[OID4VCI] Explicit client association for pre-authorized offers by tdiesler · Pull Request #50897 · keycloak/keycloak

tdiesler · 2026-07-14T18:41:44Z

Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients.

Adds target_client request support and client discovery.
Updates pre-authorized issuance flows and tests.
Adds offer-state inspection utilities.

depends on

[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption #50576

Copilot

Pull request overview

Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients.

Changes:

Adds target_client request support and client discovery.
Updates pre-authorized issuance flows and tests.
Adds offer-state inspection utilities.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`CredentialOfferUriRequest.java`	Adds the target-client query parameter.
`OID4VCredentialOfferPreAuthTest.java`	Tests target-client validation and discovery.
`OID4VCPublicClientPreAuthTest.java`	Specifies the public target client.
`OID4VCJWTIssuerEndpointPreAuthTest.java`	Supplies target clients in endpoint tests.
`OID4VCAuthorizationDetailsFlowPreAuthTestBase.java`	Associates authorization-details offers with a client.
`JwtPreAuthCodeHandlerTest.java`	Associates test offers with their client.
`OID4VCTestContext.java`	Exposes the context client ID.
`OID4VCredentialOfferAuthCodeTest.java`	Verifies auth-code offers remain unbound.
`OID4VCCredentialOfferCorsTest.java`	Updates target parameter names and requests.
`OID4VCSdJwtIssuingEndpointTest.java`	Supplies the SD-JWT target client.
`CredentialOfferStateUtils.java`	Adds server-side offer-state inspection.
`VerifiableCredentialOfferAction.java`	Adapts provider argument ordering.
`OID4VCIssuerEndpoint.java`	Accepts and forwards explicit target clients.
`DefaultCredentialOfferProvider.java`	Implements target-client discovery and validation.
`CredentialOfferProvider.java`	Updates provider parameter ordering.

…d for offer creation and redemption closes keycloak#48188 Signed-off-by: Thomas Diesler <tdiesler@proton.me> * Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers). * Keep pre-authorized code offers bound to the authenticated client. * Update Javadoc section headings to explicitly name the corresponding grant types.

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

closes keycloak#50587 Signed-off-by: Thomas Diesler <tdiesler@proton.me> Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients. * Adds target_client request support and client discovery. * Updates pre-authorized issuance flows and tests. * Adds offer-state inspection utilities.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings July 14, 2026 18:41

tdiesler requested a review from a team as a code owner July 14, 2026 18:41

keycloak-github-bot Bot added the team/core-protocols label Jul 14, 2026

tdiesler marked this pull request as draft July 14, 2026 18:41

Copilot started reviewing on behalf of tdiesler July 14, 2026 18:42 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

tdiesler force-pushed the ghi50578-preauth-client branch from bb30691 to b99783b Compare July 14, 2026 19:04

tdiesler force-pushed the ghi50578-preauth-client branch from b99783b to baa1a5a Compare July 15, 2026 06:55

tdiesler marked this pull request as ready for review July 15, 2026 06:56

Copilot AI review requested due to automatic review settings July 15, 2026 06:56

Copilot started reviewing on behalf of tdiesler July 15, 2026 06:56 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

tdiesler marked this pull request as draft July 15, 2026 16:11

tdiesler force-pushed the ghi50578-preauth-client branch 4 times, most recently from 179ef83 to 54a9776 Compare July 16, 2026 10:03

tdiesler marked this pull request as ready for review July 16, 2026 12:18

Copilot AI review requested due to automatic review settings July 16, 2026 12:18

Copilot started reviewing on behalf of tdiesler July 16, 2026 12:19 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 16, 2026 14:15

tdiesler force-pushed the ghi50578-preauth-client branch from 54a9776 to c9c73c8 Compare July 16, 2026 14:15

Copilot started reviewing on behalf of tdiesler July 16, 2026 14:26 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 17, 2026 07:50

tdiesler force-pushed the ghi50578-preauth-client branch from c9c73c8 to c2e4d48 Compare July 17, 2026 07:50

Copilot started reviewing on behalf of tdiesler July 17, 2026 07:51 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

tdiesler force-pushed the ghi50578-preauth-client branch from c2e4d48 to acf7e4a Compare July 17, 2026 08:57

Merge branch 'ghi48188-auth-code' into ghi50578-preauth-client

ff29b7a

Copilot AI review requested due to automatic review settings July 17, 2026 15:46

tdiesler force-pushed the ghi50578-preauth-client branch from acf7e4a to 7914057 Compare July 17, 2026 15:46

Copilot started reviewing on behalf of tdiesler July 17, 2026 15:46 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Comment thread ...va/org/keycloak/protocol/oid4vc/issuance/credentialoffer/DefaultCredentialOfferProvider.java Outdated

Copilot AI review requested due to automatic review settings July 17, 2026 19:37

tdiesler force-pushed the ghi50578-preauth-client branch from 7914057 to 9cea73c Compare July 17, 2026 19:37

Copilot started reviewing on behalf of tdiesler July 17, 2026 19:37 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Uh oh!

Conversation

tdiesler commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tdiesler commented Jul 14, 2026 •

edited

Loading