8000 [OID4VCI] add encrypted request/response support to OID4VC OAuth test client by forkimenjeckayang · Pull Request #48462 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

[OID4VCI] add encrypted request/response support to OID4VC OAuth test client - #48462

Merged
mposolda merged 2 commits into
keycloak:mainfrom
adorsys:oid4vci-client-encryption-support
Apr 24, 2026
Merged

mposolda merged 2 commits into
keycloak:mainfrom
adorsys:oid4vci-client-encryption-support

Conversation

@forkimenjeckayang
@forkimenjeckayang forkimenjeckayang commented Apr 24, 2026 •
Copy link
Copy Markdown
Contributor

Summary

  • Added built-in encrypted OID4VC credential request support to Oid4vcCredentialRequest:
    • JWE encryption helper for request payloads
    • request content-type override to support application/jwt
  • Added encrypted response handling to Oid4vcCredentialResponse:
    • detect/store encrypted JWT response payload
    • decrypt JWE response into CredentialResponse using a private key
  • Refactored OID4VCIssuerEndpointEncryptionTest to use the OID4VC test client utility API for encrypted flows instead of direct low-level HTTP/JWE handling.

Why

Encryption tests were carrying transport/JWE mechanics inline, which made them verbose and duplicated logic.
Moving this behavior into shared test utilities keeps tests focused on behavior/assertions and simplifies adding future encryption test scenarios.

closes #48449

…ponse support in OID4VC test client

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
@mposolda mposolda self-assigned this Apr 24, 2026
@forkimenjeckayang
forkimenjeckayang force-pushed the oid4vci-client-encryption-support branch from 6592873 to 4a775a8 Compare April 24, 2026 12:28
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@forkimenjeckayang Thanks!

FYI. I've linked this with the issue #48449 .

For the review: Can you please also update OID4VCIssuerEndpointEncryptionTest.getCNonce() to not use RestEasy/Apache HTTP, but rather to use oauth.oid4vc().nonceRequest() (or doNonceRequest()) ?

…uest()

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
@forkimenjeckayang
Copy link
Copy Markdown
Contributor Author

For the review: Can you please also update OID4VCIssuerEndpointEncryptionTest.getCNonce() to not use RestEasy/Apache HTTP, but rather to use oauth.oid4vc().nonceRequest() (or doNonceRequest()) ?

Done @mposolda

@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@forkimenjeckayang Nice, Thanks!

@mposolda
mposolda merged commit 6ed241a into keycloak:main Apr 24, 2026
85 checks passed
@stianst stianst mentioned this pull request Jun 1, 2026
sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026
… client (keycloak#48462)

closes keycloak#48449


Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Review OID4VCIssuerEndpointEncryptionTest

2 participants

0