KEYCLOAK-18268 logo_uri, policy_uri and tos_uri ( client attributes)#8082
KEYCLOAK-18268 logo_uri, policy_uri and tos_uri ( client attributes)#8082cgeorgilakis wants to merge 1 commit intokeycloak:masterfrom
Conversation
599f6ba to
c916688
Compare
|
Our goal was to do no database changes. However, for logo_uri some SAML clients use data:image and the logo_uri length is over 4000 characters. Current database length for VALUE field of CLIENT_ATTRIBUTES is insufficient. |
There was a problem hiding this comment.
This should be more strict: "Schemes other than “https”, “http”, or “data” SHOULD NOT be used."
according to https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-ui/v1.0/os/sstc-saml-metadata-ui-v1.0-os.html#__RefHeading__10407_1021935550
There was a problem hiding this comment.
I agree that check must be more strict. However, I am not sure that we should folllow SAML documentation for OIDC clients.
I try to use already implemented check for URIs. However, in logo URI "data" scheme must be supported. What Keycloak team believe about Logo URI validation? Maybe we should check if scheme is equal to "data". This means that URI is accepted. Otherwise uri.toURL() must be executed.
c916688 to
67635dc
Compare
10ecc0f to
abe4bc3
Compare
Recently there were some requirements where REALM_ATTRIBUTE needed to be extended, the same can be applied in CLIENT_ATTRIBUTE.
|
|
Been merged into this PR in order to be one PR. |
Keycloak Documentation PR : keycloak/keycloak-documentation#1181.
Needed for this PR.