[OID4VCI]: Enforce key_attestations_required when proof JWT omits key_attestation#50732
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR closes a validation gap in OID4VCI JWT proof handling by enforcing key_attestations_required even when the proof JWT omits the key_attestation JOSE header, preventing issuance with an unattested key when attestation is required by the credential configuration.
Changes:
- Enforce presence of
key_attestationheader claim whenkey_attestations_requiredis configured for the JWT proof type. - Expose and reuse
AttestationValidatorUtil.getAttestationRequirements()fromJwtProofValidator. - Update/extend test coverage with a dedicated regression test and a helper to build non-attestation contexts for unrelated JWT-proof validation tests.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java | Adjust test realm credential-scope setup to not require key attestation by default (uses null instead of non-null lists). |
| tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java | Adds regression test for missing key_attestation when required; adds helper context without attestation requirements and updates existing tests to use it. |
| services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidator.java | Rejects JWT proofs that omit key_attestation when the credential configuration requires key attestations. |
| services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtil.java | Makes getAttestationRequirements() public so it can be reused by JwtProofValidator. |
…ttestation - Reject proof JWTs that omit the key_attestation header when the credential configuration requires key attestations - Expose AttestationValidatorUtil.getAttestationRequirements() for reuse in JwtProofValidator - Add createVCIssuanceContextWithoutAttestation() test helper and update eight non-attestation JWT proof tests to avoid masking their validation intent - Add integration test to verify proof JWTs without key_attestation are rejected when required Closes keycloak#50517 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
This was referenced Jul 22, 2026
Contributor
Author
Agreed. It's only configurable via the Admin API for now. There are no UI fields or integration tests yet. Thanks for opening #51179 to track that. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR enforces required key attestations for proof JWT validation
Key Changes
key_attestations_requiredwhen thekey_attestationheader is missing from a proof JWTkey_attestationwhen attestation is required by the credential configurationAttestationValidatorUtil.getAttestationRequirements()inJwtProofValidatorcreateVCIssuanceContextWithoutAttestation()test helper for non-attestation test scenariosCloses #50517