Skip to content

Fix UAA start with legacy key setup #3837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
strehle merged 2 commits into from
Apr 14, 2026
Merged

Fix UAA start with legacy key setup #3837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e783cf
Fix UAA start with legacy key setup
strehle Apr 14, 2026
8754a41
add tests
strehle Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...in/java/org/cloudfoundry/identity/uaa/zone/GeneralIdentityZoneConfigurationValidator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ public IdentityZoneConfiguration validate(IdentityZone zone, IdentityZoneValidat
}
}
}
if (UaaStringUtils.isNotEmpty(config.getIssuer()) && (tokenPolicy == null || UaaStringUtils.isNullOrEmpty(tokenPolicy.getActiveKeyId()))) {
if (!zone.isUaa() && UaaStringUtils.isNotEmpty(config.getIssuer()) && (tokenPolicy == null || UaaStringUtils.isNullOrEmpty(tokenPolicy.getActiveKeyId()))) {
throw new InvalidIdentityZoneConfigurationException("You cannot set issuer value unless you have set your own signing key for this identity zone.");
}
Comment thread
strehle marked this conversation as resolved.

Expand Down
37 changes: 37 additions & 0 deletions ...va/org/cloudfoundry/identity/uaa/zone/GeneralIdentityZoneConfigurationValidatorTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,6 +316,43 @@ void validate_isser_no_keys(IdentityZoneValidator.Mode mode) {
.hasMessageContaining("You cannot set issuer value unless you have set your own signing key for this identity zone.");
}

// Tests for: if (!zone.isUaa() && isNotEmpty(issuer) && (tokenPolicy == null || isNullOrEmpty(activeKeyId)))
@MethodSource("parameters")
@ParameterizedTest
void validate_nonUaaZone_withIssuer_andNoTokenPolicy_throwsException(IdentityZoneValidator.Mode mode) {
// non-UAA zone with issuer set but no token policy -> should fail
zone.setId("custom-zone");
zone.getConfig().setIssuer("http://custom.example.com/issuer");
zone.getConfig().setTokenPolicy(null);
assertThatThrownBy(() -> validator.validate(zone, mode))
.isInstanceOf(InvalidIdentityZoneConfigurationException.class)
.hasMessageContaining("You cannot set issuer value unless you have set your own signing key for this identity zone.");
}

@MethodSource("parameters")
@ParameterizedTest
void validate_nonUaaZone_withoutIssuer_andNoActiveKey_succeeds(IdentityZoneValidator.Mode mode) throws InvalidIdentityZoneConfigurationException {
// non-UAA zone without issuer -> condition not triggered, should pass
zone.setId("custom-zone");
zone.getConfig().setIssuer("http://localhost:8080/uaa");
zone.getConfig().setTokenPolicy(null);
// validate should not throw
assertThatThrownBy(() -> validator.validate(zone, mode))
.isInstanceOf(InvalidIdentityZoneConfigurationException.class)
.hasMessageContaining("You cannot set issuer value unless you have set your own signing key for this identity zone.");
Comment thread
strehle marked this conversation as resolved.
Comment thread
strehle marked this conversation as resolved.
}

@MethodSource("parameters")
@ParameterizedTest
void validate_uaaZone_withIssuer_andNoActiveKey_succeeds(IdentityZoneValidator.Mode mode) throws InvalidIdentityZoneConfigurationException {
// UAA zone is exempt from the issuer check -> should pass even without an active key
zone.setId(IdentityZone.getUaaZoneId());
zone.getConfig().setIssuer("http://uaa.example.com/issuer");
zone.getConfig().setTokenPolicy(null);
// validate should not throw
validator.validate(zone, mode);
}

@MethodSource("parameters")
@ParameterizedTest
void validate_invalid_corsPolicy_xhrConfiguration_allowedUris(IdentityZoneValidator.Mode mode) {
Expand Down
Loading