Repository navigation
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients.
Changes:
- Adds
target_clientrequest support and client discovery. - Updates pre-authorized issuance flows and tests.
- Adds offer-state inspection utilities.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
CredentialOfferUriRequest.java |
Adds the target-client query parameter. |
OID4VCredentialOfferPreAuthTest.java |
Tests target-client validation and discovery. |
OID4VCPublicClientPreAuthTest.java |
Specifies the public target client. |
OID4VCJWTIssuerEndpointPreAuthTest.java |
Supplies target clients in endpoint tests. |
OID4VCAuthorizationDetailsFlowPreAuthTestBase.java |
Associates authorization-details offers with a client. |
JwtPreAuthCodeHandlerTest.java |
Associates test offers with their client. |
OID4VCTestContext.java |
Exposes the context client ID. |
OID4VCredentialOfferAuthCodeTest.java |
Verifies auth-code offers remain unbound. |
OID4VCCredentialOfferCorsTest.java |
Updates target parameter names and requests. |
OID4VCSdJwtIssuingEndpointTest.java |
Supplies the SD-JWT target client. |
CredentialOfferStateUtils.java |
Adds server-side offer-state inspection. |
VerifiableCredentialOfferAction.java |
Adapts provider argument ordering. |
OID4VCIssuerEndpoint.java |
Accepts and forwards explicit target clients. |
DefaultCredentialOfferProvider.java |
Implements target-client discovery and validation. |
CredentialOfferProvider.java |
Updates provider parameter ordering. |
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
2 times, most recently
from
July 15, 2026 06:55
b99783b to
baa1a5a
Compare
tdiesler
marked this pull request as ready for review
July 15, 2026 06:56
tdiesler
marked this pull request as draft
July 15, 2026 16:11
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
4 times, most recently
from
July 16, 2026 10:03
179ef83 to
54a9776
Compare
tdiesler
marked this pull request as ready for review
July 16, 2026 12:18
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 16, 2026 14:15
54a9776 to
c9c73c8
Compare
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 17, 2026 07:50
c9c73c8 to
c2e4d48
Compare
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 17, 2026 08:57
c2e4d48 to
acf7e4a
Compare
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 17, 2026 15:46
acf7e4a to
7914057
Compare
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 17, 2026 19:37
7914057 to
9cea73c
Compare
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 29, 2026 16:59
9cea73c to
e90178f
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/DefaultCredentialOfferProvider.java:201
- Discovery scans every client in the realm and materializes each lazy JPA client to read enabled/attributes, then loads optional-scope mappings for every OID4VCI candidate at line 206. This makes each offer without
target_clientan O(number of realm clients) multi-query path, which can make offer creation prohibitively expensive in large realms; use a storage-level lookup keyed by the required client-scope mappings instead.
List<ClientModel> candidateClients = session.clients().getClientsStream(realm)
.filter(ClientModel::isEnabled)
.filter(c -> Boolean.parseBoolean(c.getAttributes().get(OID4VCI_ENABLED_ATTRIBUTE_KEY)))
.toList();
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
July 29, 2026 19:04
e90178f to
6e3da50
Compare
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.webauthn.registration.passwordless.PwdLessOtherSettingsTest#timeout |
forkimenjeckayang
suggested changes
Aug 14, 2026
Contributor
There was a problem hiding this comment.
a few comments @tdiesler
Pleaset let me know what you think when chanced
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
October 8, 2026 10:21
6e3da50 to
1c780f1
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It changes security-sensitive client binding across credential offer creation and redemption flows.
0 open findings
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
closes keycloak#50587 Signed-off-by: Thomas Diesler <tdiesler@proton.me> Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients. * Adds target_client request support and client discovery. * Updates pre-authorized issuance flows and tests. * Adds offer-state inspection utilities.
tdiesler
force-pushed
the
ghi50578-preauth-client
branch
from
October 8, 2026 12:28
1c780f1 to
d907738
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It changes security-sensitive client binding across offer creation, token issuance, and credential redemption, warranting final human review.
0 open findings
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #50587
Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients.
depends on