v3.7.32: Keycloak 26.7.1 → 26.7.3 (20 CVE fixes) + retire legacy p1-sso theme + fix p1-sso-v2 CSS

Summary

Two scopes bundled into 3.7.32:

1. Keycloak 26.7.1 → 26.7.3 patch bump (20 CVE fixes). Realigns the plugin's compileOnly SPI pin with the runtime version P1 environments already moved to via configmap. Quarkus unchanged at 3.33.3.1 (26.7.3 bundles the same Quarkus). No plugin Java code changes required for the KC bump.

2. Retire the legacy p1-sso theme + fix a real p1-sso-v2 CSS bug. Delete the original p1-sso theme from the plugin JAR (superseded years ago by p1-sso-v2 in this repo and p1-sso-v3/v4 in the themes repo). Fix invalid trailing commas in both @font-face src: declarations in p1-sso-v2/custom-resources/css/new-ui.css. Update documentation drift where five doc files described theme mounts + a nonexistent p1-sso-v3 directory in this repo.

The two scopes are independent but co-shipped to reduce release churn — theme changes have zero effect on running realms (theme selection is DB-persisted and served by the init container image, not the plugin JAR).

Files bumped (KC 26.7.3)

• keycloakVersion 26.7.1 → 26.7.3 in p1-keycloak-plugin/build.gradle
• rootProjectVersion 3.7.31 → 3.7.32 in gradle.properties
• Docker dev image 26.7.1 → 26.7.3 in docker-dev/docker-compose.yml
• COMPATIBILITY_MATRIX row for 3.7.32

Files changed (theme retirement + bug fix + doc cleanup)

• Deleted: p1-keycloak-plugin/src/main/resources/theme/p1-sso/ (30 files, 2,459 lines)
• Updated: p1-keycloak-plugin/src/main/resources/META-INF/keycloak-themes.json — removed p1-sso entry, kept p1-sso-v2
• Fixed CSS bug: p1-keycloak-plugin/src/main/resources/theme/p1-sso-v2/custom-resources/css/new-ui.css — removed trailing commas after format("truetype") in both @font-face src: declarations (invalid per CSS spec; browsers silently ignored the malformed entry, but Sonar rule css:S8775 correctly rejected it)
• Sonar config cleanup: dropped the now-dead css:S7924 suppression on **/theme/p1-sso/**/*.css from sonar-project.properties + sonar-project-dev.properties. Multicriteria list reduced to e1,e2.
• Doc drift fixes: docs/DOCKER_DEV_ARCHITECTURE.md, docs/QUICK_START.md, docs/DEVELOPER_ONBOARDING.md, docker-dev/README.md, README.md — corrected theme mount paths and removed references to a p1-sso-v3 directory that has never existed in this repo (v3/v4 live in the themes repo as the internal-themes image)

Selected KC 26.7.3 CVEs (full list in release notes)

OIDC/auth path (most relevant to P1 SSO):

• CVE-2026-16089 — OIDC authorization codes can be retargeted to another client session
• CVE-2026-16093 — Required signed-JWT assertion policy can be bypassed with unsigned assertion headers
• CVE-2026-18209 — Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check inspects only query string, not URL fragment
• CVE-2026-18218 — Client not-before revocation ignored when realm not-before is older but nonzero
• CVE-2026-79652 — jwt-bearer authorization grant does not enforce consentRequired

Admin/RBAC/FGAP:

• CVE-2026-16072 — Organization managers can create managed members through stored registration links without manage-users
• CVE-2026-16105 — Missing per-role authorization on RoleContainerResource composite endpoints
• CVE-2026-16108 — Realm default-group reads disclose hidden groups under FGAP v2
• CVE-2026-16106 — Delegated admin can remove privileged child roles via role-composite deletion
• CVE-2026-17059 — GET /roles/{role}/users returns user PII without per-user view filter
• CVE-2026-18571 — FGAP v2: group assignment bypass during user creation
• CVE-2026-18201 — Generic IdP creation can bind brokers to organizations without manage-organizations
• CVE-2026-16104 — Authenticator config surfaces expose raw reCAPTCHA secrets

Token exchange / external IdP:

• CVE-2026-18215 — Microsoft external access-token exchange bypasses configured tenant
• CVE-2026-18214 — Google external access-token exchange bypasses hosted-domain restriction
• CVE-2026-18570 — Full-scope-disabled client policy validation bypassed by omitting fullScopeAllowed
• CVE-2026-18572 — UMA claim token can override the authorization time-policy clock
• CVE-2026-18573 — Client access-type condition evaluates updates against old client type

Other:

• CVE-2026-35563 — LDAP client TLS hostname verification (LDAP client 2.1.7) — relevant to Scenario B customers federating AD
• CVE-2026-19729 — Incomplete fix for CVE-2026-9083: relative path traversal enables filesystem probing in 26.6.4

Relevant logs

Build + test on this branch:

$ ./gradlew :p1-keycloak-plugin:clean :p1-keycloak-plugin:build
BUILD SUCCESSFUL

Total tests: 1427   skipped: 8   failed: 0   errors: 0

Built JAR ships only p1-sso-v2:

$ unzip -l p1-keycloak-plugin-3.7.32.jar | awk '/theme\/[^\/]+\/$/'
        0  2026-08-31 21:56   theme/p1-sso-v2/

Parsson exclusion (from 3.7.29) preserved:

$ jar tf p1-keycloak-plugin-3.7.32.jar | grep -iE "^jakarta/json|^org/eclipse/parsson"
(empty — still excluded)

Linked Issue

Follows upstream KC 26.7.3 release: https://github.com/keycloak/keycloak/releases/tag/26.7.3

Upgrade Notices

• Drop-in for KC bump. Existing envs on 3.7.31 can bump to 3.7.32 by changing the plugin image tag only — no config or realm changes required for the KC portion.
• Theme retirement — breaking for anyone using p1-sso: if any downstream deployment still references the p1-sso theme by name, it must switch to p1-sso-v2 (or a p1-sso-v3/v4 from the themes repo). Running realms select their theme from the database and are served by the init-container image, so P1-managed environments (which use p1-sso-v4) are unaffected. External plugin consumers on p1-sso-v2 are unaffected. Only downstream consumers still on the original p1-sso are impacted.
• External-manifests follow-up required: apps/backup_restore/restore/base/resources/sql.sh in the external-manifests repo writes account_theme = 'p1-sso' (also admin_theme, login_theme) into restored realms. After this release, that script must be updated to 'p1-sso-v2' — otherwise a restore would point restored realms at a theme the JAR no longer provides. Tracked separately; fix belongs in the external-manifests repo.
• Plugin remains backwards-compatible with KC 26.7.1 and 26.7.2 (patch releases don't change SPI surface).
• OWASP dependency-check expected clean (only KC version changed; both KC and its Quarkus come from Ironbank sources).