keycloak: allow ISO8601 datetime format

[Alphayeeeet]

Please label as enhancement

The officially as-well supported ISO8601 timestamp shall be added to the date processor.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Is there a test for this and a demonstrated need?

[Alphayeeeet]

I didn't add a test as I didn't find an official Keycloak doc of the supported date format, but we tested it internally for our instances. If necessary, I'm perfectly fine with adding a test-case.

Context: We use RHSSO, there are frequent parsing errors because of the date format, as it somehow uses ISO-like format without timezone offset. As this change should be only beneficial as multiple date formats are supported and checked sequentially by the processor, this would fix these issues.

We might be able to change the log timestamp, however, I think it would be more beneficial to support proprietary distributions of Keycloak as well.

[efd6]

Thanks. Please add a test.

[Alphayeeeet]

@efd6 Test case has been added. Please run CI again.

[efd6]

I suspect that you are using and older version of elastic-package. Can you update that to the most recent release and redo elastic-package test pipeline -g?

[efd6]

/test

[Alphayeeeet]

@efd6 Version was updated, however there were no significant changes in the expected test results.
Please run CI again and approve if applicable. Thanks

[efd6]

/test

[efd6]

Thanks. The change I was expecting was made.

[Alphayeeeet]

@efd6 Has been fixed

[efd6]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e2b8745

History

• 💚 Build #27222 succeeded 1a2eb4c
• 💚 Build #27185 succeeded 4787f7a
• 💚 Build #27086 succeeded 5d05f2a

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
66.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package keycloak - 1.29.0 containing this change is available at https://epr.elastic.co/package/keycloak/1.29.0/