scram: rename attributes to scram_sha256_* and re-point contract at the ircd - #1
Open
MrLenin wants to merge 4 commits into
Open
scram: rename attributes to scram_sha256_* and re-point contract at the ircd#1MrLenin wants to merge 4 commits into
MrLenin wants to merge 4 commits into
Conversation
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ttribution Renames PROVIDER_ID/DISPLAY_NAME on ScramPasswordPolicyProviderFactory, the unregistered ScramCredentialProviderFactory PROVIDER_ID, the WebhookEventListenerProvider X3_* field names, and scrubs residual X3 attribution from prose/javadoc where the SCRAM contract's actual counterpart is the ircd (nefarious/ircd/kc/kc_cred_derive.c), not X3. Transitional: adds LegacyScramPasswordPolicyProviderFactory, registering the old "x3Scram" ID alongside the new "scramSha256" one. Keycloak validates every realm's passwordPolicy against loaded providers at boot, before the Admin REST API is reachable -- a bare rename (dropping the old ID outright) makes Keycloak fail to start as soon as it's deployed, for any realm still configured with the old policy string, with no live API left to fix it. This alias exists only to survive that boot and is removed in a follow-up commit once the live realm is flipped to scramSha256.
…s on scramSha256 Cleanup half of the coordinated cutover started in 0c2fc29. The testnet realm's passwordPolicy was flipped to scramSha256 (testnet commit f6acf0e) and re-provisioning no longer regresses it to x3Scram, so LegacyScramPasswordPolicyProviderFactory and its META-INF/services registration are no longer needed. Deploying this jar proves the point: Keycloak boots cleanly with only "scramSha256" registered, which it could not do before the realm was flipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Renames the SCRAM credential user-attribute keys written by the SCRAM providers from
x3_scram_{salt,iterations,stored_key,server_key}toscram_sha256_{...}— the attributes outlive X3, and the consumer is now the Nefarious ircd's SASL SCRAM-SHA-256 path (which reads the new names first and falls back to both legacy spellings, so existing accounts migrate naturally on their next password change; no bulk migration, no derivation change: SHA-256, 4096 iterations, 16-byte salt unchanged).Also corrects the providers' javadoc contract: the live producer is
ScramPasswordPolicyProvider(the CredentialProvider registration is disabled), and derivation parameters are documented as lockstep with the ircd's registration-time derivation (nefarious ircd/kc/kc_cred_derive.c) — change one, change both.Deployed and exercised on the Afternet testnet bed (registration + SCRAM login E2E green).
🤖 Generated with Claude Code