Upgrading Versions

• An custom Keycloak event logger that replaces the default event logger is included in this release, if you wish to enable manually as part of an upgrade do the following (in the Unicorn Delivery Service realm):
  • Click on the Realm Settings > Events and add jsonlog-event-listener.
  • Remove the built in jboss-logging event listener.
  • Click Save
• The custom registration event listener was renamed from custom-registration-listener to registration-event-listener. To manually update this event listener (in the Unicorn Delivery Service realm):
  • Click on the Realm Settings > Events and add registration-event-listener.
  • Remove custom-registration-listener.
  • Click Save
• An additional scope (bare-groups) was included in the uds realm.json. To add this scope manually do the following (in the Unicorn Delivery Service realm):
  • Click on Client Scopes > Create client scope.
  • Name the scope bare-groups, and configure it to be to be
    • Type: Optional
    • Include in token scope: On
  • Click Save
  • Click Mappers > Create a new mapper
  • Select Custom Group Path Mapper and name it bare groups
  • To enable this scope to be added as a defaultClientScope for your clients, navigate to the top level Clients > Client registration tab.
    • Click Allowed Client Scopes
    • Add bare-groups to the list of Allowed Client Scopes
    • Click Save

This version upgrade utilizes built in Keycloak functionality for User Managed Attributes.

If upgrading without a full redeploy of keycloak the following changes will be needed:

1. The realm.json will need to be updated to contain the correct User Managed Attributes definition, User Managed Attributes Configuration. The following steps can be used to do this with clickops:
   1. In Realm Settings tab and on the General page
      1. toggle off User-managed access
      2. Unmanaged Attributes set to Only administrators can write
   2. On User profile page
      1. select the JSON Editor tab
      2. Copy and Paste the value of the User Attribute Definition from the realm.json
      3. Save
2. Incorporate STIG password rules, in accordance with these two hardening guides:
   • Elasticsearch 8.0 Application Server
   • Elasticsearch 8.0 Central Log Server
   • Changes:
     1. Passwords expire in 60 days
     2. Passwords complexity: 2 special characters, 1 digit, 1 lowercase, 1 uppercase, and 15 character minimum length
     3. IDP session idle timeout is now 10 minutes
     4. Maximum login attempts is now 3

If upgrading without a full redeploy of keycloak the following steps will be necessary to create and use group authorization:

1. In keycloak admin portal, in UDS realm, navigate to Authentication sidebar tab
2. In Authentication tab add the Authorization flow to UDS Authentication, UDS Registration, UDS Reset Credentials
   1. In each Authentication flow
      1. Add step -> UDS Operator Group Authentication Validation
      • Make sure that the step is at the base level and bottom of the Authentication flow
3. Finally if using SAML IDP
   1. In the Authentication tab
      1. Create Flow
      2. Name -> Authorization
      3. Description -> UDS Operator Group Authentication Validation
      4. Basic Flow
      5. Create
      6. Add execution
      7. Add the UDS Operator Group Authentication Validation
   2. In the Identity Providers tab, select the SAML Provider
      1. Add the Authorization flow to the Post login flow in the Advanced settings section