Fixing Re-authentication with passkeys

[akshayutture-augment]

Test 1

---

Replicated from ai-code-review-evaluation/keycloak-greptile#1

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[akshayutture-augment]

@greptileai

[greptile-apps]

Greptile Overview

Confidence Score: 0/5

• This PR cannot be merged due to a compilation error in UsernameForm.java
• The code contains a syntax error where isConditionalPasskeysEnabled() is called without its required UserModel user parameter on line 47 of UsernameForm.java. This will cause a compilation failure. While the overall design and test coverage are good, this critical error prevents the code from building.
• services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java requires immediate fix for compilation error

Important Files Changed

File Analysis

Filename	Score	Overview
services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java	0/5	Contains compilation error - isConditionalPasskeysEnabled() called without required UserModel parameter
services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java	4/5	Added isConditionalPasskeysEnabled(UserModel) helper and refactored WebAuthn setup to work during re-authentication
services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnConditionalUIAuthenticator.java	5/5	Overrode shouldShowWebAuthnAuthenticators() to prevent displaying authenticators list and added re-authentication form setup on error
services/src/main/java/org/keycloak/authentication/authenticators/util/AuthenticatorUtils.java	5/5	Added setupReauthenticationInUsernamePasswordFormError() utility to centralize re-authentication form setup logic

Sequence Diagram

sequenceDiagram
    participant User
    participant Browser
    participant UsernameForm
    participant UsernamePasswordForm
    participant WebAuthnConditionalUI
    participant AuthContext

    Note over User,AuthContext: Re-authentication Flow (prompt=login)
    
    User->>Browser: Request with prompt=login
    Browser->>UsernameForm: authenticate()
    UsernameForm->>AuthContext: getUser()
    AuthContext-->>UsernameForm: user (not null)
    UsernameForm->>UsernameForm: isConditionalPasskeysEnabled(user)
    UsernameForm->>WebAuthnConditionalUI: isPasskeysEnabled()
    WebAuthnConditionalUI-->>UsernameForm: true
    UsernameForm->>UsernamePasswordForm: super.authenticate()
    UsernamePasswordForm->>AuthContext: setAuthNote(USER_SET_BEFORE_USERNAME_PASSWORD_AUTH)
    UsernamePasswordForm->>WebAuthnConditionalUI: fillContextForm()
    WebAuthnConditionalUI->>AuthContext: form.setAttribute(ENABLE_WEBAUTHN_CONDITIONAL_UI)
    UsernamePasswordForm-->>Browser: Display login form with passkeys enabled
    
    alt User enters wrong password
        Browser->>UsernamePasswordForm: action() with password
        UsernamePasswordForm->>UsernamePasswordForm: badPasswordHandler()
        UsernamePasswordForm->>AuthenticatorUtils: setupReauthenticationInUsernamePasswordFormError()
        AuthenticatorUtils->>AuthContext: getAuthNote(USER_SET_BEFORE_USERNAME_PASSWORD_AUTH)
        AuthenticatorUtils->>AuthContext: form.setAttribute(USERNAME_HIDDEN, true)
        UsernamePasswordForm->>WebAuthnConditionalUI: fillContextForm()
        UsernamePasswordForm-->>Browser: Display error with passkeys still enabled
    else User selects passkey
        Browser->>UsernamePasswordForm: action() with webauthn data
        UsernamePasswordForm->>WebAuthnConditionalUI: action()
        WebAuthnConditionalUI->>AuthContext: Validate WebAuthn credential
        WebAuthnConditionalUI-->>Browser: Success or error with passkeys enabled
    end

Loading

[greptile-apps]

_{9 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

syntax: isConditionalPasskeysEnabled() is called without passing the required UserModel user parameter

Suggested change

	if (context.getUser() != null && !isConditionalPasskeysEnabled()) {
	if (context.getUser() != null && !isConditionalPasskeysEnabled(context.getUser())) {

Prompt To Fix With AI

This is a comment left during a code review.
Path: services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java
Line: 47:47

Comment:
**syntax:** `isConditionalPasskeysEnabled()` is called without passing the required `UserModel user` parameter

```suggestion
        if (context.getUser() != null && !isConditionalPasskeysEnabled(context.getUser())) {
```

How can I resolve this? If you propose a fix, please make it concise.