Repository navigation
[OID4VCI-FAPI2] Pass fapi2-security-profile-final-dpop-negative-tests - #50125
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Keycloak’s DPoP validation and OID4VC test utilities to satisfy the FAPI2 “final DPoP negative tests” expectations (issue #48070), tightening proof/JWK validation and aligning HTTP URI matching behavior.
Changes:
- Extend OID4VC wallet test helper API to allow sending
dpop_jkton authorization requests. - Normalize DPoP
htucomparison by stripping URI fragments (in addition to query) to match expected DPoP URL processing. - Harden DPoP proof header/JWK validation by rejecting missing
algand rejecting private-key material (d) in the embedded JWK.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCBasicWallet.java | Adds a fluent helper to set dpop_jkt on authorization requests in OID4VC tests. |
| services/src/main/java/org/keycloak/services/util/DPoPUtil.java | Tightens DPoP validation (URI normalization, alg presence check, reject JWK private-key parameter d). |
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.forms.MultipleTabsLoginTest#expiredAuthenticationAction_expiredCodeExpiredExecutionKeycloak CI - Forms IT (chrome) org.keycloak.testsuite.federation.kerberos.KerberosLdapTest#writableEditModeTestKeycloak CI - Java Distribution IT (windows-latest - temurin - 21) org.keycloak.testsuite.federation.kerberos.KerberosLdapTest#usernamePasswordLoginTestKeycloak CI - Java Distribution IT (windows-latest - temurin - 21) |
tdiesler
marked this pull request as draft
June 19, 2026 07:03
tdiesler
marked this pull request as ready for review
June 19, 2026 11:01
tdiesler
marked this pull request as draft
June 22, 2026 11:40
tdiesler
marked this pull request as ready for review
June 23, 2026 08:30
tdiesler
force-pushed
the
ghi48070
branch
2 times, most recently
from
June 23, 2026 14:44
ef268d5 to
3372c4f
Compare
mposolda
reviewed
Jun 25, 2026
| @@ -104,8 +106,18 @@ public enum Mode { | |||
| DISABLED | |||
| } | |||
|
|
|||
| private static final Set<String> JWK_PRIVATE_KEY_PARAMETERS = Set.of( | |||
Contributor
There was a problem hiding this comment.
Is it possible to use signatureProviderFactory..getJwkPrivateKeyClaims() method to retrieve names of private key claims dynamically? It is already used in the method JwtProofValidator.getPrivateClaimNames
Hardcoded claims are not ideal for few reasons... Especially we will need to add some support for post-quantum cryptography in the near future AFAIK, which would probably mean some additional algorithms supported and hence hardcoded list may cause some claims to be omitted (which might in theory have even security implications...).
closes keycloak#48070 Signed-off-by: Thomas Diesler <tdiesler@proton.me> * Extend OID4VC wallet test helper API to allow sending dpop_jkt on authorization requests. * Normalize DPoP htu comparison by stripping URI fragments (in addition to query) to match expected DPoP URL processing. * Harden DPoP proof header/JWK validation by rejecting missing alg and rejecting private-key material (d) in the embedded JWK.
mposolda
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #48070