Fix/first broker login flow

CHANGELOG.md

@@ -16,6 +16,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 - Keycloak workflow API documentation differs from actual implementation [#1476](https://github.com/adorsys/keycloak-config-cli/pull/1476)
 - Support for Keycloak 26.5.5 to fix [#1303](https://github.com/adorsys/keycloak-config-cli/issues/1303)
+- Fix creation of custom first broker login flow and binding it to realm [#1481](https://github.com/adorsys/keycloak-config-cli/issues/1481)
+
 
 ### Security
 - Update assertj-core from 3.26.3 to 3.27.7 (CVE-2026-24400, XXE vulnerability)

src/main/java/de/adorsys/keycloak/config/service/AuthenticationFlowsImportService.java

@@ -125,11 +125,50 @@ private void setupFlowsInRealm(RealmImport realmImport) {
         realm.setRegistrationFlow(realmImport.getRegistrationFlow());
         realm.setResetCredentialsFlow(realmImport.getResetCredentialsFlow());
 
+        // firstBrokerLoginFlow is only available in Keycloak 24+
+        String firstBrokerLoginFlow = getFirstBrokerLoginFlow(realmImport);
+        if (firstBrokerLoginFlow != null) {
+            setFirstBrokerLoginFlow(realm, firstBrokerLoginFlow);
+        }
+
         realmRepository.update(realm);
     }
 
     /**
-     * creates or updates only the top-level flows and its executions or execution-flows
+     * Gets the firstBrokerLoginFlow using reflection to support Keycloak versions
+     * below 24.
+     */
+    private String getFirstBrokerLoginFlow(RealmImport realmImport) {
+        try {
+            return (String) RealmImport.class.getMethod("getFirstBrokerLoginFlow").invoke(realmImport);
+        } catch (NoSuchMethodException e) {
+            // Method not available in Keycloak < 24
+            return null;
+        } catch (Exception e) {
+            logger.warn("Failed to get firstBrokerLoginFlow: {}", e.getMessage());
+            return null;
+        }
+    }
+
+    /**
+     * Sets the firstBrokerLoginFlow using reflection to support Keycloak versions
+     * below 24.
+     */
+    private void setFirstBrokerLoginFlow(RealmRepresentation realm, String firstBrokerLoginFlow) {
+        try {
+            RealmRepresentation.class.getMethod("setFirstBrokerLoginFlow", String.class)
+                    .invoke(realm, firstBrokerLoginFlow);
+        } catch (NoSuchMethodException e) {
+            // Method not available in Keycloak < 24, ignore
+            logger.debug("setFirstBrokerLoginFlow not available in this Keycloak version");
+        } catch (Exception e) {
+            logger.warn("Failed to set firstBrokerLoginFlow: {}", e.getMessage());
+        }
+    }
+
+    /**
+     * creates or updates only the top-level flows and its executions or
+     * execution-flows
      */
     private void createOrUpdateTopLevelFlows(RealmImport realmImport, List<AuthenticationFlowRepresentation> topLevelFlowsToImport) {
         for (AuthenticationFlowRepresentation topLevelFlowToImport : topLevelFlowsToImport) {
@@ -200,7 +239,7 @@ private boolean hasAnySubFlowToBeUpdated(
     }
 
     private List<AuthenticationFlowRepresentation> getAllSubFlows(RealmImport realmImport,
-                                                                  AuthenticationFlowRepresentation topLevelFlowToImport) {
+            AuthenticationFlowRepresentation topLevelFlowToImport) {
 
         final List<AuthenticationFlowRepresentation> subFlows = AuthenticationFlowUtil.getSubFlowsForTopLevelFlow(
                 realmImport, topLevelFlowToImport);
@@ -428,7 +467,24 @@ private boolean isFlowReferencedByRealmBindings(String realmName, String flowAli
                 || flowAlias.equals(realm.getClientAuthenticationFlow())
                 || flowAlias.equals(realm.getDockerAuthenticationFlow())
                 || flowAlias.equals(realm.getRegistrationFlow())
-                || flowAlias.equals(realm.getResetCredentialsFlow());
+                || flowAlias.equals(realm.getResetCredentialsFlow())
+                || flowAlias.equals(getRealmFirstBrokerLoginFlow(realm));
+    }
+
+    /**
+     * Gets the firstBrokerLoginFlow from a RealmRepresentation using reflection to
+     * support Keycloak versions below 24.
+     */
+    private String getRealmFirstBrokerLoginFlow(RealmRepresentation realm) {
+        try {
+            return (String) RealmRepresentation.class.getMethod("getFirstBrokerLoginFlow").invoke(realm);
+        } catch (NoSuchMethodException e) {
+            // Method not available in Keycloak < 24
+            return null;
+        } catch (Exception e) {
+            logger.warn("Failed to get realm firstBrokerLoginFlow: {}", e.getMessage());
+            return null;
+        }
     }
 
     private void deleteTopLevelFlowsMissingInImport(
@@ -444,7 +500,9 @@ private void deleteTopLevelFlowsMissingInImport(
                 .collect(Collectors.toSet());
 
         for (AuthenticationFlowRepresentation existingTopLevelFlow : existingTopLevelFlows) {
-            if (topLevelFlowsToImportAliases.contains(existingTopLevelFlow.getAlias())) continue;
+            if (topLevelFlowsToImportAliases.contains(existingTopLevelFlow.getAlias())) {
+                continue;
+            }
 
             if (isTemporaryWorkaroundFlow(existingTopLevelFlow.getAlias())) {
                 continue;

src/main/java/de/adorsys/keycloak/config/service/RealmImportService.java

@@ -41,7 +41,7 @@
 @Service
 @ConditionalOnProperty(prefix = "run", name = "operation", havingValue = "IMPORT", matchIfMissing = true)
 public class RealmImportService {
-    static final String[] ignoredPropertiesForRealmImport = new String[]{
+    static final String[] ignoredPropertiesForRealmImport = new String[] {
             "authenticatorConfig",
             "clients",
             "roles",
@@ -56,6 +56,7 @@ public class RealmImportService {
             "dockerAuthenticationFlow",
             "registrationFlow",
             "resetCredentialsFlow",
+            "firstBrokerLoginFlow",
             "components",
             "authenticationFlows",
             "scopeMappings",
@@ -173,14 +174,15 @@ private void updateRealmIfNecessary(RealmImport realmImport) {
             logger.debug(
                     "No need to update realm '{}', import checksum same: '{}'",
                     realmImport.getRealm(),
-                    realmImport.getChecksum()
-            );
+                    realmImport.getChecksum());
         }
     }
 
     private void setEventsEnabledWorkaround(RealmImport realmImport) {
         // https://github.com/adorsys/keycloak-config-cli/issues/338
-        if (realmImport.isEventsEnabled() != null) return;
+        if (realmImport.isEventsEnabled() != null) {
+            return;
+        }
 
         Boolean existingEventsEnabled = realmRepository.get(realmImport.getRealm()).isEventsEnabled();
         realmImport.setEventsEnabled(existingEventsEnabled);
@@ -189,10 +191,12 @@ private void setEventsEnabledWorkaround(RealmImport realmImport) {
     private void createRealm(RealmImport realmImport) {
         logger.debug("Creating realm '{}' ...", realmImport.getRealm());
 
-        RealmRepresentation realm = CloneUtil.deepClone(realmImport, RealmRepresentation.class, ignoredPropertiesForRealmImport);
+        RealmRepresentation realm = CloneUtil.deepClone(realmImport, RealmRepresentation.class,
+                ignoredPropertiesForRealmImport);
         realmRepository.create(realm);
 
-        // refresh the access token to update the scopes. See: https://github.com/adorsys/keycloak-config-cli/issues/339
+        // refresh the access token to update the scopes. See:
+        // https://github.com/adorsys/keycloak-config-cli/issues/339
         keycloakProvider.refreshToken();
 
         stateService.loadState(realmImport);
@@ -202,7 +206,8 @@ private void createRealm(RealmImport realmImport) {
     private void updateRealm(RealmImport realmImport) {
         logger.debug("Updating realm '{}'...", realmImport.getRealm());
 
-        RealmRepresentation realm = CloneUtil.deepClone(realmImport, RealmRepresentation.class, ignoredPropertiesForRealmImport);
+        RealmRepresentation realm = CloneUtil.deepClone(realmImport, RealmRepresentation.class,
+                ignoredPropertiesForRealmImport);
 
         RealmRepresentation existingRealm = realmRepository.get(realmImport.getRealm());
 
@@ -223,8 +228,7 @@ private void importOtpPolicy(RealmImport realmImport) {
         if (realmConfig.getOtpPolicyAlgorithm() != null) {
             otpPolicyImportService.updateOtpPolicy(
                     realmImport.getRealm(),
-                    realmConfig
-            );
+                    realmConfig);
         }
     }