Repository navigation
[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption #48188
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
oid4vc
Describe the bug
When testing against the German testing wallet from SPRIND i found, that Keycloak currently assumes the same client_id is used when creating the offer as when fetching it.
That assumption is wrong, because the wallet uses its own client to do the authentication flow and subsequently to redeem the offer.
Version
26.6.1
Regression
- The issue is a regression
Expected behavior
Offer can be fetched using a different client than the one used to create it, if the wallet client is authorized to do so
Actual behavior
invalid_credential_request error with "Unexpected login client"
How to Reproduce?
- Create offer using client_id
app - Scan offer QR code
- Wallet initiates auth code flow using client_id
wallet - Wallet tries to fetch the offer using client_id
wallet
Anything else?
No response
Reacted by keycloak-github-bot
Activity
dominikschlosser commentedon Apr 18, 2026
@tdiesler what do you think about this?
[-][OID4VCI] Authorization Code Flow assumes same client_id for offer creation and redemption[/-][+][OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption[/+]tdiesler commentedon Apr 20, 2026
Yes, I can take this
mposolda commentedon May 4, 2026
@dominikschlosser How exactly are you creating credential offer? Are you using custom REST endpoint for credential-offers, which we have in Keycloak or are you using application-initiated action (as used for example in
OID4VCActionTest) ? Not sure about REST endpoint, but the latter allows creation offer withoutclientId, which means that any client can be used for the login.Also is this the offer for authorization-code or pre-authorized code grant?
tdiesler commentedon May 4, 2026
@mposolda This is about pre-auth offers created through the endpoint (for auth-code offers we take the client_id from the auth code). For pre-auth we used to have both target user and target client_id. We removed the target client_id because we couldn't reconstruct that properly with the persistent auth session (IIRC). Now that we moved to a transient session, would it now be possible to restore a target client_id?
Note, in case we restore a target client_id that the (offer) admin can choose from - is it ok to choose any client_id or perhaps only those that the admin can login themselves?
16 remaining items
[OID4VCI] Issuance with Authorization Code Flow assumes same client_i…