8000 [OID4VCI-HAIP] Pass oid4vci-1_0-issuer-happy-flow by tdiesler · Pull Request #49221 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

[OID4VCI-HAIP] Pass oid4vci-1_0-issuer-happy-flow - #49221

Merged
mposolda merged 1 commit into
keycloak:mainfrom
tdiesler:ghi47316
Jun 2, 2026
Merged

mposolda merged 1 commit into
keycloak:mainfrom
tdiesler:ghi47316

Conversation

@tdiesler
Copy link
Copy Markdown
Contributor

closes #47316

-- add x5c certificates to header except for trust anchor
-- add DPoP to token and credential request
-- add DPoP support to basic wallet
-- explicit usage of nonce in credential proof

@tdiesler
tdiesler requested a review from a team as a code owner May 21, 2026 14:00
@tdiesler
tdiesler requested review from a team as code owners May 21, 2026 15:52
@tdiesler
tdiesler force-pushed the ghi47316 branch 3 times, most recently from 468df62 to c221c91 Compare May 21, 2026 18:41
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostSigEmailTest

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testReloginWithInvalidAuthSessionCookie

Keycloak CI - Adapter IT Strict Cookies

org.awaitility.core.ConditionTimeoutException: Assertion condition defined as a Lambda expression in org.keycloak.testsuite.util.URLAssert URL expected to begin with: https://localhost:8543/auth/realms/demo/login-action ; actual URL: https://localhost:8643/sales-post-sig-email/ ==> expected: <true> but was: <false> within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
...

Report flaky test

mposolda
mposolda previously approved these changes May 22, 2026
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdiesler Thanks!

@mposolda mposolda self-assigned this May 22, 2026
@tdiesler
tdiesler force-pushed the ghi47316 branch 4 times, most recently from 018cb18 to 7a9b991 Compare May 24, 2026 08:45
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdiesler Can you please rebase on top of latest main? As in the meantime, I've merged other PR by Dominik, which was also important and was in the queue for a longer time:#48869 .

There will be likely some small update needed in the HAIPIssuerConformanceTest in the configuration of trusted keys (instead of option on the client-authenticator, there is a need to create IDP and reference this IDP from the client configuration. You can check similar changes for the OIDCAttestationBasedClientAuthenticationTest in that PR)

closes keycloak#47316

-- add x5c certificates to header except for trust anchor
-- add DPoP to token and credential request
-- add DPoP support to basic wallet
-- explicit usage of nonce in credential proof

Signed-off-by: Thomas Diesler <tdiesler@proton.me>
@VinodAnandan
Copy link
Copy Markdown
Contributor

Thank you @tdiesler for rebasing the PR and thank you @mposolda for the review. Would it be possible to merge this PR now? It would be greatly appreciated.

@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdiesler Thanks!

@mposolda
mposolda merged commit b6bf7ee into keycloak:main Jun 2, 2026
87 checks passed
@tdiesler
tdiesler deleted the ghi47316 branch June 2, 2026 06:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[OID4VCI-HAIP] Pass oid4vci-1_0-issuer-happy-flow

4 participants

0