (#9)

Co-authored-by: Marek Posolda <mposolda@gmail.com>
Co-authored-by: Pedro Igor <pigor.craveiro@gmail.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>

Issue 20007

…loak#7 and 6 more

Update .gitignore

Address findings keycloak#1-keycloak#7 from the code review of the sbux branch:

- Default the dedicated account-state message keys (passwordExpired*,
  accountExpired, accountLocked) to the generic invalid-credentials text
  in en/zh-Hans/zh-Hant: a dedicated message confirms a correct-but-expired
  password (AD 532/773) or leaks account existence/state (701/533/775) to
  unauthenticated attackers. Realms opt in via Localization realm overrides;
  document the oracle risk in ldap.adoc
- Consume the UPDATE_PASSWORD_MESSAGE auth note after rendering the
  change-password notice, and clear LOGIN_ERROR_MESSAGE when credentials
  validate successfully, so stale notes cannot mislead later attempts in
  the same auth session
- Set the same auth notes on the LDAP ppolicy path
  (PasswordPolicyPasswordChangeException) as on the MSAD diagnostic-code
  path, so both paths show consistent notices
- Keep the original bind AuthenticationException (carrying AD subcodes)
  when reading ppolicy response controls fails, instead of replacing it
- Enforce ldap-allowed-hosts at runtime in LDAPStorageProviderFactory.create()
  for components persisted before the option was set, and constrain LDAP
  referral targets in ObjectFactoryBuilder (secure-referral, default on)
- Validate ldap-metrics-slos entries as positive milliseconds with a
  fail-fast error naming the option

Tests: 94 federation/ldap tests pass, including new isEnforced, SLO parsing
and referral allow-list cases.