[BACK-4441] Add 2FA cleanup event listeners (recovery codes + trusted devices)#50
Open
toddkazakov wants to merge 2 commits into
Open
[BACK-4441] Add 2FA cleanup event listeners (recovery codes + trusted devices)#50toddkazakov wants to merge 2 commits into
toddkazakov wants to merge 2 commits into
Conversation
When a user removes their final OTP device via self-service, Keycloak fires REMOVE_TOTP after the credential is already deleted. This global event listener reacts by removing the user's recovery (authn) codes, which Tidepool issues only as an OTP backup, so they are not left as an unusable standalone second factor. Runs for all realms (isGlobal); no per-realm eventsListeners config needed. Adds JUnit5/Mockito/AssertJ test setup to the admin module. (cherry picked from commit d840eb8)
When a user sets a new password via self-service or completes a forgot-password reset, Keycloak fires UPDATE_PASSWORD. This global event listener reacts by deleting every 'trusted-device' credential for the user, so trust established under the old password cannot be reused. Admin-initiated password resets emit only an admin event and are out of scope, matching the recovery-codes cleanup listener. (cherry picked from commit e7124ea)
toddkazakov
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two event listeners with unit tests: delete recovery codes when the last OTP is removed, and remove trusted devices when the password changes.
📚 Stacked PR 4 of 8. Base branch:
tk-stack-3-aia-authenticator— review/merge it first.Stack — review & merge bottom-up:
tk-stack-1-trusted-device-spi→mastertk-stack-2-attempted-username-fix→tk-stack-1-trusted-device-spitk-stack-3-aia-authenticator→tk-stack-2-attempted-username-fixtk-stack-4-2fa-cleanup-listeners→tk-stack-3-aia-authenticatortk-stack-5-login-activity-outbox→tk-stack-4-2fa-cleanup-listenerstk-stack-6-email-changed-notification→tk-stack-5-login-activity-outboxtk-stack-7-cancelable-email-change→tk-stack-6-email-changed-notificationtk-stack-8-theme-redesign→tk-stack-7-cancelable-email-changeBuilds green on JDK 21 (
./mvnw clean compile package); on the stack tip 42 admin + 35 home-idp tests pass.