8000 [OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption by tdiesler · Pull Request #50576 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption - #50576

Merged
mposolda merged 1 commit into
keycloak:mainfrom
tdiesler:ghi48188-auth-code-offer-client-binding
Jul 29, 2026
Merged

[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption#50576
mposolda merged 1 commit into
keycloak:mainfrom
tdiesler:ghi48188-auth-code-offer-client-binding

Conversation

@tdiesler
@tdiesler tdiesler commented Jul 2, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

closes #48188

Adjusts OID4VCI credential-offer creation so that Authorization Code Grant offers no longer assume the same client_id is used for both offer creation and subsequent redemption, addressing "wallets may authenticate/redeem using their own client".

  • Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers).
  • Keep pre-authorized code offers bound to the authenticated client.
  • Update Javadoc section headings to explicitly name the corresponding grant types.

Copilot AI review requested due to automatic review settings July 2, 2026 13:49
@tdiesler
tdiesler requested a review from a team as a code owner July 2, 2026 13:49
Copilot AI reviewed Jul 2, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adjusts OID4VCI credential-offer creation so that Authorization Code Grant offers no longer assume the same client_id is used for both offer creation and subsequent redemption, addressing #48188 (wallets may authenticate/redeem using their own client).

Changes:

  • Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers).
  • Keep pre-authorized code offers bound to the authenticated client.
  • Update Javadoc section headings to explicitly name the corresponding grant types.
Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java:446

  • The Javadoc for the authorization-code offer section doesn’t mention the newly introduced behavior that these offers are no longer bound to the client_id used to create them (only pre-authorized offers are). Adding an explicit bullet here would help prevent future regressions and clarify the intended security model (client authorization is enforced via configured credential scopes/policies, not by matching the creator client_id).
     * <b>Authorization Code Grant Offer</b>
     * <ul>
     *   <li>If targetUser is null or empty, the generated offer is "anonymous"</li>
     *   <li>If targetUser is equal to the current login, the offer is "self issued"</li>
     *   <li>If targetUser is none of the above, the offer is "targeted"</li>

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Resolved
Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Resolved
@tdiesler tdiesler mentioned this pull request Jul 2, 2026
Closed
1 of 2 tasks
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch 2 times, most recently from f496177 to 6267e81 Compare July 2, 2026 14:49
Copilot AI review requested due to automatic review settings July 3, 2026 09:30
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 6267e81 to 74e363e Compare July 3, 2026 09:30
Copilot AI reviewed Jul 3, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Resolved
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 74e363e to 57b9979 Compare July 3, 2026 09:38
@dominikschlosser
dominikschlosser commented Jul 3, 2026
Copy link
Copy Markdown
Contributor

@tdiesler LGTM but i just wonder why no test has to be changed for this? Maybe you should add one?

Copilot AI review requested due to automatic review settings July 3, 2026 12:46
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 57b9979 to 0b1cf55 Compare July 3, 2026 12:46
@tdiesler
tdiesler commented Jul 3, 2026
Copy link
Copy Markdown
Contributor Author

@tdiesler LGTM but i just wonder why no test has to be changed for this? Maybe you should add one?

Yes, good catch - I added the wanted test coverage

Copilot AI reviewed Jul 3, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Resolved
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 0b1cf55 to 5c2a54b Compare July 3, 2026 14:46
Copilot AI review requested due to automatic review settings July 3, 2026 14:51
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5c2a54b to 5fc887a Compare July 3, 2026 14:51
Copilot AI reviewed Jul 3, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Resolved
IngridPuppet
IngridPuppet approved these changes Jul 7, 2026
View reviewed changes
@IngridPuppet IngridPuppet 8BD0 left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thx

Copilot AI review requested due to automatic review settings July 13, 2026 08:12
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5fc887a to 9e21a77 Compare July 13, 2026 08:12
Copilot AI reviewed Jul 13, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

10000

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Resolved
Copilot AI review requested due to automatic review settings July 13, 2026 08:30
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 9e21a77 to 5fc887a Compare July 13, 2026 08:30
Copilot AI reviewed Jul 13, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings July 14, 2026 14:44
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5fc887a to 1f19a27 Compare July 14, 2026 14:44
Copilot AI reviewed Jul 14, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Resolved
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Resolved
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Resolved
Copilot AI review requested due to automatic review settings July 14, 2026 18:27
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 1f19a27 to b2a132e Compare July 14, 2026 18:27
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 234c341 to b2a132e Compare July 14, 2026 18:30
Copilot AI reviewed Jul 14, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@tdiesler tdiesler mentioned this pull request Jul 14, 2026
Open
Copilot AI review requested due to automatic review settings July 14, 2026 19:00
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from b2a132e to 5fc887a Compare July 14, 2026 19:00
Copilot AI reviewed Jul 14, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@tdiesler
[OID4VCI] Issuance with Authorization Code Flow assumes same client_i…
6b8ed25 
…d for offer creation and redemption

closes keycloak#48188

Signed-off-by: Thomas Diesler <tdiesler@proton.me>

* Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers).
* Keep pre-authorized code offers bound to the authenticated client.
* Update Javadoc section headings to explicitly name the corresponding grant types.
Copilot AI review requested due to automatic review settings July 15, 2026 06:18
@tdiesler
tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5fc887a to 6b8ed25 Compare July 15, 2026 06:18
Copilot AI reviewed Jul 15, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@mposolda mposolda self-assigned this Jul 29, 2026
mposolda
mposolda approved these changes Jul 29, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdiesler @dominikschlosser @IngridPuppet Thanks for the PR and for the reviews!

@mposolda
mposolda merged commit b39de11 into keycloak:main Jul 29, 2026
91 checks passed
@tdiesler
tdiesler deleted the ghi48188-auth-code-offer-client-binding branch July 29, 2026 12:48
Copilot AI mentioned this pull request Aug 7, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@mposolda mposolda mposolda approved these changes
+2 more reviewers
@dominikschlosser dominikschlosser dominikschlosser approved these changes
@IngridPuppet IngridPuppet IngridPuppet approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

Labels

team/core-protocols

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption

5 participants

@tdiesler @dominikschlosser @mposolda @IngridPuppet
0