8000 [OID4VCI] Add a client policy to allow preauth offers (blocked) by tdiesler · Pull Request #46897 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[OID4VCI] Add a client policy to allow preauth offers (blocked) - #46897

Closed
tdiesler wants to merge 3 commits into
keycloak:mainfrom
tdiesler:ghi46896
Closed

[OID4VCI] Add a client policy to allow preauth offers (blocked)#46897
tdiesler wants to merge 3 commits into
keycloak:mainfrom
tdiesler:ghi46896

Conversation

@tdiesler
@tdiesler tdiesler commented Mar 5, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

closes #46896

depends on

  1. [OID4VCI] Add a client policy to require a credential offer #47286

This PR adds this client policy ...

  "clientProfiles": {
    "profiles": [
      {
        "name": "oid4vci-client-profile",
        "executors": [
          {
            "executor": "oid4vci-policy-executor",
            "configuration": {}
          }
        ]
      }
    ]
  },

  "clientPolicies": {
    "policies": [
      {
        "name": "oid4vci-offer-preauth",
        "description": "Client policy to determine whether 'pre-authorized_code' grant credential offers can be issued",
        "enabled": true,
        "conditions": [
          {
            "condition": "client-attributes",
            "configuration": {
              "attributes": "[{\"key\":\"oid4vci.enabled\", \"value\":\"true\"}]"
            }
          }
        ],
        "profiles": [
          "oid4vci-client-profile"
        ]
      }
    ]
  },

which is triggered when a client is oid4vci enabled.

@tdiesler
tdiesler requested review from a team as code owners March 5, 2026 12:20
@tdiesler
tdiesler force-pushed the ghi46896 branch 2 times, most recently from 59a2038 to 1172c26 Compare March 5, 2026 13:24
@tdiesler tdiesler mentioned this pull request Mar 5, 2026
Closed
@tdiesler
tdiesler marked this pull request as draft March 5, 2026 16:40
@tdiesler
tdiesler marked this pull request as ready for review March 5, 2026 20:30
@tdiesler
tdiesler force-pushed the ghi46896 branch 5 times, most recently from 4e87f2e to 44a334e Compare March 5, 2026 21:16
@tdiesler
tdiesler marked this pull request as draft March 6, 2026 05:42
@tdiesler
8000 tdiesler force-pushed the ghi46896 branch 2 times, most recently from b4e16c4 to 87a6861 Compare March 6, 2026 13:45
@tdiesler tdiesler changed the title [OID4VCI] Provide client policy to allow pre-authorized offers [OID4VCI] Add support for credential client policies Mar 6, 2026
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Mar 6, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
keycloak-github-bot Bot commented Mar 6, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.model.session.UserSessionProviderModelTest#testCreateUserSessionsParallel

Keycloak CI - Store Model Tests

java.lang.AssertionError: 
threads didn't terminate in time: [main (RUNNABLE):
	at java.management@25.0.2/sun.management.ThreadImpl.dumpThreads0(Native Method)
	at java.management@25.0.2/sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:505)
	at java.management@25.0.2/sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:493)
...

Report flaky test

8000
@tdiesler
tdiesler force-pushed the ghi46896 branch 2 times, most recently from 5d10a26 to 311c674 Compare March 6, 2026 22:43
@tdiesler
tdiesler commented Mar 13, 2026
Copy link
Copy Markdown
Contributor Author

This is now 1st class PR (without dependency on tx_code)

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Mar 13, 2026
Closed
@tdiesler
tdiesler force-pushed the ghi46896 branch 2 times, most recently from 238b7a2 to 1e5abd8 Compare March 15, 2026 11:17
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Mar 15, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
keycloak-github-bot Bot commented Mar 15, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest#testNonEssentialAcrMinimumUpgrade

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for org.keycloak.testsuite.util.WaitUtils$$Lambda/0x00000000158d6d70@7e1fe472 (tried for 10 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.14.0-1017-azure', java.version: '25.0.2'
Driver info: org.openqa.selenium.chrome.ChromeDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest#stepupToUnknownEssentialAcrFails

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.NoSuchElementException: 
no such element: Unable to locate element: {"method":"css selector","selector":"#username"}
  (Session info: chrome=145.0.7632.116)
For documentation on this error, please visit: https://www.selenium.dev/documentation/webdriver/troubleshooting/errors#no-such-element-exception
Build info: version: '4.28.1', revision: '73f5ad48a2'
...

Report flaky test

org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest#optionalClaimNotReachedSucceeds

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for org.keycloak.testsuite.util.WaitUtils$$Lambda/0x00000000158d6d70@4e9100bb (tried for 10 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.14.0-1017-azure', java.version: '25.0.2'
Driver info: org.openqa.selenium.chrome.ChromeDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest#testBackwardsCompatibilityForLoaConditionConfig

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.NoSuchElementException: 
no such element: Unable to locate element: {"method":"css selector","selector":"#username"}
  (Session info: chrome=145.0.7632.116)
For documentation on this error, please visit: https://www.selenium.dev/documentation/webdriver/troubleshooting/errors#no-such-element-exception
Build info: version: '4.28.1', revision: '73f5ad48a2'
...

Report flaky test

@tdiesler
tdiesler force-pushed the ghi46896 branch 4 times, most recently from 6e399e9 to d0436f4 Compare March 16, 2026 13:59
mposolda
mposolda reviewed Mar 17, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Regarding the "pre-authorized code grant allowed": We should be consistent with other grants and apply client policies in same way like done for other grants. For other grants, we have executors like for example RejectResourceOwnerPasswordCredentialsGrantExecutor (the one I had demo on the SIG meeting few weeks ago) or RejectImplicitGrantExecutor . When this is executor is used, the particular grant is always rejected. It is up to the condition on where the grant is applied. For example it can be applied to AnyClientCondition (which means all requests in the realm) or to the particular client scope (by using client scope condition). Pre-authorized code grant should be also option on the client (again for consistency with other grants) and executor should have a way to "auto-configure" that configuration option on the client. In other words, pre-authorized code grant should be consistent like other grants are doing instead of "pre-authorized grant" being handled in a special way inconsistent with other grants. Also considering this, it should not be an option on the credential client scope whether "pre-authorized code grant" is allowed or not.

  • For "Credential offer required" - This makes sense to me if it is config option on the client scope. However in that case, the client scope condition should be evaluated even if the client-policy is not configured. It would be strange to have configuration option like "require credential offer" on the client scope, but at the same time, apply this requirement just if client policy is configured. In other words, having executor, which applies policy based on the configuration options on the client scope is strange to me.
    So I would start with only option on client scope and perhaps initially without client scope policy involvement for this one. We can possibly have both configuration option on the client scope as well as an executor (or configuration option on some executor). This can be useful if client policy want to make sure that for example all client scopes in the realm should always require credential-offer.

In short: I think it can be nice to handle "pre-authorized code grant allowed" and "credential offer required" in separate PRs. The "pre-authorized code" grant should be done in a way consistent with other grants (Executor similar to RejectResourceOwnerPasswordCredentialsGrantExecutor).

The "credential offer required" can be initially added as a config option on the client scope (no client policy needed) as that one makes sense to be configurable on the credential scope. We can add integration with client policies for this one as well as a follow-up if needed.

Comment thread .github/actions/testsuite-deprecation-check/deprecation-check.sh Resolved
Comment thread testsuite/integration-arquillian/tests/base/src/test/resources/testrealm.json Resolved
@mposolda mposolda self-assigned this Mar 17, 2026
@tdiesler
tdiesler commented Mar 17, 2026
Copy link
Copy Markdown
Contributor Author

@mposolda thanks for the detailed feedback. I may ask a few questions about that tomorrow & then we can do whatever is being decided.

@tdiesler
tdiesler force-pushed the ghi46896 branch 4 times, most recently from 275abc5 to a3fdf57 Compare March 19, 2026 11:03
@tdiesler tdiesler changed the title [OID4VCI] Add support for credential client policies [OID4VCI] Add a client policy to allow preauth offers Mar 19, 2026
@tdiesler
tdiesler force-pushed the ghi46896 branch 2 times, most recently from faeff8a to e64bd3e Compare March 19, 2026 16:29
@tdiesler
tdiesler commented Mar 25, 2026
Copy link
Copy Markdown
Contributor Author

If possible, I'd like to come back to this after #47286 which it depends on.

@mposolda mposolda mentioned this pull request Mar 25, 2026
Merged
This was referenced Mar 31, 2026
Closed
Closed
tdiesler added 3 commits April 14, 2026 20:49
@tdiesler
[OID4VCI] Add a client policy to require a credential offer
039ef80 
Signed-off-by: Thomas Diesler <tdiesler@proton.me>
@tdiesler
-- add switch control in Admin UI
9bc868c 
Signed-off-by: Thomas Diesler <tdiesler@proton.me>
@tdiesler
[OID4VCI] Add a client policy to allow preauth offers
3af6e04 
Signed-off-by: Thomas Diesler <tdiesler@proton.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mposolda mposolda mposolda left review comments
Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review
+2 more reviewers
@VinodAnandan VinodAnandan VinodAnandan left review comments
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

Labels

flaky-test team/cloud-native team/core-clients team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Add a client policy to allow preauth offers

3 participants

@tdiesler @mposolda @VinodAnandan
0