[OID4VCI]: Fix `getAttestationRequirements()` for non-JWT proof types by Awambeng · Pull Request #50724 · keycloak/keycloak

Awambeng · 2026-07-09T10:02:23Z

This PR fixes getAttestationRequirements() to use the configured proof type instead of always reading the jwt configuration.

Key changes

Pass proofTypeKey through validateAttestationPayload() to getAttestationRequirements()
Replace the hardcoded ProofType.JWT lookup with proofTypeKey
Remove the unused ProofType.JWT import
Add unit tests covering both jwt and attestation proof types and missing configuration cases

Closes #50521

Copilot

Pull request overview

Fixes OID4VCI attestation validation so key_attestations_required is read from the actual proof-type entry being validated (e.g., attestation) rather than always reading the jwt entry, aligning behavior with configured metadata and closing #50521.

Changes:

Thread the proof-type key through validateAttestationPayload(...) into getAttestationRequirements(...).
Replace the hardcoded ProofType.JWT lookup with .get(proofTypeKey), and remove the unused static import.
Add unit tests verifying correct lookup for both jwt and attestation, plus missing/unsupported configuration cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java	Fixes attestation requirements lookup to use the provided proof-type key instead of hardcoding `jwt`.
services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java	Adds coverage proving requirements are read from the correct proof-type entry and handles missing config gracefully.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-21T09:13:44Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.webauthn.AppInitiatedActionWebAuthnSkipIfExistsTest#processSetupTwice

Keycloak CI - WebAuthn IT

java.lang.RuntimeException: Could not create statement
	at org.jboss.arquillian.junit.Arquillian.methodBlock(Arquillian.java:307)
	at org.jboss.arquillian.junit.Arquillian$2.evaluate(Arquillian.java:160)
	at org.jboss.arquillian.junit.Arquillian.multiExecute(Arquillian.java:344)
	at org.jboss.arquillian.junit.Arquillian.access$200(Arquillian.java:48)
...

Report flaky test

mposolda

@Awambeng Thanks for this PR! It looks good to me, but could you please rebase? There is conflict with your other PR merged ( #50517 )

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Awambeng · 2026-07-27T09:19:04Z

@Awambeng Thanks for this PR! It looks good to me, but could you please rebase? There is conflict with your other PR merged ( #50517 )

Thank you, @mposolda! I've rebased and resolved the conflicts. It should be ready to merge once the CI checks are done.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

- Thread proofTypeKey through validateAttestationPayload() to getAttestationRequirements() - Replace the hardcoded .get(JWT) lookup with .get(proofTypeKey) - Remove the unused ProofType.JWT import - Add unit tests verifying attestation requirements are read for the correct proof type Closes keycloak#50521 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java:87

The parameter name proofTypeKeyForSigningAlgPolicy no longer matches its expanded responsibility (it now affects both signing-alg policy and key_attestations_required lookup). Consider renaming the parameter (and corresponding Javadoc tag) to something like proofTypeKey / proofTypeKeyForConfigLookup to reflect its actual usage.

     * @param proofTypeKeyForSigningAlgPolicy {@link org.keycloak.protocol.oid4vc.model.ProofType} value
     *                                        ({@code jwt} or {@code attestation}) to resolve
     *                                        {@code proof_signing_alg_values_supported} and
     *                                        {@code key_attestations_required}; if {@code null}, falls back to
     *                                        {@code ProofType.JWT} for attestation requirements and FAPI
     *                                        {@code ALLOWED_ALGORITHMS} for signing algorithms.

services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java:99

This comment states an invariant ('always ... never null') that conflicts with the production code’s defensive null checks. To avoid misleading future maintainers, reword to only describe the intent of the test (e.g., that it covers the empty-map case) without asserting the map can never be null.

        // supportedProofTypes is always an initialized HashMap (never null), so this covers the empty-map case.

Copilot AI review requested due to automatic review settings July 9, 2026 10:02

Awambeng requested a review from a team as a code owner July 9, 2026 10:02

keycloak-github-bot Bot added the team/core-protocols label Jul 9, 2026

Copilot started reviewing on behalf of Awambeng July 9, 2026 10:06 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread ...src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java

Comment thread ...test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java Outdated

Awambeng mentioned this pull request Jul 9, 2026

OID4VCI: getAttestationRequirements() hardcodes proof-type key to jwt ignoring other types adorsys/keycloak-oid4vc#306

Open

Copilot AI review requested due to automatic review settings July 9, 2026 10:33

Copilot started reviewing on behalf of Awambeng July 9, 2026 10:33 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 21, 2026 08:06

Awambeng force-pushed the issue-50521 branch from 18c7121 to 2547924 Compare July 21, 2026 08:06

Copilot started reviewing on behalf of Awambeng July 21, 2026 08:07 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

keycloak-github-bot Bot added the flaky-test label Jul 21, 2026

This was referenced Jul 21, 2026

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested #51052

Closed

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested #51053

Closed

keycloak-github-bot Bot reviewed Jul 21, 2026

View reviewed changes

mposolda self-assigned this Jul 27, 2026

mposolda reviewed Jul 27, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 27, 2026 09:16

Awambeng force-pushed the issue-50521 branch from 2547924 to c2d0c4d Compare July 27, 2026 09:16

Copilot started reviewing on behalf of Awambeng July 27, 2026 09:17 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread ...src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java

Awambeng requested review from Copilot and mposolda July 27, 2026 09:19

Copilot started reviewing on behalf of Awambeng July 27, 2026 09:20 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

keycloak-github-bot Bot mentioned this pull request Jul 27, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1 #51075

Closed

Awambeng added 2 commits July 28, 2026 12:25

Address review comments from Copilot

f33c1c6

Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Copilot AI review requested due to automatic review settings July 28, 2026 11:25

Awambeng force-pushed the issue-50521 branch from c2d0c4d to f33c1c6 Compare July 28, 2026 11:25

Copilot AI reviewed Jul 28, 2026

View reviewed changes

Comment thread ...src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java

Copilot started reviewing on behalf of Awambeng July 28, 2026 13:28 View session

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[OID4VCI]: Fix `getAttestationRequirements()` for non-JWT proof types - #50724

[OID4VCI]: Fix `getAttestationRequirements()` for non-JWT proof types#50724
Awambeng wants to merge 2 commits into
keycloak:mainfrom
adorsys:issue-50521

Awambeng commented Jul 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Uh oh!

mposolda left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Awambeng commented Jul 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Awambeng commented Jul 9, 2026

Key changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

org.keycloak.testsuite.webauthn.AppInitiatedActionWebAuthnSkipIfExistsTest#processSetupTwice

Uh oh!

mposolda left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Awambeng commented Jul 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants