From: "Lohitha Chiranjeewa" <kalc04(a)gmail.com&gt; To: "keycloak-user" <keycloak-user(a)lists.jboss.org&gt; Sent: Friday, 24 July, 2015 1:56:10 PM Subject: [keycloak-user] Users able to retrieve a valid Access Token despite not verifying their email Hi, We have identified that even if the user hasn't verified his email (he cannot log in until it's verified), he can still invoke the 'auth/realms/{realm} /tokens /grants/access' API and retrieve a valid Access Token. APIs can be successfully invoked through this Access Token. This seems to be a buggy scenario. Can anyone confirm if this is actually a bug or if this is the expected behavior? Regards, Lohitha. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

From: "Bill Burke" <bburke(a)redhat.com&gt; To: keycloak-user(a)lists.jboss.org Sent: Friday, 24 July, 2015 3:41:51 PM Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token despite not verifying their email So, setting a verify email required action allows you to replicate the problem? What version of Keycloak are you using? Just looking at the code from 1.3 and master we don't allow the creation of a token if a required action is active.

On 7/24/2015 9:34 AM, Stian Thorgersen wrote: > That's indeed a bug - can you create a jira please? > > ----- Original Message ----- >> From: "Lohitha Chiranjeewa" <kalc04(a)gmail.com&gt; >> To: "keycloak-user" <keycloak-user(a)lists.jboss.org&gt; >> Sent: Friday, 24 July, 2015 1:56:10 PM >> Subject: [keycloak-user] Users able to retrieve a valid Access Token >> despite not verifying their email >> >> Hi, >> >> We have identified that even if the user hasn't verified his email (he >> cannot >> log in until it's verified), he can still invoke the 'auth/realms/{realm} >> /tokens /grants/access' API and retrieve a valid Access Token. APIs can be >> successfully invoked through this Access Token. This seems to be a buggy >> scenario. >> >> Can anyone confirm if this is actually a bug or if this is the expected >> behavior? >> >> >> Regards, >> Lohitha. >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

On 7/24/2015 9:59 AM, Stian Thorgersen wrote: > > > ----- Original Message ----- >> From: "Bill Burke" <bburke(a)redhat.com&gt; >> To: keycloak-user(a)lists.jboss.org >> Sent: Friday, 24 July, 2015 3:41:51 PM >> Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token despite not verifying their email >> >> So, setting a verify email required action allows you to replicate the >> problem? >> >> What version of Keycloak are you using? Just looking at the code from >> 1.3 and master we don't allow the creation of a token if a required >> action is active. > > The problem is that when a user logs in we check if verify email is required by the realm, if it is and user hasn't verified email we add the required action. We don't do this check in the direct grants api. > This check might be gone entirely now.

From: "Stian Thorgersen" <stian(a)redhat.com&gt; To: "Bill Burke" <bburke(a)redhat.com&gt; Cc: keycloak-user(a)lists.jboss.org Sent: Friday, 24 July, 2015 4:10:44 PM Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token despite not verifying their email Was just looking at it and can't find anything that would check it, but RequiredActionEmailVerificationTest which is supposed to test it is passing ----- Original Message ----- > From: "Bill Burke" <bburke(a)redhat.com&gt; > To: "Stian Thorgersen" <stian(a)redhat.com&gt; > Cc: keycloak-user(a)lists.jboss.org > Sent: Friday, 24 July, 2015 4:08:06 PM > Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token > despite not verifying their email > > > > On 7/24/2015 9:59 AM, Stian Thorgersen wrote: > > > > > > ----- Original Message ----- > >> From: "Bill Burke" <bburke(a)redhat.com&gt; > >> To: keycloak-user(a)lists.jboss.org > >> Sent: Friday, 24 July, 2015 3:41:51 PM > >> Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token > >> despite not verifying their email > >> > >> So, setting a verify email required action allows you to replicate the > >> problem? > >> > >> What version of Keycloak are you using? Just looking at the code from > >> 1.3 and master we don't allow the creation of a token if a required > >> action is active. > > > > The problem is that when a user logs in we check if verify email is > > required by the realm, if it is and user hasn't verified email we add the > > required action. We don't do this check in the direct grants api. > > > > This check might be gone entirely now. > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

From: "Bill Burke" <bburke(a)redhat.com&gt; To: "Stian Thorgersen" <stian(a)redhat.com&gt; Cc: keycloak-user(a)lists.jboss.org Sent: Saturday, 25 July, 2015 6:46:36 PM Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token despite not verifying their email On 7/24/2015 10:15 AM, Stian Thorgersen wrote: > Tried it manually and it's not working. Users don't have to verify email in > master. > Ok, I added a test and it is passing. Can you verify I'm doing the right checks? If I'm testing this right, I'll close the bug. ResourceOwnerPasswordCredentialsGrantTest.grantAccessTokenVerifyEmail() > One relevant question if "direct grant" flow has OTP set to optional and > user has enabled otp with its account what happens? > If the user has OTP set up, then direct grant flow will expect it. If it is not there, it will send an error message. BruteForceTest.testGrantMissingOtp() tests this. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com

The test only checks if new users have to verify email, not that existing users have to verify email. Added https://issues.jboss.org/browse/KEYCLOAK-1696 ----- Original Message ----- > From: "Stian Thorgersen" <stian(a)redhat.com&gt; > To: "Bill Burke" <bburke(a)redhat.com&gt; > Cc: keycloak-user(a)lists.jboss.org > Sent: Friday, 24 July, 2015 4:10:44 PM > Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token despite not verifying their email > > Was just looking at it and can't find anything that would check it, but > RequiredActionEmailVerificationTest which is supposed to test it is passing > > ----- Original Message ----- > > From: "Bill Burke" <bburke(a)redhat.com&gt; > > To: "Stian Thorgersen" <stian(a)redhat.com&gt; > > Cc: keycloak-user(a)lists.jboss.org > > Sent: Friday, 24 July, 2015 4:08:06 PM > > Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token > > despite not verifying their email > > > > > > > > On 7/24/2015 9:59 AM, Stian Thorgersen wrote: > > > > > > > > > ----- Original Message ----- > > >> From: "Bill Burke" <bburke(a)redhat.com&gt; > > >> To: keycloak-user(a)lists.jboss.org > > >> Sent: Friday, 24 July, 2015 3:41:51 PM > > >> Subject: Re: [keycloak-user] Users able to retrieve a valid Access Token > > >> despite not verifying their email > > >> > > >> So, setting a verify email required action allows you to replicate the > > >> problem? > > >> > > >> What version of Keycloak are you using? Just looking at the code from > > >> 1.3 and master we don't allow the creation of a token if a required > > >> action is active. > > > > > > The problem is that when a user logs in we check if verify email is > > > required by the realm, if it is and user hasn't verified email we add the > > > required action. We don't do this check in the direct grants api. > > > > > > > This check might be gone entirely now. > > > > -- > > Bill Burke > > JBoss, a division of Red Hat > > http://bill.burkecentral.com > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user