Skip to content

PR #50342: oid4vci-feat: Add provider ID detail to refresh token events and impl…#50705

Merged
pskopek merged 3 commits into
keycloak:mainfrom
jimmychakkalakal:features/50342_refresh_token_prov_claim_vx_type_field
Jul 17, 2026
Merged

PR #50342: oid4vci-feat: Add provider ID detail to refresh token events and impl…#50705
pskopek merged 3 commits into
keycloak:mainfrom
jimmychakkalakal:features/50342_refresh_token_prov_claim_vx_type_field

Conversation

@jimmychakkalakal

@jimmychakkalakal jimmychakkalakal commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Decision: Use prov field instead of custom token type

After analysis, I've retained the prov field on RefreshToken rather than introducing a new type like "Refresh-oid4vci".

Rationale:

  1. Avoids risky changes - A custom type requires modifying 6+ files with hardcoded type checks (TokenRevocationEndpoint, TokenManager, UserSessionUtil, etc.), each carrying regression risk
  2. Wrong dependency - DefaultRefreshTokenProvider would need to explicitly exclude "Refresh-oid4vci", making core code depend on feature code
  3. Breaks issue [OID4VCI] Refresh token revocation support #50341 - That PR already dispatches on prov claim; switching to type would conflict
  4. Established pattern - prov is already the SPI discriminator; OID4VCIRefreshTokenProvider uses it in supports()

Implementation:

  • Added Details.REFRESH_TOKEN_PROVIDER_ID constant
  • Emit refresh_token_provider_id event detail in token refresh, revocation, and initial issuance events
  • Provider ID discriminates token ownership without changing token type checks

Closes #50342

@jimmychakkalakal
jimmychakkalakal requested a review from Copilot July 9, 2026 07:41
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR standardizes emitting the refresh token provider identifier (refresh_token_provider_id) into Keycloak events, enabling downstream consumers to distinguish refresh-token ownership (e.g., OID4VCI vs default) without introducing new refresh token types.

Changes:

  • Adds Details.REFRESH_TOKEN_PROVIDER_ID and emits it during initial issuance (code-to-token), refresh, and revocation flows.
  • Extends the refresh token provider SPI with a default getProviderId() and overrides it for OID4VCI.
  • Adds an integration test validating the emitted provider ID for both OID4VCI and default refresh tokens.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Adds integration coverage for refresh_token_provider_id on REFRESH_TOKEN, REVOKE_GRANT, and CODE_TO_TOKEN events.
services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java Emits refresh_token_provider_id detail during initial refresh token issuance.
services/src/main/java/org/keycloak/protocol/oidc/refresh/RefreshTokenProvider.java Adds SPI default method getProviderId() for consistent provider identification.
services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java Emits refresh_token_provider_id detail during refresh-token grant processing.
services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java Emits refresh_token_provider_id detail during refresh token revocation.
services/src/main/java/org/keycloak/protocol/oid4vc/refresh/OID4VCIRefreshTokenProvider.java Overrides getProviderId() to return the OID4VCI provider ID.
server-spi-private/src/main/java/org/keycloak/events/Details.java Introduces the REFRESH_TOKEN_PROVIDER_ID event detail constant.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java Outdated
Comment thread services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java Outdated
Comment thread services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch 2 times, most recently from 4662cf0 to aa54459 Compare July 9, 2026 08:01
@jimmychakkalakal
jimmychakkalakal requested a review from Copilot July 9, 2026 08:01
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
@jimmychakkalakal
jimmychakkalakal requested a review from Copilot July 9, 2026 08:29
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java Outdated
Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 2ea1f29 to 55629a9 Compare July 9, 2026 08:42
@jimmychakkalakal
jimmychakkalakal requested a review from Copilot July 9, 2026 08:42
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java
Comment thread services/src/main/java/org/keycloak/protocol/oidc/refresh/RefreshTokenProvider.java
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 55629a9 to 859ee49 Compare July 9, 2026 08:47
@jimmychakkalakal
jimmychakkalakal requested a review from Copilot July 9, 2026 08:47
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java Outdated
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 859ee49 to 9136905 Compare July 9, 2026 08:54
@jimmychakkalakal
jimmychakkalakal requested a review from Copilot July 9, 2026 08:54
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
@jimmychakkalakal
jimmychakkalakal marked this pull request as ready for review July 10, 2026 12:56
@jimmychakkalakal
jimmychakkalakal requested a review from a team as a code owner July 10, 2026 12:56
@jimmychakkalakal jimmychakkalakal changed the title oid4vci-feat: Add provider ID detail to refresh token events and impl… PR #50342: oid4vci-feat: Add provider ID detail to refresh token events and impl… Jul 13, 2026
Copilot AI review requested due to automatic review settings July 14, 2026 14:13
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 9136905 to 5dc9474 Compare July 14, 2026 14:13
Copilot AI reviewed Jul 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java Outdated
Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java Outdated
Copilot AI review requested due to automatic review settings July 14, 2026 14:46
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 5dc9474 to 9eab14d Compare July 14, 2026 14:46
Copilot AI reviewed Jul 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java
Comment on lines +79 to +80
String providerIdDetail = oldRefreshToken.getProvider() != null ? oldRefreshToken.getProvider() : getProviderId();
event.detail(Details.REFRESH_TOKEN_PROVIDER_ID, providerIdDetail);
Comment thread services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
Comment on lines +1259 to +1260
String providerId = refreshToken.getProvider() != null ? refreshToken.getProvider() : refreshTokenProvider.getProviderId();
event.detail(Details.REFRESH_TOKEN_PROVIDER_ID, providerId);
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java
Comment on lines +127 to +133
String refreshToken = tokenResponse.getRefreshToken();
oauth.doTokenRevoke(refreshToken);

EventAssertion.assertSuccess(events.poll())
.type(EventType.REVOKE_GRANT)
.details(Details.REFRESH_TOKEN_PROVIDER_ID,
OID4VCIRefreshTokenProviderFactory.PROVIDER_ID);
graziang
graziang approved these changes Jul 16, 2026
View reviewed changes

@graziang graziang left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jimmychakkalakal thanks! The decision to keep the prov claim rather than a custom token type seems seems reasonable.

lhanusov
lhanusov suggested changes Jul 16, 2026
View reviewed changes

@lhanusov lhanusov left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jimmychakkalakal Hi Jimmy, please, take a look and let me know what you think about my comments. If it makes sense, please address.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java
Copilot AI review requested due to automatic review settings July 16, 2026 13:31
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 3aa5ef1 to 438dd63 Compare July 16, 2026 13:32
Copilot AI reviewed Jul 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCRefreshTokenProviderEventTest.java
Copilot AI review requested due to automatic review settings July 16, 2026 13:33
Copilot AI reviewed Jul 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comment thread services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
Comment on lines +1259 to +1260
String providerId = refreshToken.getProvider() != null ? refreshToken.getProvider() : refreshTokenProvider.getProviderId();
event.detail(Details.REFRESH_TOKEN_PROVIDER_ID, providerId);
@jimmychakkalakal

jimmychakkalakal commented Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

@lhanusov Thanks for the comments. I have changed the implementation. Please review, when you have time

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 16, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 16, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithoutFailover

Keycloak CI - Clustering IT

org.opentest4j.AssertionFailedError: expected: <false> but was: <true>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertFalse.failNotFalse(AssertFalse.java:63)
	at org.junit.jupiter.api.AssertFalse.assertFalse(AssertFalse.java:36)
...

Report flaky test

org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithFailover

Keycloak CI - Clustering IT

org.opentest4j.AssertionFailedError: expected: <false> but was: <true>
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.assertEntityOnSurvivorNodesEqualsTo(AbstractInvalidationClusterTest.java:168)
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.crud(AbstractInvalidationClusterTest.java:65)
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.crudWithFailover(AbstractInvalidationClusterTest.java:49)
	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
...

Report flaky test

@jimmychakkalakal
oid4vci-feat: Add provider ID detail to refresh token events and impl…
81f5956 
…ement provider ID retrieval

Closes keycloak#50342

Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
@jimmychakkalakal
oid4vci-feat: Add provider ID detail to refresh token events and impl…
5be9235 
…ement provider ID retrieval

Closes keycloak#50342

Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
@jimmychakkalakal
Worked on reviewers suggestions
bad26c9 
Closes keycloak#50342

Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
Copilot AI review requested due to automatic review settings July 17, 2026 09:15
@jimmychakkalakal
jimmychakkalakal force-pushed the features/50342_refresh_token_prov_claim_vx_type_field branch from 438dd63 to bad26c9 Compare July 17, 2026 09:15
Copilot AI reviewed Jul 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

@pskopek
pskopek merged commit fb3d0d8 into keycloak:main Jul 17, 2026
97 of 100 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
+3 more reviewers
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
@graziang graziang graziang approved these changes
@lhanusov lhanusov lhanusov approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test team/core-protocols

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Do we need 'prov' claim on the refresh token?

5 participants

@jimmychakkalakal @graziang @lhanusov @pskopek