8000 [OID4VCI] Add support for credential scope policies by tdiesler · Pull Request #46466 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[OID4VCI] Add support for credential scope policies - #46466

Closed
tdiesler wants to merge 9 commits into
keycloak:mainfrom
tdiesler:ghi46262
Closed

[OID4VCI] Add support for credential scope policies#46466
tdiesler wants to merge 9 commits into
keycloak:mainfrom
tdiesler:ghi46262

Conversation

@tdiesler
@tdiesler tdiesler commented Feb 19, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

closes #46262

discussion: #46467

depends on
#46897

@tdiesler
tdiesler requested review from a team as code owners February 19, 2026 12:23
@tdiesler tdiesler mentioned this pull request Feb 19, 2026
Closed
@tdiesler tdiesler changed the title Ghi46262 [OID4VCI] Add support for credential issuance policies Feb 19, 2026
@tdiesler
tdiesler commented Feb 19, 2026
Copy link
Copy Markdown
Contributor Author

Wit this PR you get basic policy definitions like this

    /**
     * Credential Policy that governs whether the given `credential_configuration_id` requires a Credential Offer
     */
    VC_POLICY_CREDENTIAL_OFFER_REQUIRED = new CredentialPredicatePolicy("vc.policy.offer.required", true, false);

    /**
     * Credential Policy that governs whether Credential Offers with `pre-authorized_code` grant are allowed
     */
    VC_POLICY_CREDENTIAL_OFFER_PRE_AUTH_ALLOWED = new CredentialPredicatePolicy("vc.policy.offer.pre-auth.allowed", true, true);

    /**
     * Credential Policy that governs whether Credential Offers with `pre-authorized_code` grant require a `tx_code`
     */
    VC_POLICY_CREDENTIAL_OFFER_TX_CODE_REQUIRED = new CredentialPredicatePolicy("vc.policy.offer.tx-code.required", true, false);

which are enforced by the new CredentialOfferProvider. This is the single (java) entry point for all clients that want to create a credential offer.

@tdiesler
tdiesler force-pushed the ghi46262 branch 3 times, most recently from fc9e385 to ff796cc Compare February 19, 2026 18:31
@tdiesler tdiesler mentioned this pull request Feb 20, 2026
Closed
@tdiesler
tdiesler force-pushed the ghi46262 branch 4 times, most recently from faf7ac0 to 8e06141 Compare February 20, 2026 12:14
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Feb 20, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
keycloak-github-bot Bot commented Feb 20, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.model.infinispan.EmbeddedInfinispanSplitBrainTest#testLocalCacheClearedOnMergeEvent

Keycloak CI - Store Model Tests

java.lang.AssertionError: 
threads didn't terminate in time: [main (RUNNABLE):
	at java.management@25.0.2/sun.management.ThreadImpl.dumpThreads0(Native Method)
	at java.management@25.0.2/sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:505)
	at java.management@25.0.2/sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:493)
...

java.lang.AssertionError
	at org.junit.Assert.fail(Assert.java:87)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.junit.Assert.assertTrue(Assert.java:53)
	at org.keycloak.testsuite.model.infinispan.EmbeddedInfinispanSplitBrainTest.awaitLatch(EmbeddedInfinispanSplitBrainTest.java:112)
...

Report flaky test

@tdiesler
tdiesler force-pushed the ghi46262 branch 2 times, most recently from 86e5739 to d116d66 Compare February 21, 2026 13:01
@tdiesler
tdiesler force-pushed the ghi46262 branch 8 times, most recently from ee34238 to ca22ed5 Compare February 26, 2026 17:21
@tdiesler tdiesler mentioned this pull request Feb 27, 2026
Closed
@tdiesler
tdiesler force-pushed the ghi46262 branch 6 times, most recently from 461ba44 to 9cf88af Compare March 4, 2026 20:42
@tdiesler tdiesler mentioned this pull request Mar 5, 2026
Closed
@tdiesler
tdiesler force-pushed the ghi46262 branch 2 times, most recently from 56fbd06 to b984ce1 Compare March 5, 2026 06:21
tdiesler added 5 commits March 5, 2026 11:39
@tdiesler
[OID4VCI] Migrate OID4VCCredentialOfferMatrixTest
3686f49 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler
[OID4VCI] Migrate CredentialsOffer to multiple grant types
2b48933 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler
[OID4VCI] Remove deprecated constants used in the old testsuite
778e119 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler
[OID4VCI] Add support for authorization_code grant
edf30f7 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler
[OID4VCI] Add CredentialOfferProvider as single entry for offer creation
3d0cab6 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler tdiesler changed the title [OID4VCI] Add support for credential issuance policies [OID4VCI] Add support for credential scope policies Mar 5, 2026
tdiesler added 4 commits March 5, 2026 14:24
@tdiesler
Merge branch 'ghi46261' into ghi46896
220c3f8 
* ghi46261:
  [OID4VCI] Add CredentialOfferProvider as single entry for offer creation
  [OID4VCI] Add support for `authorization_code` grant
  [OID4VCI] Remove deprecated constants used in the old testsuite
  [OID4VCI] Migrate CredentialsOffer to multiple grant types
  [OID4VCI] Migrate OID4VCCredentialOfferMatrixTest
@tdiesler
[OID4VCI] Provide client policy to allow pre-authorized offers
1172c26 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler
Merge branch 'ghi46896' into ghi46262
44f9f4c 
* ghi46896:
  [OID4VCI] Provide client policy to allow pre-authorized offers
  [OID4VCI] Add CredentialOfferProvider as single entry for offer creation
  [OID4VCI] Add support for `authorization_code` grant
  [OID4VCI] Remove deprecated constants used in the old testsuite
  [OID4VCI] Migrate CredentialsOffer to multiple grant types
  [OID4VCI] Migrate OID4VCCredentialOfferMatrixTest
@tdiesler
[OID4VCI] Add support for credential scope policies
b30b62d 
Signed-off-by: Thomas Diesler <tdiesler@ibm.com>
@tdiesler
tdiesler commented Mar 5, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor Author

The vc.policy.offer.preauth.allowed policy has now been migrated to Client Policies in PR #46897

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review
1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test team/cloud-native team/core-clients team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Add support for credential issuance policies

1 participant

@tdiesler
0