Conversation
WalkthroughThe changes update Keycloak to version 26.2, adjust its Docker Compose configuration, and modify the Keycloak realm and theme files to align with the new version. The authentication flow is updated to use PAR (Pushed Authorization Requests). Related documentation and environment variable examples are also revised. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant App
participant OpenID Client
participant Keycloak
User->>App: Initiate login
App->>OpenID Client: getLoginUrl()
OpenID Client->>Keycloak: Send Pushed Authorization Request (PAR)
Keycloak-->>OpenID Client: Return PAR URI
OpenID Client-->>App: Return login URL with PAR
App-->>User: Redirect to Keycloak login with PAR
User->>Keycloak: Authenticate
Keycloak-->>App: Return authorization code
Assessment against linked issues
Assessment against linked issues: Out-of-scope changes
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
docker/keycloak/themes_src/README.md (1)
16-17: Fix typos and grammar in documentation.There are two issues that need correction:
- Line 16: Grammar issue - "Don't forget the change" should be "Don't forget to change"
- Line 17: Typo - "comfiy" should be "comify"
Apply this diff:
-Then copy all the files from this directory to the `keycloakify-starter-main/src/login` directory. Import the `main.css` in the `KcPage.tsx`. +Then copy all the files from this directory to the `keycloakify-starter-main/src/login` directory. Import the `main.css` in the `KcPage.tsx`. -Don't forget the change the name of the theme to `comfiy` in the `vite.config.ts` file. +Don't forget to change the name of the theme to `comify` in the `vite.config.ts` file.docker-compose.yml (2)
50-50: Verify you’re mounting built providers, not raw theme sources
/opt/keycloak/providersis where Keycloak 26 expects compiled provider/theme JARs.
IfKEYCLOAK_THEME_PATHstill points tothemes_src, Keycloak won’t pick the custom UI and will silently fall back to the default theme.Ensure the CI pipeline runs
keycloakify build(or similar), produces the JAR, and thatKEYCLOAK_THEME_PATHresolves to that output directory/file.
54-57: Standardise admin env-var names to avoid confusionYou feed the new
KC_BOOTSTRAP_*variables from legacyKEYCLOAK_ADMIN_*names. Mixing conventions in one file is easy to overlook and may bite newcomers.Recommend renaming the
.enventries and wiring them straight through:- KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME} - KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD} + KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME} + KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}Deprecate the old variables in
example.envwith a clear comment.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (9)
docker/keycloak/themes/comify/login/resources/img/favicon.icois excluded by!**/*.icodocker/keycloak/themes/comify/login/resources/img/feedback-error-arrow-down.pngis excluded by!**/*.pngdocker/keycloak/themes/comify/login/resources/img/feedback-error-sign.pngis excluded by!**/*.pngdocker/keycloak/themes/comify/login/resources/img/feedback-success-arrow-down.pngis excluded by!**/*.pngdocker/keycloak/themes/comify/login/resources/img/feedback-success-sign.pngis excluded by!**/*.pngdocker/keycloak/themes/comify/login/resources/img/feedback-warning-arrow-down.pngis excluded by!**/*.pngdocker/keycloak/themes/comify/login/resources/img/feedback-warning-sign.pngis excluded by!**/*.pngdocker/keycloak/themes/keycloak-theme-for-kc-all-other-versions.jaris excluded by!**/*.jardocker/keycloak/themes_src/logo.svgis excluded by!**/*.svg
📒 Files selected for processing (7)
docker-compose.yml(1 hunks)docker/keycloak/comify-realm.json(3 hunks)docker/keycloak/themes/comify/login/theme.properties(0 hunks)docker/keycloak/themes_src/README.md(1 hunks)docker/keycloak/themes_src/main.css(3 hunks)example.env(1 hunks)src/integrations/authentication/implementations/openid/OpenID.ts(2 hunks)
💤 Files with no reviewable changes (1)
- docker/keycloak/themes/comify/login/theme.properties
🧰 Additional context used
🪛 LanguageTool
docker/keycloak/themes_src/README.md
[style] ~16-~16: For a more polite and respectful tone, consider rephrasing with ‘please’.
Context: ...rt the main.css in the KcPage.tsx. Don't forget the change the name of the theme to `co...
(DONT_FORGET)
[uncategorized] ~17-~17: “the” seems less likely than “to”.
Context: ...cssin theKcPage.tsx. Don't forget the change the name of the theme to comfiy...
(AI_HYDRA_LEO_CP_THE_TO)
🪛 YAMLlint (1.37.1)
docker-compose.yml
[warning] 46-46: wrong indentation: expected 6 but found 4
(indentation)
[warning] 49-49: wrong indentation: expected 8 but found 6
(indentation)
[warning] 52-52: wrong indentation: expected 8 but found 6
(indentation)
[warning] 54-54: wrong indentation: expected 8 but found 6
(indentation)
🔇 Additional comments (7)
src/integrations/authentication/implementations/openid/OpenID.ts (1)
4-4: LGTM! PAR implementation is correctly integrated.The changes properly implement Pushed Authorization Requests (PAR) by updating the import to
buildAuthorizationUrlWithPARand making thegetLoginUrlmethod asynchronous. This aligns perfectly with the realm configuration that enablesrequire.pushed.authorization.requests.Also applies to: 70-70
example.env (1)
74-75: LGTM! Environment variables are appropriate for development.The new Keycloak environment variables
KC_HTTP_ENABLEDandKC_HOSTNAME_STRICTare correctly configured for development environments and align with the Keycloak 26.2 update.docker/keycloak/themes_src/main.css (1)
85-85: LGTM! CSS improvements enhance theme styling.The changes improve the theme by:
- Adding proper background color for primary buttons
- Correcting the logo path reference
- Enhancing card and column layouts
These updates align with the keycloakify theme generation approach mentioned in the README.
Also applies to: 171-171, 651-658
docker/keycloak/comify-realm.json (3)
29-29: LGTM! SSL disabled for development environment.Setting
sslRequiredto"none"is appropriate for development environments and aligns with the HTTP-enabled configuration.
694-694: LGTM! PAR requirement aligns with code changes.Enabling
require.pushed.authorization.requestsperfectly matches the OpenID.ts implementation changes that switched tobuildAuthorizationUrlWithPAR.
1444-1444: LGTM! LinkedIn provider alias simplified.The alias change from
"linkedin-openid-connect"to"linkedin"improves consistency and simplicity.docker-compose.yml (1)
45-47: ```shell
#!/bin/bashShow lines 40-60 of docker-compose.yml to verify indentation around the keycloak service
sed -n '40,60p' docker-compose.yml
</details> </blockquote></details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
docker-compose.yml (3)
45-47: Indentation breaks Compose-spec conventions
Lines under thekeycloak:service are indented 4 spaces instead of the expected 6 (two per hierarchy level). While Docker Compose tolerates mixed indentation, it becomes painful when editing or diff-ing later.- keycloak: - image: quay.io/keycloak/keycloak:26.2 + keycloak: + image: quay.io/keycloak/keycloak:26.2Fix the whole service block to use consistent 2-space steps.
46-46: Pin by digest to prevent silent upstream changes
quay.io/keycloak/keycloak:26.2will float if Red Hat republishes the tag. Consider locking to the immutable digest (find it withpodman pull --quiet …) and keep the semantic tag as a comment:- image: quay.io/keycloak/keycloak:26.2 + # quay.io/keycloak/keycloak:26.2 + image: quay.io/keycloak/keycloak@sha256:<digest>This shields your CI/CD from unexpected patch rebuilds.
58-63: Secret envs should use_FILEpattern
Leaking client secrets via plain-text environment variables is risky. Docker Compose supports the_FILEconvention:KEYCLOAK_GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google_client_secretSwitching to secrets keeps credentials out of
docker psand shell history.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
docker-compose.yml(1 hunks)docker/keycloak/themes_src/README.md(1 hunks)example.env(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- docker/keycloak/themes_src/README.md
- example.env
🧰 Additional context used
🪛 YAMLlint (1.37.1)
docker-compose.yml
[warning] 46-46: wrong indentation: expected 6 but found 4
(indentation)
[warning] 49-49: wrong indentation: expected 8 but found 6
(indentation)
[warning] 52-52: wrong indentation: expected 8 but found 6
(indentation)
[warning] 54-54: wrong indentation: expected 8 but found 6
(indentation)
🔇 Additional comments (1)
docker-compose.yml (1)
49-51: Verify correct mount location for themes vs. providers
From KC 21+, raw theme folders are still read only from/opt/keycloak/themes;/opt/keycloak/providersis intended for compiled providers/theme JARs. If you mount an uncompiled directory produced byyarn keycloakify --watch, Keycloak will no longer pick it up.Double-check that
${KEYCLOAK_THEME_PATH}contains built.jarartefacts; otherwise revert to/opt/keycloak/themesor add a build step that copies the jar(s) there.
docker-compose.yml
Outdated
| KC_HTTP_ENABLED: ${KC_HTTP_ENABLED} | ||
| KC_HOSTNAME_STRICT: ${KC_HOSTNAME_STRICT} | ||
| KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME} | ||
| KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD} |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Env var defaults & type-safety
KC_HTTP_ENABLED and KC_HOSTNAME_STRICT must be explicit "true"/"false" strings; unset vars will cause Keycloak to fail at start-up. Provide sane fallbacks in the compose file or example.env:
- KC_HTTP_ENABLED: ${KC_HTTP_ENABLED}
- KC_HOSTNAME_STRICT: ${KC_HOSTNAME_STRICT}
+ KC_HTTP_ENABLED: ${KC_HTTP_ENABLED:-true}
+ KC_HOSTNAME_STRICT: ${KC_HOSTNAME_STRICT:-false}Similarly, ensure the new bootstrap admin credentials are present in every deployment pipeline.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 54-54: wrong indentation: expected 8 but found 6
(indentation)
🤖 Prompt for AI Agents
In docker-compose.yml around lines 54 to 57, the environment variables
KC_HTTP_ENABLED and KC_HOSTNAME_STRICT need explicit "true" or "false" string
values to prevent Keycloak startup failures. Update the compose file to provide
default values for these variables using the syntax ${VAR:-default}, setting
sane fallbacks like "true" or "false". Additionally, ensure
KC_BOOTSTRAP_ADMIN_USERNAME and KC_BOOTSTRAP_ADMIN_PASSWORD are always set in
deployment pipelines by adding appropriate defaults or validation to avoid
missing credentials.
|
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
docker-compose.yml (1)
54-55: Defaults for critical env vars still missing (duplicate of previous feedback)
KC_HTTP_ENABLEDandKC_HOSTNAME_STRICTinherit directly from${KEYCLOAK_HTTP_ENABLED}/${KEYCLOAK_HOSTNAME_STRICT}.
If these variables are unset, Keycloak fails hard at startup. Provide sane fall-backs, e.g.:- KC_HTTP_ENABLED: ${KEYCLOAK_HTTP_ENABLED} - KC_HOSTNAME_STRICT: ${KEYCLOAK_HOSTNAME_STRICT} + KC_HTTP_ENABLED: ${KEYCLOAK_HTTP_ENABLED:-true} + KC_HOSTNAME_STRICT: ${KEYCLOAK_HOSTNAME_STRICT:-false}Same concern applies to the new bootstrap admin credentials if they might be omitted in some environments.
🧹 Nitpick comments (1)
docker-compose.yml (1)
46-46: Consider pinning the image with a digest for deterministic buildsUpgrading to
quay.io/keycloak/keycloak:26.2is fine, but relying solely on a mutable tag can lead to non-reproducible deployments once26.2is re-built or re-published. Pin the image with its SHA digest—or at least freeze to the minor/patch version you have locally validated—to guarantee identical bits across CI/CD environments.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
docker-compose.yml(1 hunks)example.env(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- example.env
🧰 Additional context used
🪛 YAMLlint (1.37.1)
docker-compose.yml
[warning] 46-46: wrong indentation: expected 6 but found 4
(indentation)
[warning] 49-49: wrong indentation: expected 8 but found 6
(indentation)
[warning] 52-52: wrong indentation: expected 8 but found 6
(indentation)
[warning] 54-54: wrong indentation: expected 8 but found 6
(indentation)
🔇 Additional comments (1)
docker-compose.yml (1)
50-50: Verify that the mounted path matches the artefact produced by keycloakify
/opt/keycloak/providersis correct only when you mount a JAR generated by keycloakify (≥ 7.x).
If you intend to hot-reload raw theme files (e.g., for local styling tweaks) you still need/opt/keycloak/themes. Double-check thatKEYCLOAK_THEME_PATHindeed points to the built provider JAR; otherwise the theme will no longer be discovered after the upgrade.
2 participants
Fixes #410
Changes proposed in this pull request:
loginandregisterscreens@MaskingTechnology/comify
Summary by CodeRabbit
New Features
Bug Fixes
Refactor
Chores