Skip to content

[OID4VP] Add support for direct_post.jwt response mode - #50932

Merged
rmartinc merged 1 commit into
keycloak:mainfrom
dominikschlosser:ghi50644
Jul 23, 2026
Merged

[OID4VP] Add support for direct_post.jwt response mode#50932
rmartinc merged 1 commit into
keycloak:mainfrom
dominikschlosser:ghi50644

Conversation

@dominikschlosser

@dominikschlosser dominikschlosser commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@rmartinc @vaceksimon

Closes #50644

Conformance results

Single run on the final state of this branch. Common variant:
credential_format=sd_jwt_vc, client_id_prefix=x509_hash, request_method=request_uri_signed.

Plan oid4vp-1final-verifier-test-plan

Variant Modules Result
vp_profile=plain_vp, response_mode=direct_post happy-flow, minimal-cnf-jwk, invalid-kb-jwt-{signature, nonce, aud}, invalid-credential-signature, invalid-sd-hash, kb-jwt-iat-in-{past, future} 9 passed
vp_profile=plain_vp, response_mode=direct_post.jwt happy-flow, invalid-kb-jwt-nonce 2 passed

Plan oid4vp-1final-verifier-haip-test-plan (new in 5.2.0, mandates direct_post.jwt)

Ran locally, has to be implemented in main as soon as the suite version has been bumped (see #51060 )

Variant Modules Result
response_mode=direct_post.jwt (vp_profile=haip) same 9 modules as the plain plan 9 passed

Totals: 20 modules passed, 0 failed, 2 disabled.

Disabled (@Disabled with TODO, same module in both plans): verifier-request-uri-method-post —
request_uri retrieval via POST is not implemented, the request object endpoint answers GET only.
These can be enabled as soon as #50661 is implemented.

Not run (plan variants for unimplemented features): credential_format=iso_mdl,
client_id_prefix=x509_san_dns|redirect_uri, request_method=url_query.

@dominikschlosser
dominikschlosser marked this pull request as ready for review July 15, 2026 17:12
@dominikschlosser
dominikschlosser requested a review from a team as a code owner July 15, 2026 17:12
@keycloak-github-bot

keycloak-github-bot Bot commented Jul 15, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#multipleSecurityKeys

Keycloak CI - WebAuthn IT

java.lang.AssertionError: 

Expected: is <4>
     but: was <0>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
...

Report flaky test

org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithoutFailover

Keycloak CI - Store IT (mysql)

org.opentest4j.AssertionFailedError: expected: <false> but was: <true>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertFalse.failNotFalse(AssertFalse.java:63)
	at org.junit.jupiter.api.AssertFalse.assertFalse(AssertFalse.java:36)
...

Report flaky test

org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithFailover

Keycloak CI - Store IT (mysql)

org.opentest4j.AssertionFailedError: expected: <false> but was: <true>
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.assertEntityOnSurvivorNodesEqualsTo(AbstractInvalidationClusterTest.java:168)
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.crud(AbstractInvalidationClusterTest.java:65)
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTest.crudWithFailover(AbstractInvalidationClusterTest.java:49)
	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 15, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

rmartinc
rmartinc requested changes Jul 17, 2026
View reviewed changes

@rmartinc rmartinc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @dominikschlosser! LGTM in general. Just two suggestions if those make sense to you. Another problem detected is the conformance tests are broken for the VCI part (not for the VP part). Testing downgrading the version to the previous release-v5.1.44 seems to work, so maybe you can skip the upgrade in this PR and manage it as a follow-up issue. See https://github.com/rmartinc/keycloak/actions/runs/29565752941/job/87838591840.

I have done some little test in my branch https://github.com/rmartinc/keycloak/tree/pr-50932 (last test commit). There I tested point 2 for the first suggestion and also the modifications in the test classes.Check if those changes make some sense to you...

Comment thread services/src/main/java/org/keycloak/broker/oid4vp/OID4VPIdentityProvider.java Outdated
Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPDirectPostJwtTest.java Outdated
vaceksimon
vaceksimon approved these changes Jul 20, 2026
View reviewed changes

@vaceksimon vaceksimon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apart from what @rmartinc mentioned regarding the @BeforeEach methods in the tests, I don't see any other issues

@dominikschlosser
[OID4VP] Add support for direct_post.jwt response mode
ac3c619 
Signed-off-by: Dominik Schlosser <dominik.schlosser@gmail.com>
This was referenced Jul 21, 2026
Closed
Closed
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 21, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 21, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

rmartinc
rmartinc approved these changes Jul 23, 2026
View reviewed changes

@rmartinc rmartinc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @dominikschlosser for the changes! And thanks @vaceksimon for the review!

@rmartinc
rmartinc merged commit 798dc35 into keycloak:main Jul 23, 2026
91 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rmartinc rmartinc rmartinc approved these changes
+2 more reviewers
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
@vaceksimon vaceksimon vaceksimon approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VP] Support direct_post.jwt (encrypted) response mode

3 participants

@dominikschlosser @rmartinc @vaceksimon