Add IdP configuration to disable forwarding of the acr_values parameter

Closes keycloak#39813

Signed-off-by: Johannes Knutsen <johannes@kodet.no>

Author: knutz3n

js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties

@@ -1450,6 +1450,8 @@ byConfiguration=By configuration
 usersAdded_other={{count}} users added to the group
 userFedUnlinkUsersConfirmTitle=Unlink all users?
 passCurrentLocale=Pass current locale
+passAcrValues=Pass acr_values
+passAcrValuesHelp=Pass the current acr_values query parameter on to the identity provider.
 realmNameField=Realm name
 roleCreated=Role created
 socialProfileJSONFieldPath=Social Profile JSON Field Path

js/apps/admin-ui/src/identity-providers/add/ExtendedNonDiscoverySettings.tsx

@@ -42,6 +42,7 @@ export const ExtendedNonDiscoverySettings = () => {
         <SwitchField label="passLoginHint" field="config.loginHint" />
         <SwitchField label="passMaxAge" field="config.passMaxAge" />
         <SwitchField label="passCurrentLocale" field="config.uiLocales" />
+        <SwitchField label="passAcrValues" field="config.forwardAcrValues" />
         <SwitchField
           field="config.backchannelSupported"
           label="backchannelLogout"

services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java

@@ -359,9 +359,11 @@ protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
             uriBuilder.queryParam(OAuth2Constants.PROMPT, prompt);
         }
 
-        String acr = request.getAuthenticationSession().getClientNote(OAuth2Constants.ACR_VALUES);
-        if (acr != null) {
-            uriBuilder.queryParam(OAuth2Constants.ACR_VALUES, acr);
+        if (getConfig().isForwardAcrValues()) {
+            String acr = request.getAuthenticationSession().getClientNote(OAuth2Constants.ACR_VALUES);
+            if (acr != null) {
+                uriBuilder.queryParam(OAuth2Constants.ACR_VALUES, acr);
+            }
         }
         String forwardParameterConfig = getConfig().getForwardParameters() != null ? getConfig().getForwardParameters(): "";
         List<String> forwardParameters = Arrays.asList(forwardParameterConfig.split("\\s*,\\s*"));

services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java

@@ -36,6 +36,7 @@ public class OAuth2IdentityProviderConfig extends IdentityProviderModel {
     public static final String PKCE_METHOD = "pkceMethod";
     public static final String TOKEN_ENDPOINT_URL = "tokenUrl";
     public static final String TOKEN_INTROSPECTION_URL = "tokenIntrospectionUrl";
+    public static final String FORWARD_ACR_VALUES = "forwardAcrValues";
 
     public static final String JWT_X509_HEADERS_ENABLED = "jwtX509HeadersEnabled";
 
@@ -143,6 +144,14 @@ public void setForwardParameters(String forwardParameters) {
        getConfig().put("forwardParameters", forwardParameters);
     }
 
+    public boolean isForwardAcrValues() {
+        return Boolean.parseBoolean(getConfig().getOrDefault(FORWARD_ACR_VALUES, "false"));
+    }
+
+    public void setForwardAcrValues(boolean forwardAcrValues) {
+        getConfig().put(FORWARD_ACR_VALUES, String.valueOf(forwardAcrValues));
+    }
+
     public boolean isPkceEnabled() {
         return Boolean.parseBoolean(getConfig().getOrDefault(PKCE_ENABLED, "false"));
     }

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerAcrParameterTest.java

@@ -1,6 +1,9 @@
 package org.keycloak.testsuite.broker;
 
+import org.junit.Test;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
 import org.keycloak.admin.client.resource.UsersResource;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.Assert;
 
@@ -18,8 +21,29 @@ protected BrokerConfiguration getBrokerConfiguration() {
         return KcOidcBrokerConfiguration.INSTANCE;
     }
 
+    @Test
+    public void testLogInAsUserInIDPWithAcrValues() {
+        // Forward acr_values = true
+        IdentityProviderResource idpRes = adminClient
+                .realm(bc.consumerRealmName())
+                .identityProviders()
+                .get(BrokerTestConstants.IDP_OIDC_ALIAS);
+        IdentityProviderRepresentation idpRep = idpRes.toRepresentation();
+        OIDCIdentityProviderConfigRep cfg = new OIDCIdentityProviderConfigRep(idpRep);
+        cfg.setForwardAcrValues(true);
+        idpRes.update(idpRep);
+
+        assertValidLogin(true);
+
+        testSingleLogout();
+    }
+
     @Override
     protected void loginUser() {
+        assertValidLogin(false);
+    }
+
+    private void assertValidLogin(boolean expectHasAcrValues) {
         oauth.clientId("broker-app");
         loginPage.open(bc.consumerRealmName());
 
@@ -33,8 +57,13 @@ protected void loginUser() {
         Assert.assertTrue("Driver should be on the provider realm page right now",
                 driver.getCurrentUrl().contains("/auth/realms/" + bc.providerRealmName() + "/"));
 
-        Assert.assertTrue(ACR_VALUES + "=" + ACR_3 + " should be part of the url",
-                driver.getCurrentUrl().contains(ACR_VALUES + "=" + ACR_3));
+        if (expectHasAcrValues) {
+            Assert.assertTrue(ACR_VALUES + "=" + ACR_3 + " SHOULD be part of the url",
+                    driver.getCurrentUrl().contains(ACR_VALUES + "=" + ACR_3));
+        } else {
+            Assert.assertFalse(ACR_VALUES + "=" + ACR_3 + " SHOULD NOT be part of the url",
+                    driver.getCurrentUrl().contains(ACR_VALUES + "=" + ACR_3));
+        }
 
         log.debug("Logging in");
         loginPage.login(bc.getUserLogin(), bc.getUserPassword());