✨ Keycloak: Configuration to support multiple certificates in Election Event by BelSequent · Pull Request #2587 · sequentech/step

BelSequent · 2026-04-20T10:02:52Z

Parent issue: https://github.com/sequentech/meta/issues/11110

…ng/main

Copilot

Pull request overview

This PR adds multi-certificate (CA bundle) support for X.509 voter certificate authentication per election event, including import/export of CA bundles, Keycloak realm attribute management to toggle certificate login, and improved audit/electoral-log reporting for certificate auth events.

Changes:

Add certificate authorities export (PEM bundle) as a new task/action and include CA bundles in election event export/import.
Introduce Keycloak realm attribute updates (e.g., voter-certificate-policy) and update voting portal login theme to conditionally show the certificate IDP.
Extend Electoral Log support to record certificate authority import/delete events and enrich Keycloak login event details for certificate-based logins.

Reviewed changes

Copilot reviewed 104 out of 106 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/windmill/src/types/tasks.rs	Add new task type for CA export.
packages/windmill/src/types/documents.rs	Add CERTIFICATES document type.
packages/windmill/src/tasks/mod.rs	Register new CA export task module.
packages/windmill/src/tasks/export_election_event.rs	Add `include_certificates` export option.
packages/windmill/src/tasks/export_certificate_authority.rs	New Celery task to export CA PEM bundle to S3/documents.
packages/windmill/src/services/import/import_election_event.rs	Import CA PEM bundles from election event export.
packages/windmill/src/services/export/export_election_event.rs	Optionally include CA PEM bundle in export ZIP.
packages/windmill/src/services/electoral_log.rs	Add posting of certificate auth events.
packages/windmill/src/services/certificate_authority.rs	Clarify PEM marker comment.
packages/windmill/src/services/celery_app.rs	Register/route new CA export Celery task.
packages/windmill/src/services/ballot_styles/ballot_publication.rs	Fix status clone usage.
packages/windmill/src/postgres/certificate_authority.rs	Support bulk delete + PEM fetch by ids; transaction-based reads.
packages/voting-portal/src/gql/graphql.ts	Update generated GraphQL types for CA bulk delete/export + realm attributes update.
packages/voting-portal/graphql.schema.json	Schema snapshot updates for new/changed actions/types.
packages/ui-core/src/types/ElectionEventPresentation.ts	Rename voter cert policy enum + field.
packages/step-cli/src/graphql/schema.json	Schema snapshot updates for new/changed actions/types.
packages/step-cli/src/commands/export_election_event.rs	Always include certificates in CLI election event export.
packages/sequent-core/src/types/keycloak.rs	Add constants for realm attribute + certificate IDP alias.
packages/sequent-core/src/services/keycloak/realm_attributes.rs	New Keycloak realm attribute update helper.
packages/sequent-core/src/services/keycloak/realm.rs	Add Keycloak-style secret generator + minor rename fix.
packages/sequent-core/src/services/keycloak/mod.rs	Export new realm_attributes module.
packages/sequent-core/src/ballot.rs	Rename voter cert policy types.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/theme.properties	Remove mtlsLoginUrl theme property usage.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_tl.properties	Update/add certificate auth error/button strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_nl.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_nl.properties	Add Dutch voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_gl.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_gl.properties	Add Galician voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_fr.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_fr.properties	Add French voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_eu.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_eu.properties	Add Basque voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_es.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_es.properties	Add Spanish voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_en.properties	Replace voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_cat.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/messages/messages_cat.properties	Add Catalan voting-portal cert login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/login.ftl	Filter/show certificate IDP based on realm attr.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/login-x509-info.ftl	Remove old X509 info template.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/error.ftl	Redesign error page markup/back link.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/resources/css/custom.css	Add styling for new error page + social provider button.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_tl.properties	Update Tagalog admin-portal login labels.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_nl.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_nl.properties	Add Dutch admin-portal login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_gl.properties	Update Galician admin-portal login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_fr.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_fr.properties	Add French admin-portal login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_eu.properties	Update Basque admin-portal login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_es.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_es.properties	Add Spanish admin-portal login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_en.properties	Update English admin-portal login labels.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_cat.properties.license	Add SPDX license file.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/login/messages/messages_cat.properties	Add Catalan admin-portal login strings.
packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.admin-portal/account/messages/messages_eu.properties	Remove HTML entity from back link text.
packages/keycloak-extensions/message-otp-authenticator/src/main/java/sequent/keycloak/authenticator/Utils.java	Add shared constants for cert login event details/deny codes.
packages/keycloak-extensions/custom-event-listener/src/main/java/sequent/keycloak/custom_event_listener/CustomEventListenerProvider.java	Include certificate detail fields in LOGIN/LOGIN_ERROR bodies.
packages/keycloak-extensions/conditional-authenticators/src/main/java/sequent/keycloak/conditional_authenticators/X509UserResolutionAuthenticatorFactory.java	New factory for extended X509 authenticator.
packages/keycloak-extensions/conditional-authenticators/src/main/java/sequent/keycloak/conditional_authenticators/X509UserResolutionAuthenticator.java	Set deny-type when user resolution fails.
packages/keycloak-extensions/conditional-authenticators/src/main/java/sequent/keycloak/conditional_authenticators/X509CertClassifierAuthenticator.java	Record cert details + deny-type when cert missing/unparseable.
packages/keycloak-extensions/conditional-authenticators/src/main/java/sequent/keycloak/conditional_authenticators/ConditionalAuthNoteAuthenticatorFactory.java	Add regex matching config option.
packages/keycloak-extensions/conditional-authenticators/src/main/java/sequent/keycloak/conditional_authenticators/ConditionalAuthNoteAuthenticator.java	Implement regex matching with syntax error handling.
packages/harvest/src/routes/realm_attributes.rs	New route to update Keycloak realm attributes (authorized).
packages/harvest/src/routes/mod.rs	Register new routes (CA export + realm attributes).
packages/harvest/src/routes/import_certificate_authority.rs	Log CA imports to electoral log; policy rename.
packages/harvest/src/routes/get_certificate_authorities_pem.rs	Use transaction for PEM bundle retrieval.
packages/harvest/src/routes/export_certificate_authority.rs	New route/action to trigger CA bundle export task.
packages/harvest/src/routes/delete_certificate_authority.rs	Bulk delete CAs + electoral log events + return deleted_count.
packages/harvest/src/main.rs	Mount new routes.
packages/graphql.schema.json	Workspace schema snapshot updates for new/changed actions/types.
packages/electoral-log/src/messages/statement.rs	Add statement type/body for CA import/delete events.
packages/electoral-log/src/messages/newtypes.rs	Add newtypes for CA event action + subject DN list.
packages/electoral-log/src/messages/message.rs	Add message builder for CA events.
packages/ballot-verifier/src/gql/graphql.ts	Update generated GraphQL types for new/changed actions/types.
packages/ballot-verifier/graphql.schema.json	Schema snapshot updates for new/changed actions/types.
packages/admin-portal/src/types/tasksExecution.ts	Add task enum value for CA export.
packages/admin-portal/src/translations/tl.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/nl.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/gl.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/fr.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/eu.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/es.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/en.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/translations/cat.ts	Add CA export/UI strings + policy key rename.
packages/admin-portal/src/resources/ElectionEvent/ElectionEventTabs.tsx	Show CA tab based on renamed policy.
packages/admin-portal/src/resources/ElectionEvent/EditElectionEventDataForm.tsx	Add realm attribute update mutation + policy rename.
packages/admin-portal/src/resources/ElectionEvent/EditElectionEventCAs.tsx	Add CA export (single/bulk/all) UI + bulk delete UI.
packages/admin-portal/src/queries/UpdateRealmAttributes.ts	New GraphQL mutation for realm attributes action.
packages/admin-portal/src/queries/ExportCertificateAuthority.ts	New GraphQL mutation for CA export action.
packages/admin-portal/src/queries/DeleteCertificateAuthority.ts	Update delete mutation to accept ids and return count.
packages/admin-portal/src/gql/graphql.ts	Update generated GraphQL types for new/changed actions/types.
packages/admin-portal/src/gql/gql.ts	Update typed documents registry for new/changed mutations.
packages/admin-portal/src/components/election-event/export-data/ExportElectionEventDrawer.tsx	Add “Certificates” checkbox and pass include_certificates.
packages/admin-portal/graphql.schema.json	Schema snapshot updates for new/changed actions/types.
hasura/metadata/actions.yaml	Add Hasura actions: update_realm_attributes + export_certificate_authority.
hasura/metadata/actions.graphql	Add action definitions + update CA delete + export options.
docs/docusaurus/docs/07-developers/10-tutorials/08-x509-adding-ca-certificates.md	Update CA import instructions + permissions.
docs/docusaurus/docs/07-developers/10-tutorials/07-x509-voter-certificate-authentication.md	Update X.509 login docs (remove mtls button references).
docs/docusaurus/docs/07-developers/06-keycloak/x509_client_cert_architecture.md	Document new IDP-based certificate login approach.
docs/docusaurus/docs/07-developers/06-keycloak/x509_cert_login_events.md	New doc describing cert-login electoral log events.
.devcontainer/keycloak-nginx/keycloak-mtls.conf.template	Remove restart redirect/error_page mtls button logic.
.devcontainer/docker-compose.yml	Remove KC_MTLS_LOGIN_URL from env.
.devcontainer/docker-compose-remote.yml	Remove KC_MTLS_LOGIN_URL from env.
.devcontainer/devcontainer.json	Remove proto3 extension from recommended list.
.devcontainer/.env.development	Remove KC_MTLS_LOGIN_URL documentation/config.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-04-20T10:10:04Z

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-04-21 17:29 UTC

(cherry picked from commit 53a8379)

(cherry picked from commit 2784ad4)

(cherry picked from commit 535ad18)

…EventCAs.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 110 out of 113 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-21T10:28:27Z

+        <#assign visibleProviders = social.providers?filter(p -> p.alias != 'digital-certificates' || (realm.attributes['voter-certificate-policy']!'disabled') == 'enabled')>
+        <#if realm.password && visibleProviders?has_content>
            <div id="kc-social-providers" class="${properties.kcFormSocialAccountSectionClass!}">
-                <hr/>
-                <h4>${msg("identity-provider-login-label")}</h4>
-
-                <ul class="${properties.kcFormSocialAccountListClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountListGridClass!}</#if>">
-                    <#list social.providers as p>
+                <#list visibleProviders as p>
+                    <hr/>
+                    <h4>${msg("identity-provider-login-label")}</h4>
+                    <ul class="${properties.kcFormSocialAccountListClass!} <#if visibleProviders?size gt 3>${properties.kcFormSocialAccountListGridClass!}</#if>">


social.providers is used with ?filter without checking it exists (previous template guarded with social.providers??). If Keycloak renders this section with no social providers, this can throw a FreeMarker error and break the login page. Also, the <hr/>, <h4>, and <ul> are inside the #list, so they will be duplicated for each provider; the heading/list wrapper should be rendered once around all <li> entries.

xalsina-sequent · 2026-04-21T10:25:14Z

Please review this changes are not from another version.

…n Event (#2587) Parent issue: sequentech/meta#11110 --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

BelSequent added 30 commits March 30, 2026 10:30

Button gate by realm attribute

ef55b1d

Button gate by policy based on realm attribute.

5e6130e

template for IDP fix

0668861

Update attribute on save

6c7e335

Import/export event with CAs

d663a1f

Description for CERTIFICATES tab

d15c000

Fix Import IDP's client secret

80e3c39

keycloak login events - wip

45697e5

import and delete certificate events

4531455

Format

fc67104

Logn events inprovements

0863642

Events doc

5ce7cae

remove deprectated extension

0a718c5

Merge remote-tracking branch 'origin/main' into feat/meta-11110-pendi…

c074a65

…ng/main

wip

0b4881d

Do secret generation only for special IDP

63ccd2b

Shorten description in KC events

48b5c22

Fix

9a6f780

Export button - wip

2998c47

Fix delete certs on selection.

765c1a0

wip

542f546

update.graphql

a84c884

Update default event creation

7b8f9bc

wip

c357b43

wip

483bb5b

Flow error cases

6014617

clean up

5e18e1f

Format

abadb6a

Update docs and move java const

4234681

doc update

5e7b93b

BelSequent added 2 commits April 13, 2026 10:32

Voter login - Figma styles and lang

93056f9

login error styles

109699c

Copilot AI review requested due to automatic review settings April 20, 2026 10:02

Copilot started reviewing on behalf of BelSequent April 20, 2026 10:03 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

BelSequent and others added 7 commits April 20, 2026 12:10

Improve UX when selecting certs to delete/export

48fb0f2

Improves error when no matching CN

e2e11f1

(cherry picked from commit 53a8379)

Fix user disabled case

e540376

(cherry picked from commit 2784ad4)

Fix log Event details

4b9bf51

(cherry picked from commit 535ad18)

Fix

cb1ffe0

Update packages/admin-portal/src/resources/ElectionEvent/EditElection…

9dd8556

…EventCAs.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into feat/meta-11110-restore-event-level/main

ddecddb

BelSequent mentioned this pull request Apr 20, 2026

✨ Keycloak: Configuration to support multiple certificates in Election Event #2570

Closed

BelSequent added 6 commits April 20, 2026 13:51

Format

7a8a2d2

Documentation

fe6b268

Docusaurus: Fix broken links.

c7e9a2b

Review: add const str

e56bc61

Improvements

10df74c

Format

96ac92a

xalsina-sequent requested a review from Copilot April 21, 2026 10:22

Copilot started reviewing on behalf of xalsina-sequent April 21, 2026 10:23 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

BelSequent added 2 commits April 21, 2026 11:22

Improve buttons separator - UX

98e97a9

Fix

0ee8a4a

xalsina-sequent approved these changes Apr 21, 2026

View reviewed changes

xalsina-sequent merged commit 707f8db into main Apr 21, 2026
20 checks passed

xalsina-sequent deleted the feat/meta-11110-restore-event-level/main branch April 21, 2026 17:21

Findeton pushed a commit that referenced this pull request Apr 22, 2026

✨ Keycloak: Configuration to support multiple certificates in Electio…

bfa5ddd

…n Event (#2587) Parent issue: sequentech/meta#11110 --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Findeton pushed a commit that referenced this pull request Apr 30, 2026

✨ Keycloak: Configuration to support multiple certificates in Electio…

25fd60a

…n Event (#2587) Parent issue: sequentech/meta#11110 --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Keycloak: Configuration to support multiple certificates in Election Event#2587

✨ Keycloak: Configuration to support multiple certificates in Election Event#2587
xalsina-sequent merged 49 commits into
mainfrom
feat/meta-11110-restore-event-level/main

BelSequent commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 21, 2026

Uh oh!

xalsina-sequent Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

BelSequent commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

xalsina-sequent Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Apr 20, 2026 •

edited

Loading