Merge the “develop” branch into “master” - 6.8 Release

.github/actions/setup-maven/action.yml

@@ -14,7 +14,7 @@ runs:
   using: composite
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         ref: ${{ inputs.git-reference }}
     - name: Determine Java version by reading the Maven property

.github/workflows/check_property_files.yml

@@ -9,7 +9,7 @@ jobs:
         name: Duplicate Keys
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: Run duplicates detection script
               shell: bash
               run: tests/check_duplicate_properties.sh
@@ -18,7 +18,7 @@ jobs:
         name: Metadata Blocks Properties
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: Setup GraalVM + Native Image
               uses: graalvm/setup-graalvm@v1
               with:

.github/workflows/codeql.yml

@@ -61,7 +61,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/container_app_pr.yml

@@ -20,7 +20,7 @@ jobs:
         if: ${{ github.repository_owner == 'IQSS' }}
         steps:
             # Checkout the pull request code as when merged
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   ref: 'refs/pull/${{ github.event.client_payload.pull_request.number }}/merge'
             - uses: actions/setup-java@v4

.github/workflows/container_maintenance.yml

@@ -173,7 +173,7 @@ jobs:
         with:
           platforms: ${{ env.PLATFORMS }}
       - name: Setup Trivy binary for vulnerability scanning
-        uses: aquasecurity/setup-trivy@v0.2.3
+        uses: aquasecurity/setup-trivy@v0.2.4
         with:
           version: v0.63.0
 
@@ -199,7 +199,7 @@ jobs:
       - configbaker-image
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       ### BASE IMAGE
       - name: Render README for base image
@@ -272,6 +272,6 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: gdcc/base
+          repository: gdcc/configbaker
           short-description: "Dataverse Config Baker Container Image providing setup tooling and more"
           readme-filepath: ./modules/container-configbaker/README.md

.github/workflows/deploy_beta_testing.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: actions/setup-java@v4
         with:
@@ -47,10 +47,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Download war artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: built-app
           path: ./

.github/workflows/guides_build_sphinx.yml

@@ -10,7 +10,7 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - id: lookup
       run: |
         echo "sphinx_version=$(grep Sphinx== ./doc/sphinx-guides/requirements.txt | tr -s "=" | cut -f 2 -d=)" | tee -a "${GITHUB_OUTPUT}"

.github/workflows/maven_cache_management.yml

@@ -32,7 +32,7 @@ jobs:
             contents: read
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
             - name: Determine Java version from Parent POM
               run: echo "JAVA_VERSION=$(grep '<target.java.version>' modules/dataverse-parent/pom.xml | cut -f2 -d'>' | cut -f1 -d'<')" >> ${GITHUB_ENV}
             - name: Set up JDK ${{ env.JAVA_VERSION }}
@@ -80,7 +80,7 @@ jobs:
             contents: read
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
             - name: Cleanup caches
               run: |
                   gh extension install actions/gh-actions-cache

.github/workflows/maven_unit_test.yml

@@ -37,7 +37,7 @@ jobs:
         steps:
           # TODO: As part of #10618 change to setup-maven custom action
           # Basic setup chores
-          - uses: actions/checkout@v4
+          - uses: actions/checkout@v5
           - name: Set up JDK ${{ matrix.jdk }}
             uses: actions/setup-java@v4
             with:
@@ -103,7 +103,7 @@ jobs:
         steps:
             # TODO: As part of #10618 change to setup-maven custom action
             # Basic setup chores
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: Set up JDK ${{ matrix.jdk }}
               uses: actions/setup-java@v4
               with:
@@ -112,7 +112,7 @@ jobs:
                   cache: maven
 
             # Get the build output from the unit test job
-            - uses: actions/download-artifact@v4
+            - uses: actions/download-artifact@v5
               with:
                   name: java-artifacts
             - run: |
@@ -137,15 +137,15 @@ jobs:
         steps:
             # TODO: As part of #10618 change to setup-maven custom action
             # Basic setup chores
-          - uses: actions/checkout@v4
+          - uses: actions/checkout@v5
           - uses: actions/setup-java@v4
             with:
                 java-version: '17'
                 distribution: temurin
                 cache: maven
 
           # Get the build output from the integration test job
-          - uses: actions/download-artifact@v4
+          - uses: actions/download-artifact@v5
             with:
                 name: java-reportdir
           - run: tar -xvf java-reportdir.tar

.github/workflows/reviewdog_checkstyle.yml

@@ -10,7 +10,7 @@ jobs:
         name: Checkstyle job
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
             - name: Run check style
               uses: nikitasavinov/checkstyle-action@master
               with:

.github/workflows/scripts/containers/maintain-application.sh

@@ -126,15 +126,15 @@ for BRANCH in "$@"; do
   # 6. Let's put together what tags we want added to this build run
   TAG_OPTIONS=""
   if ! (( IS_DEV )); then
-    TAG_OPTIONS="-Dapp.image=$APP_IMAGE_REF -Ddocker.tags.revision=$NEXT_REV_TAG"
+    TAG_OPTIONS="-Dapp.image=$APP_IMAGE_REF -Dapp.image.tag.1=$NEXT_REV_TAG"
     # In case of the current release, add the "latest" tag as well.
     if (( IS_CURRENT_RELEASE )); then
-      TAG_OPTIONS="$TAG_OPTIONS -Ddocker.tags.latest=latest"
+      TAG_OPTIONS="$TAG_OPTIONS -Dapp.image.tag.2=latest"
     fi
   else
     # shellcheck disable=SC2016
     UPCOMING_TAG=$( mvn initialize help:evaluate -Pct -f . -Dexpression=app.image.tag -Dapp.image.tag='${app.image.version}-${base.image.flavor}' -q -DforceStdout )
-    TAG_OPTIONS="-Ddocker.tags.upcoming=$UPCOMING_TAG"
+    TAG_OPTIONS="-Dapp.image.tag.1=$UPCOMING_TAG"
 
     # For the dev branch we only have rolling tags and can add them now already
     SUPPORTED_ROLLING_TAGS+=("[\"unstable\", \"$UPCOMING_TAG\"]")
@@ -148,9 +148,8 @@ for BRANCH in "$@"; do
       # Build the application image, but skip the configbaker image (that's a different job)!
       # shellcheck disable=SC2046
       mvn -Pct -f . deploy -Ddocker.noCache -Ddocker.platforms="${PLATFORMS}" \
-        -Dconf.skipBuild -Dbase.image="${BASE_IMAGE_REF}" \
-        -Ddocker.imagePropertyConfiguration=override $TAG_OPTIONS \
-        $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push -Ddocker.skip.tag"; fi )
+        -Dconf.skipBuild -Dbase.image="${BASE_IMAGE_REF}" $TAG_OPTIONS \
+        $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push"; fi )
     else
       echo "Skipping Maven build as requested by DRY_RUN=1"
     fi

.github/workflows/scripts/containers/maintain-base.sh

@@ -120,6 +120,13 @@ for BRANCH in "$@"; do
   CURRENT_REV_TAG="${BASE_IMAGE_REF#*:}-r$REV"
   NEXT_REV_TAG="${BASE_IMAGE_REF#*:}-r$(( REV + 1 ))"
 
+  # 6a. Determine if we must newly release an "r0" because a rolling tag from development is now released.
+  IS_NEW_RELEASE=0
+  if ! (( IS_DEV )) && [ "$REV" = "-1" ]; then
+    echo "This is a newly released version of Dataverse - forcing build, as no r0 image is present on Docker Hub"
+    IS_NEW_RELEASE=1
+  fi
+
   # 7. Let's put together what tags we want added to this build run
   TAG_OPTIONS=""
   if ! (( IS_DEV )); then
@@ -139,12 +146,12 @@ for BRANCH in "$@"; do
 
   # 8. Let's build the base image if necessary
   NEWER_IMAGE=0
-  if (( NEWER_JAVA_IMAGE + NEWER_PKGS + FORCE_BUILD > 0 )); then
+  if (( NEWER_JAVA_IMAGE + NEWER_PKGS + IS_NEW_RELEASE + FORCE_BUILD > 0 )); then
     if ! (( DRY_RUN )); then
       # shellcheck disable=SC2046
       mvn -Pct -f modules/container-base deploy -Ddocker.noCache -Ddocker.platforms="${PLATFORMS}" \
         -Ddocker.imagePropertyConfiguration=override $TAG_OPTIONS \
-        $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push -Ddocker.skip.tag"; fi )
+        $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push"; fi )
     else
       echo "Skipping Maven build as requested by DRY_RUN=1"
     fi

.github/workflows/scripts/containers/maintain-configbaker.sh

@@ -122,15 +122,15 @@ for BRANCH in "$@"; do
   # 6. Let's put together what tags we want added to this build run
   TAG_OPTIONS=""
   if ! (( IS_DEV )); then
-    TAG_OPTIONS="-Dconf.image=$CONFIG_IMAGE_REF -Ddocker.tags.revision=$NEXT_REV_TAG"
+    TAG_OPTIONS="-Dconf.image=$CONFIG_IMAGE_REF -Dconf.image.tag.1=$NEXT_REV_TAG"
     # In case of the current release, add the "latest" tag as well.
     if (( IS_CURRENT_RELEASE )); then
-      TAG_OPTIONS="$TAG_OPTIONS -Ddocker.tags.latest=latest"
+      TAG_OPTIONS="$TAG_OPTIONS -Dconf.image.tag.2=latest"
     fi
   else
     # shellcheck disable=SC2016
     UPCOMING_TAG=$( mvn initialize help:evaluate -Pct -f . -Dexpression=conf.image.tag -Dconf.image.tag='${app.image.version}-${conf.image.flavor}' -q -DforceStdout )
-    TAG_OPTIONS="-Ddocker.tags.upcoming=$UPCOMING_TAG"
+    TAG_OPTIONS="-Dconf.image.tag.1=$UPCOMING_TAG"
 
     # For the dev branch we only have rolling tags and can add them now already
     SUPPORTED_ROLLING_TAGS+=("[\"unstable\", \"$UPCOMING_TAG\"]")
@@ -145,9 +145,8 @@ for BRANCH in "$@"; do
       # shellcheck disable=SC2046
       mvn -Pct -f . deploy -Ddocker.noCache -Ddocker.platforms="${PLATFORMS}" \
         -Dapp.skipBuild -Dconf.image.base="${BASE_IMAGE_REF}" \
-        -Dmaven.main.skip -Dmaven.test.skip -Dmaven.war.skip \
-        -Ddocker.imagePropertyConfiguration=override $TAG_OPTIONS \
-        $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push -Ddocker.skip.tag"; fi )
+        -Dmaven.main.skip -Dmaven.test.skip -Dmaven.war.skip $TAG_OPTIONS \
+        $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push"; fi )
     else
       echo "Skipping Maven build as requested by DRY_RUN=1"
     fi

.github/workflows/shellcheck.yml

@@ -21,7 +21,7 @@ jobs:
         permissions:
             pull-requests: write
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: shellcheck
               uses: reviewdog/action-shellcheck@v1
               with:

.github/workflows/shellspec.yml

@@ -19,7 +19,7 @@ jobs:
         steps:
             - name: Install shellspec
               run: curl -fsSL https://git.io/shellspec | sh -s ${{ env.SHELLSPEC_VERSION }} --yes
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: Run Shellspec
               run: |
                   cd tests/shell
@@ -30,7 +30,7 @@ jobs:
         container:
             image: rockylinux/rockylinux:9
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: Install shellspec
               run: |
                   curl -fsSL https://github.com/shellspec/shellspec/releases/download/${{ env.SHELLSPEC_VERSION }}/shellspec-dist.tar.gz | tar -xz -C /usr/share
@@ -47,7 +47,7 @@ jobs:
         steps:
             - name: Install shellspec
               run: curl -fsSL https://git.io/shellspec | sh -s 0.28.1 --yes
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - name: Run Shellspec
               run: |
                   cd tests/shell

.github/workflows/spi_release.yml

@@ -37,7 +37,7 @@ jobs:
         runs-on: ubuntu-latest
         if: github.event_name == 'pull_request' && needs.check-secrets.outputs.available == 'true'
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
             - uses: actions/setup-java@v4
               with:
                   java-version: '17'
@@ -63,7 +63,7 @@ jobs:
         runs-on: ubuntu-latest
         if: github.event_name == 'push' && needs.check-secrets.outputs.available == 'true'
         steps:
-            -   uses: actions/checkout@v4
+            -   uses: actions/checkout@v5
             -   uses: actions/setup-java@v4
                 with:
                     java-version: '17'

conf/keycloak/Dockerfile

@@ -14,10 +14,10 @@ RUN mvn clean package
 # ------------------------------------------
 # Stage 2: Build Keycloak Image
 # ------------------------------------------
-FROM quay.io/keycloak/keycloak:26.1.4
+FROM quay.io/keycloak/keycloak:26.3.2
 
 # Add the Oracle JDBC jars
-ARG ORACLE_JDBC_VERSION=23.7.0.25.01
+ARG ORACLE_JDBC_VERSION=23.8.0.25.04
 ADD --chown=keycloak:keycloak https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc11/${ORACLE_JDBC_VERSION}/ojdbc11-${ORACLE_JDBC_VERSION}.jar /opt/keycloak/providers/ojdbc11.jar
 ADD --chown=keycloak:keycloak https://repo1.maven.org/maven2/com/oracle/database/nls/orai18n/${ORACLE_JDBC_VERSION}/orai18n-${ORACLE_JDBC_VERSION}.jar /opt/keycloak/providers/orai18n.jar
 
@@ -29,7 +29,7 @@ COPY --from=builder /app/target/keycloak-dv-builtin-users-authenticator-1.0-SNAP
 
 # Copy additional configurations
 COPY ./builtin-users-spi/conf/quarkus.properties /opt/keycloak/conf/
-COPY ./test-realm.json /opt/keycloak/data/import/
+COPY ./test-realm-include-spi.json /opt/keycloak/data/import/
 
 # Set the Keycloak command
 ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]

conf/keycloak/builtin-users-spi/pom.xml

@@ -100,7 +100,7 @@
     </build>
 
     <properties>
-        <keycloak.version>26.1.4</keycloak.version>
+        <keycloak.version>26.3.2</keycloak.version>
         <java.version>17</java.version>
         <jakarta.persistence.version>3.2.0</jakarta.persistence.version>
         <mindrot.jbcrypt.version>0.4</mindrot.jbcrypt.version>

conf/keycloak/builtin-users-spi/src/main/java/edu/harvard/iq/keycloak/auth/spi/adapters/DataverseUserAdapter.java

@@ -1,6 +1,7 @@
 package edu.harvard.iq.keycloak.auth.spi.adapters;
 
 import edu.harvard.iq.keycloak.auth.spi.models.DataverseUser;
+import edu.harvard.iq.keycloak.auth.spi.providers.DataverseUserStorageProviderFactory;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
@@ -15,10 +16,13 @@ public class DataverseUserAdapter extends AbstractUserAdapterFederatedStorage {
     protected DataverseUser dataverseUser;
     protected String keycloakId;
 
+    private static final String ATTRIBUTE_NAME_IDP = "idp";
+
     public DataverseUserAdapter(KeycloakSession session, RealmModel realm, ComponentModel model, DataverseUser dataverseUser) {
         super(session, realm, model);
         this.dataverseUser = dataverseUser;
         keycloakId = StorageId.keycloakId(model, dataverseUser.getBuiltinUser().getId().toString());
+        this.setSingleAttribute(ATTRIBUTE_NAME_IDP, DataverseUserStorageProviderFactory.PROVIDER_ID);
     }
 
     @Override