Harden CIMD URI trust validation (SSRF) and fix case-insensitive domain matching

[Copilot]

Description

This PR tightens ISSUE-45284 CIMD validation in two dimensions: it fixes non-security correctness bugs in trusted-domain matching and restores SSRF-relevant host validation for metadata URIs. It also reviews session swap/hijack risk in the touched flow and keeps existing auth-session behavior unchanged.

• Non-security correctness fixes

  • Trusted-domain checks are now case-insensitive (hostname + configured domain normalized with Locale.ROOT).
  • verifyUri(...) now handles null URI strings explicitly and returns malformed-URL validation errors consistently.

• Security hardening (SSRF)

  • CIMD URI validation now resolves hostnames and rejects internal/private targets (anyLocal, loopback, siteLocal, linkLocal) when strict scheme policy is in effect.
  • Host resolution failures are mapped to ERR_HOST_UNRESOLVED early, preventing ambiguous acceptance paths.

• Session swapping / hijacking review

  • Reviewed the CIMD request/metadata validation path for session-binding weaknesses.
  • No direct session swap/hijack defect was identified in this scope; no behavioral/session-model changes introduced.

• Representative change

  if (!getConfiguration().isAllowHttpScheme() && isInternalAddress(uri.getHost())) {
      throw invalidClientIdMetadata(ERR_NOTALLOWED_DOMAIN);
  }
  
  protected boolean checkTrustedDomain(String hostname, String trustedDomain) {
      String normalizedHostname = hostname.toLowerCase(Locale.ROOT);
      String normalizedTrustedDomain = trustedDomain.toLowerCase(Locale.ROOT);
      ...
  }

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• repo.gradle.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher -pl services -DskipTests compile -q (dns block)
• repository.jboss.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher -pl services -DskipTests compile -q (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher -pl services -am -DskipTests compile -q (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher -pl testsuite/integration-arquillian/tests/base -am -Dtest=ClientIdMetadataDocumentTest test -q (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.