Uh oh!
There was an error while loading. Please reload this page.
✨ Close the login/register template feature gap in Keycloak theme - #2930
Closed
xalsina-sequent wants to merge 1 commit into
Closed
✨ Close the login/register template feature gap in Keycloak theme#2930xalsina-sequent wants to merge 1 commit into
xalsina-sequent wants to merge 1 commit into
Conversation
Shares User Profile-driven rendering between register.ftl and both portals'
login.ftl instead of MultiAttributePasswordAuthenticator building its own
{name,type} field list: a new LoginBean (mirroring Keycloak's RegisterBean)
exposes profile.attributesByName to login.ftl, which now renders matchAttributes
fields through the same user-profile-commons.ftl macros register.ftl uses -
picking up field types, helper text, select filtering and tel-input handling
for free.
Extracts the duplication this surfaced into shared macros in
sequent.admin-portal/login/: field-helper-text.ftl, tel-input-widget.ftl,
select-filter-widget.ftl and social-providers.ftl (now used by register.ftl
and both login.ftl copies). Removes a dead "mobile" special case in
register.ftl (no realm ever configured that attribute).
Adds an opt-in honorUserProfileRequired config to MultiAttributePasswordAuthenticator:
when enabled, a matchAttributes field's required-ness (asterisk, HTML5
required, and whether it's optional for matching) follows the realm's User
Profile required setting for that attribute instead of every configured
attribute being unconditionally mandatory. The optional-attribute filtering
lives entirely in the authenticator (effectiveMatchAttributes), keeping
MultiAttributeCredentialResolver - shared with the IVR direct grant flow -
unchanged.
Parent issue: sequentech/meta#12713
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
xalsina-sequent
marked this pull request as draft
August 20, 2026 15:09
Findeton added a commit
that referenced
this pull request
Aug 23, 2026
Parent issue: sequentech/meta#12713 `main` counterpart of #2930 (`release/10.0`), cherry-picked from `abbfa30bc7`. `register.ftl` and `login.ftl` (both `sequent.admin-portal` and `sequent.voting-portal` themes) had drifted apart: `MultiAttributePasswordAuthenticator`'s `login.ftl` rendered its `matchAttributes` fields from a bespoke `{name,type}` list built in Java, so it was missing field-specific input types, User Profile helper text, select filtering, and the shared tel-input widget that `register.ftl` already had - plus every configured attribute was unconditionally mandatory to match, with no way to make some optional. ## Changes - Added `LoginBean` (mirrors Keycloak's own `RegisterBean`), exposing `profile.attributesByName` to `login.ftl` so its `matchAttributes` loop renders through the same `user-profile-commons.ftl` macros `register.ftl` uses - same field types, helper text, select filtering, tel-input handling. - Extracted the duplication this surfaced into shared macros under `sequent.admin-portal/login/`: `field-helper-text.ftl`, `tel-input-widget.ftl`, `select-filter-widget.ftl`, `social-providers.ftl` - now shared by `register.ftl` and both portals' `login.ftl`. - Removed a dead `mobile`-attribute special case in `register.ftl` (no realm ever configures a User Profile attribute literally named `mobile`). - Added an opt-in `honorUserProfileRequired` config property on `MultiAttributePasswordAuthenticator`: when enabled, a `matchAttributes` field's required-ness (asterisk, HTML5 `required`, and whether it's optional for matching) follows the realm's User Profile `required` setting for that attribute, instead of every configured attribute being unconditionally mandatory. Disabled by default, so existing realms are unaffected. The optional-attribute filtering lives entirely in the authenticator (`effectiveMatchAttributes`), so `MultiAttributeCredentialResolver` - shared with the IVR direct grant flow - is unchanged. ## Documentation Not in #2930 - added here: - New reference page **Configuring Login and Registration Fields** documenting how User Profile attributes and their annotations drive both the registration form and the attribute-based login form (input types, labels/translations, helper text, field limits, option lists and dependent dropdowns, phone-number fields, required-ness, hiding, login-hint prefilling). - Cross-linked from *Adding User Attributes to Keycloak* and *Logging In Without a Username*, and documented the new **Honor User Profile required attributes** setting in the latter's config steps. ## Conflict resolution vs #2930 `main` has moved on since `abbfa30bc7`. Resolved while cherry-picking: - `buildAttributeFields` (and its `inputTypeMax` → `max` forwarding, added on `main` by #3000) is deleted, as in #2930 - the `max` attribute and its `9999-12-31` default now come from `user-profile-commons.ftl`'s shared `inputTag` macro, which both forms go through. - Kept `TemplateSyntaxTest#multiAttributeDateInputsHonorConfiguredMaxInBothPortals` from #3000, rewritten against the new `profile.attributesByName` model so the four-digit-year regression stays covered on both portals. Its `renderLogin(portal, model)` helper is kept alongside #2930's new `profileWithAttributes` / `mockAttribute` helpers. - Dropped the four `buildAttributeFields_*` unit tests, whose subject no longer exists; the behaviour they covered is now asserted at the template level. ## Testing `mvn -pl sequent-theme test` - 28 tests pass. `message-otp-authenticator` tests were not run locally (its `action-token-login-bridge` dependency fails to build under JDK 21; this reproduces on a clean `main` and is unrelated to this change) - CI covers them on JDK 17. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Login and registration forms support configurable credential placement, validation modes, field types, labels, helper text, dropdowns, date inputs, and localized phone widgets. - Multi-attribute login can optionally follow profile-defined required fields. - Social sign-in providers display consistently, with policy-based digital certificate visibility. - Phone fields provide improved formatting and timezone-based country detection. - **Bug Fixes** - Improved focus behavior, autocomplete, accessibility, required-field handling, annotation support, fallback fields, and form layout. - **Documentation** - Expanded guidance for profile fields, annotations, requiredness, multi-attribute login, and certificate-login provider visibility. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Félix Robles <felix@sequentech.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MultiAttributePasswordAuthenticator'slogin.ftlfields now render through the same User Profile-driven macrosregister.ftluses (a newLoginBean, mirroring Keycloak's ownRegisterBean, exposesprofile.attributesByName), instead of a bespoke{name,type}field list - closing the gap wherelogin.ftldidn't show field-specific input types, helper text, select filtering, or the shared tel-input widget.sequent.admin-portal/login/:field-helper-text.ftl,tel-input-widget.ftl,select-filter-widget.ftl,social-providers.ftl- now used byregister.ftland bothsequent.admin-portal/sequent.voting-portallogin.ftlcopies.mobile-attribute special case inregister.ftl(no realm ever configures a User Profile attribute literally namedmobile).honorUserProfileRequiredconfig property onMultiAttributePasswordAuthenticator: when enabled, amatchAttributesfield's required-ness (asterisk, HTML5required, and whether it's optional for matching) follows the realm's User Profilerequiredsetting for that attribute, instead of every configured attribute being unconditionally mandatory. Disabled by default - no behavior change for existing realms.effectiveMatchAttributes) lives entirely in the authenticator, soMultiAttributeCredentialResolver- shared with the IVR direct grant flow - is untouched.Test plan
mvn -pl sequent-theme,message-otp-authenticator clean test- 134 tests passing (including new coverage forhonorUserProfileRequired's required/optional matching and rendering, and the shared macros)mvn -pl sequent-theme,message-otp-authenticator spotless:check- cleanlogin.ftlrenders correctly for both portals with a realm configuringmatchAttributes(date/select/tel field types, helper text)honorUserProfileRequiredon a test realm and confirm optional attributes can be left blank while still matchingParent issue: https://github.com/sequentech/meta/issues/12713
🤖 Generated with Claude Code