[OID4VCI]: Fix `getAttestationRequirements()` for non-JWT proof types by Awambeng · Pull Request #50724 · keycloak/keycloak

Awambeng · 2026-07-09T10:02:23Z

This PR fixes getAttestationRequirements() to use the configured proof type instead of always reading the jwt configuration.

Key changes

Pass proofTypeKey through validateAttestationPayload() to getAttestationRequirements()
Replace the hardcoded ProofType.JWT lookup with proofTypeKey
Remove the unused ProofType.JWT import
Add unit tests covering both jwt and attestation proof types and missing configuration cases

Closes #50521

Copilot

Pull request overview

Fixes OID4VCI attestation validation so key_attestations_required is read from the actual proof-type entry being validated (e.g., attestation) rather than always reading the jwt entry, aligning behavior with configured metadata and closing #50521.

Changes:

Thread the proof-type key through validateAttestationPayload(...) into getAttestationRequirements(...).
Replace the hardcoded ProofType.JWT lookup with .get(proofTypeKey), and remove the unused static import.
Add unit tests verifying correct lookup for both jwt and attestation, plus missing/unsupported configuration cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java	Fixes attestation requirements lookup to use the provided proof-type key instead of hardcoding `jwt`.
services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java	Adds coverage proving requirements are read from the correct proof-type entry and handles missing config gracefully.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-21T09:13:44Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.webauthn.AppInitiatedActionWebAuthnSkipIfExistsTest#processSetupTwice

Keycloak CI - WebAuthn IT

java.lang.RuntimeException: Could not create statement
	at org.jboss.arquillian.junit.Arquillian.methodBlock(Arquillian.java:307)
	at org.jboss.arquillian.junit.Arquillian$2.evaluate(Arquillian.java:160)
	at org.jboss.arquillian.junit.Arquillian.multiExecute(Arquillian.java:344)
	at org.jboss.arquillian.junit.Arquillian.access$200(Arquillian.java:48)
...

Report flaky test

mposolda

@Awambeng Thanks for this PR! It looks good to me, but could you please rebase? There is conflict with your other PR merged ( #50517 )

- Thread proofTypeKey through validateAttestationPayload() to getAttestationRequirements() - Replace the hardcoded .get(JWT) lookup with .get(proofTypeKey) - Remove the unused ProofType.JWT import - Add unit tests verifying attestation requirements are read for the correct proof type Closes keycloak#50521 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Awambeng · 2026-07-27T09:19:04Z

@Awambeng Thanks for this PR! It looks good to me, but could you please rebase? There is conflict with your other PR merged ( #50517 )

Thank you, @mposolda! I've rebased and resolved the conflicts. It should be ready to merge once the CI checks are done.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings July 9, 2026 10:02

Awambeng requested a review from a team as a code owner July 9, 2026 10:02

keycloak-github-bot Bot added the team/core-protocols label Jul 9, 2026

Copilot started reviewing on behalf of Awambeng July 9, 2026 10:06 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread ...src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java

Comment thread ...test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java Outdated

Awambeng mentioned this pull request Jul 9, 2026

OID4VCI: getAttestationRequirements() hardcodes proof-type key to jwt ignoring other types adorsys/keycloak-oid4vc#306

Open

Copilot AI review requested due to automatic review settings July 9, 2026 10:33

Copilot started reviewing on behalf of Awambeng July 9, 2026 10:33 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 21, 2026 08:06

Awambeng force-pushed the issue-50521 branch from 18c7121 to 2547924 Compare July 21, 2026 08:06

Copilot started reviewing on behalf of Awambeng July 21, 2026 08:07 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

keycloak-github-bot Bot added the flaky-test label Jul 21, 2026

This was referenced Jul 21, 2026

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested #51052

Open

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested #51053

Open

keycloak-github-bot Bot reviewed Jul 21, 2026

View reviewed changes

mposolda self-assigned this Jul 27, 2026

mposolda reviewed Jul 27, 2026

View reviewed changes

Awambeng added 2 commits July 27, 2026 10:16

Address review comments from Copilot

c2d0c4d

Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>

Copilot AI review requested due to automatic review settings July 27, 2026 09:16

Awambeng force-pushed the issue-50521 branch from 2547924 to c2d0c4d Compare July 27, 2026 09:16

Copilot started reviewing on behalf of Awambeng July 27, 2026 09:17 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread ...src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java

Awambeng requested review from Copilot and mposolda July 27, 2026 09:19

Copilot started reviewing on behalf of Awambeng July 27, 2026 09:20 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

keycloak-github-bot Bot mentioned this pull request Jul 27, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1 #51075

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[OID4VCI]: Fix `getAttestationRequirements()` for non-JWT proof types#50724

[OID4VCI]: Fix `getAttestationRequirements()` for non-JWT proof types#50724
Awambeng wants to merge 2 commits into
keycloak:mainfrom
adorsys:issue-50521

Awambeng commented Jul 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Uh oh!

mposolda left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Awambeng commented Jul 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Awambeng commented Jul 9, 2026

Key changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

org.keycloak.testsuite.webauthn.AppInitiatedActionWebAuthnSkipIfExistsTest#processSetupTwice

Uh oh!

mposolda left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Awambeng commented Jul 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants