Repository navigation
Conversation
Expose JWT client validator validation helpers to subclasses so downstream integrations can customize individual validation steps without copying the full validator implementation. Closes keycloak#49040 Signed-off-by: Puneet Dixit <rvit23bcs086.rvitm@rvei.edu.in>
Contributor
There was a problem hiding this comment.
Pull request overview
Makes select helper methods on AbstractJWTClientValidator protected so integrators can override individual validation steps without forking the entire class, and adds a compile-time test that subclasses both AbstractJWTClientValidator and FederatedJWTClientValidator to lock in the new extensibility surface.
Changes:
- Change visibility of
validateClientAssertionParameters,validateClient,validateSignature, and bothfailure(...)helpers fromprivatetoprotected. - Add
JWTClientValidatorExtensibilityTestthat subclasses both validators and overrides the now-protected/abstract methods to guarantee they remain extensible.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| services/src/main/java/org/keycloak/authentication/authenticators/client/AbstractJWTClientValidator.java | Widens visibility of 5 helper methods from private to protected. |
| services/src/test/java/org/keycloak/authentication/authenticators/client/JWTClientValidatorExtensibilityTest.java | New compile-time test asserting both validators can be subclassed and overridden. |
slaskawi
reviewed
May 17, 2026
Contributor
There was a problem hiding this comment.
Great work @puneetdixit200 !
I added a few comments that might be worth addressing before moving on.
puneetdixit200
force-pushed
the
49040-jwt-client-validator-extensibility
branch
2 times, most recently
from
May 20, 2026 14:46
e316b0f to
b0d6af1
Compare
Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
puneetdixit200
force-pushed
the
49040-jwt-client-validator-extensibility
branch
from
May 23, 2026 14:35
b0d6af1 to
dd8bfa2
Compare
Contributor
Author
|
Addressed the requested compile-time API stability comment on the extensibility test subclass. Verification:
|
slaskawi
approved these changes
May 25, 2026
Contributor
|
Looks good to me! Thanks for great work @puneetdixit200 ! |
Contributor
mabartos
reviewed
May 25, 2026
Member
There was a problem hiding this comment.
@puneetdixit200 LGTM, but I think the test is not necessary. Please remove it.
@slaskawi Thanks for the review.
The validator method visibility change is enough for the extension point, and reviewers asked to drop the compile-time test. Generated-by: OpenAI Codex Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
Contributor
Author
|
Removed the extensibility test in Verification:
|
mabartos
approved these changes
May 25, 2026
Contributor
Closed
sashyo
pushed a commit
to tide-foundation/keycloak-IGA
that referenced
this pull request
Jul 20, 2026
* Make JWT client validators extensible Expose JWT client validator validation helpers to subclasses so downstream integrations can customize individual validation steps without copying the full validator implementation. Closes keycloak#49040 Signed-off-by: Puneet Dixit <rvit23bcs086.rvitm@rvei.edu.in> * Simplify validator extensibility test Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com> * Remove validator extensibility test The validator method visibility change is enough for the extension point, and reviewers asked to drop the compile-time test. Generated-by: OpenAI Codex Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com> --------- Signed-off-by: Puneet Dixit <rvit23bcs086.rvitm@rvei.edu.in> Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com> Co-authored-by: Puneet Dixit <rvit23bcs086.rvitm@rvei.edu.in> Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #49040
Summary
AbstractJWTClientValidatortoprotectedso downstreamvalidators can override individual validation steps instead of copying the full class.
AbstractJWTClientValidatorandFederatedJWTClientValidator.Testing
./mvnw -pl services -am -Dtest=JWTClientValidatorExtensibilityTest test./mvnw -pl services spotless:checkAI agent usage