[OID4VCI] Fix unbounded OID4VCI credential offer expiration by forkimenjeckayang · Pull Request #50957 · keycloak/keycloak

forkimenjeckayang · 2026-07-16T13:12:41Z

This change prevents /create-credential-offer from creating credential
offers and pre-authorized codes with an unbounded expiration.

It also binds REST-created pre-authorized offers to the session that
authorized their creation, allowing logout and password changes to revoke
outstanding pre-authorized codes.

Changes

Validate the expire parameter:
- It must be later than the current time.
- It must not exceed the configured credential-offer lifespan.
Use long expiration timestamps to avoid integer overflow.
Record the creation time of credential offers.
Reject offers whose lifetime exceeds the configured maximum.
Reject legacy pre-authorized offers without creation-time information.
Store the originating user and user-session identifiers for REST-created
pre-authorized offers.
Record the originating user's password credential creation timestamp.
Reject pre-authorized code redemption when:
- The originating session no longer exists or is no longer active.
- The originating user is disabled or no longer matches the session.
- The originating user's password has changed.
Keep the originating session active in wallet tests until the
pre-authorized code is redeemed.
Preserve compatibility with existing CredentialOfferProvider
implementations through the existing Integer-based SPI method.

closes #50520

Copilot

Pull request overview

Prevents unbounded OID4VCI credential offers and binds REST-created pre-authorized codes to their originating sessions.

Changes:

Validates offer expiration and introduces long timestamps.
Revokes codes after logout, user disablement, or password changes.
Adds integration and SPI compatibility tests.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`CredentialOfferUriRequest.java`	Supports long expiration values.
`OID4VCredentialOfferPreAuthTest.java`	Tests expiration and session revocation.
`OID4VCBasicWallet.java`	Keeps originating sessions active during tests.
`PreAuthorizedCodeGrantTypeTest.java`	Tests lifespan validation.
`CredentialOfferProviderTest.java`	Tests SPI delegation.
`PreAuthorizedCodeGrantType.java`	Validates lifespan and originating session.
`VerifiableCredentialOfferAction.java`	Widens calculated expiration.
`OID4VCIssuerEndpoint.java`	Bounds expiration and records session metadata.
`DefaultCredentialOfferProvider.java`	Implements long expiration support.
`CredentialOfferState.java`	Stores creation and originating-session metadata.
`CredentialOfferProvider.java`	Adds a compatible long overload.

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java:571

Legacy stateless access tokens decode to UNKNOWN; bearer authentication then reconstructs a transient session for non-service-account users, but this check treats it as persistent and stores a request-scoped session ID that can never be resolved, so the resulting pre-authorized code always fails redemption. For UNKNOWN, fall back to the reconstructed session's persistence state and CREATED_FROM_PERSISTENT note before binding it.

                AccessTokenContext.SessionType originatingSessionType = session
                        .getProvider(TokenContextEncoderProvider.class)
                        .getTokenContextFromTokenId(getAuthResult().token().getId())
                        .getSessionType();
                boolean transientUserSession = originatingSessionType == AccessTokenContext.SessionType.TRANSIENT;

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-21T08:13:59Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java:571

Legacy/unencoded token IDs produce SessionType.UNKNOWN; when such a normal-user token has no session ID, UserSessionUtil.java:86-88 reconstructs a transient request-scoped session. This check then binds that ephemeral ID, so the resulting offer can never be redeemed; include the actual session persistence state when handling UNKNOWN.

                boolean transientUserSession = originatingSessionType == AccessTokenContext.SessionType.TRANSIENT;

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-21T10:33:54Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

forkimenjeckayang requested a review from a team as a code owner July 16, 2026 13:12

Copilot AI review requested due to automatic review settings July 16, 2026 13:12

Copilot started reviewing on behalf of forkimenjeckayang July 16, 2026 13:13 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

forkimenjeckayang mentioned this pull request Jul 16, 2026

OID4VCI: Unbounded expire parameter on /create-credential-offer allows indefinite pre-auth codes adorsys/keycloak-oid4vc#311

Open

Copilot AI review requested due to automatic review settings July 16, 2026 14:28

Copilot started reviewing on behalf of forkimenjeckayang July 16, 2026 14:31 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated

Copilot AI review requested due to automatic review settings July 16, 2026 15:09

Copilot started reviewing on behalf of forkimenjeckayang July 16, 2026 15:10 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 17, 2026 08:18

forkimenjeckayang force-pushed the issue-50520 branch from a1cba9d to 96bfad7 Compare July 17, 2026 08:18

Copilot started reviewing on behalf of forkimenjeckayang July 17, 2026 08:19 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 17, 2026 13:29

forkimenjeckayang force-pushed the issue-50520 branch from 96bfad7 to b139949 Compare July 17, 2026 13:29

Copilot started reviewing on behalf of forkimenjeckayang July 17, 2026 13:30 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated

Copilot AI review requested due to automatic review settings July 17, 2026 14:22

forkimenjeckayang force-pushed the issue-50520 branch from 088b02b to 78a69b5 Compare July 17, 2026 14:24

Copilot started reviewing on behalf of forkimenjeckayang July 17, 2026 14:32 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 20, 2026 09:18

Copilot started reviewing on behalf of forkimenjeckayang July 20, 2026 09:18 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 21, 2026 07:11

Copilot started reviewing on behalf of forkimenjeckayang July 21, 2026 07:11 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

keycloak-github-bot Bot added the flaky-test label Jul 21, 2026

This was referenced Jul 21, 2026

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested #51052

Open

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested #51053

Open

keycloak-github-bot Bot reviewed Jul 21, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 21, 2026 09:19

Copilot started reviewing on behalf of forkimenjeckayang July 21, 2026 09:20 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Jul 21, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 22, 2026 08:30

Copilot started reviewing on behalf of forkimenjeckayang July 22, 2026 08:31 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/utils/OID4VCUtil.java

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated

Fix unbounded OID4VCI credential offer expiration

48bbcfa

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>

Copilot AI review requested due to automatic review settings July 22, 2026 09:13

forkimenjeckayang force-pushed the issue-50520 branch from 7cdccb8 to 48bbcfa Compare July 22, 2026 09:13

Copilot started reviewing on behalf of forkimenjeckayang July 22, 2026 09:21 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java

Comment thread services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java Outdated

address more review comments

f26ed1c

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>

Copilot AI review requested due to automatic review settings July 22, 2026 09:49

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Copilot started reviewing on behalf of forkimenjeckayang July 22, 2026 10:14 View session

address more review comments

c021924

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>

Copilot AI review requested due to automatic review settings July 22, 2026 10:26

Copilot started reviewing on behalf of forkimenjeckayang July 22, 2026 10:31 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Uh oh!

Conversation

forkimenjeckayang commented Jul 16, 2026

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!