Release 1.16.0

chore(deps): compile against Keycloak 26.7.4 (#18)

* chore(deps): compile against Keycloak 26.7.4

Supersedes #15, which bumped the same property to 26.7.0.

Part of closing CVE-2026-18963 (critical, unauthenticated account takeover via
the reset-credentials flow). The actual fix is the server image in tz-keycloak —
every org.keycloak artifact here is provided-scope, so this bump changes only
the compile target, not what runs. See tz-keycloak#43.

26.7.4 rather than 26.7.0: the 26.6.x image line ends at 26.6.4 (26.6.6 was
never published as a container image), so the server has to move to 26.7.x
regardless, and 26.7.4 is the current patch.

Builds clean, 83/83 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(release): 1.16.0

The jar is materially different from 1.15.0 even though no source changed —
it is now compiled against Keycloak 26.7.4 rather than 26.6.4 — so it needs
its own version. Pushing this to main cuts the 1.16.0 release the tz-keycloak
Dockerfile consumes.

Builds clean, 83/83 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Release 1.15.0

feat(auth,mapper): honor home.idp.discovery.matchSubdomains in the do…

Release 1.14.0

feat(mapper): email-domain-guard — update-path email domain guard (#14)

* feat(mapper): email-domain-guard update-path email guard

Adds email-domain-guard-idp-mapper, a broker-time guard that stops an
already-linked identity provider from rewriting an account's email onto a
domain it is not authoritative for.

Companion to idp-asserted-domain-matches (#13): that condition guards the
first-broker-login create/link path; this mapper guards the *update* path,
which no authentication flow runs on. A returning brokered login (existing
(idp, brokerUserId) link) skips first-broker-login entirely — Keycloak calls
updateBrokeredUser and, under FORCE sync, rewrites email + re-derives
emailVerified from the provider's trustEmail, with no flow to intercept.

preprocessFederatedIdentity runs in IdentityBrokerService.authenticated
before that write. When a federated link already exists (update path only)
and the provider has domains configured, an out-of-domain asserted email is
nulled — Keycloak's updateEmail early-returns on a null email, so the account
keeps its existing verified address. First broker login and domain-less
providers pass through untouched (the auth flow owns the former; the latter
has no basis to judge domain membership).

Runs on all providers (reads the normalized context email + provider domain
list, neither protocol-specific). Suppression decision extracted to a pure
shouldSuppressEmail() and unit-tested; domain matching reuses EmailDomainMatcher.
Bumps version to 1.14.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* perf(mapper): gate update-path link lookup behind the domain check

preprocessFederatedIdentity runs on every brokered login. Move the cheap
in-memory domain parse + match ahead of the getUserByFederatedIdentity DB
lookup, and skip the lookup entirely for the common in-domain (or no-domains)
case — only an out-of-domain email on a domains-configured provider can ever
be suppressed. No behavior change; shouldSuppressEmail stays the authoritative
decision.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(mapper): use Keycloak's "Preprocessor" display category

The mapper adjusts the brokered context via preprocessFederatedIdentity
before the user is written; it does not import an attribute. "Preprocessor"
is Keycloak's built-in category for exactly this kind of mapper (its own
Username Template mapper uses it), so the guard groups correctly in the admin
UI's mapper-type dropdown instead of appearing under "Attribute Importer".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Release 1.13.0

feat(auth): idp-asserted-domain-matches condition + always.trust veri…

Release 1.12.0

feat(auth): idp-trust-email-verifier first-broker-login authenticator…

Release 1.11.0

Release 1.11.0 — attribute-based claim mappers (#10)

* Bump version to 1.11.0

* Add attribute-based claim mappers for non-broker token paths (#9)

Two new mappers that carry IdP claims as persisted user attributes
instead of session notes, so the claims survive token paths that skip
the broker flow (impersonation, direct grant, RFC 7523 JWT
authorization grant):

- oidc-claim-to-attribute-idp-mapper: broker-time plain copy of an
  OIDC claim onto a user attribute; removes the attribute when the
  claim is absent so FORCE sync tracks the IdP's current truth.
- oidc-prefixed-attribute-mapper: token-mint-time forwarding of every
  user attribute under a prefix; single value -> scalar claim,
  multiple values -> array; json.decode parity with the IdP mapper.

Shared internals generalized rather than forked: select() is now
generic over the value type (PrefixedSessionNoteMapperHelper ->
PrefixSelectHelper) and the JSON codec is renamed to ClaimJsonCodec.
Provider IDs of the existing session-note mappers are unchanged.


Claude-Session: https://claude.ai/code/session_01DmPwgu7dhiD7BGjw2v2iUE

Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* Add SAML attribute-to-attribute mapper (#11)

SAML counterpart of oidc-claim-to-attribute-idp-mapper: copies a SAML
assertion attribute onto a persisted user attribute with the session-note
pair's json.encode semantics (multi-valued attributes as JSON arrays,
first-value-wins otherwise) and FORCE clear-on-absent.

Needed because every current tz.idp.* passthrough site is a SAML IdP —
without this mapper the attribute unification has no migration path for
existing SSO orgs.


Claude-Session: https://claude.ai/code/session_01DmPwgu7dhiD7BGjw2v2iUE

Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: jareds-assistant[bot] <294625628+jareds-assistant[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Release 1.10.0

Bump keycloak.version from 26.5.7 to 26.6.4 (#8)

* Bump keycloak.version from 26.5.7 to 26.6.4

Bumps `keycloak.version` from 26.5.7 to 26.6.4.

Updates `org.keycloak:keycloak-core` from 26.5.7 to 26.6.4
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](https://github.com/keycloak/keycloak/compare/26.5.7...26.6.4)

Updates `org.keycloak:keycloak-services` from 26.5.7 to 26.6.4
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](https://github.com/keycloak/keycloak/compare/26.5.7...26.6.4)

Updates `org.keycloak:keycloak-saml-core-public` from 26.5.7 to 26.6.4

Updates `org.keycloak:keycloak-model-jpa` from 26.5.7 to 26.6.4

---
updated-dependencies:
- dependency-name: org.keycloak:keycloak-core
  dependency-version: 26.6.4
  dependency-type: direct:production
- dependency-name: org.keycloak:keycloak-services
  dependency-version: 26.6.4
  dependency-type: direct:production
- dependency-name: org.keycloak:keycloak-saml-core-public
  dependency-version: 26.6.4
  dependency-type: direct:production
- dependency-name: org.keycloak:keycloak-model-jpa
  dependency-version: 26.6.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump project version to 1.10.0 for the KC 26.6.4 compile target

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DmPwgu7dhiD7BGjw2v2iUE

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jared Gibson <jared@gibson.run>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Release 1.9.0

Merge pull request #3 from threatzero-solutions/feat/credential-actio…

Release 1.8.0

Merge pull request #1 from threatzero-solutions/feat/prefixed-session…

Release 1.7.0

Allow boolean filters