Configurable may_act claim enforcement by mabartos · Pull Request #50980 · keycloak/keycloak

mabartos · 2026-07-17T12:57:38Z

Closes Configurable may_act claim enforcement #50979
Replaces hardcoded sub/iss validation in validateMayAct() with a generic enforcement loop that compares any configured claim 1:1 between may_act and the actor token
Enforced claims are controlled by a HardcodedClaim mapper (may_act enforce_claims) on the delegation client scope - admins configure enforcement by simply editing the mapper's JSON value (e.g. ["sub","iss","preferred_username"]), no server restart or realm config needed
Reuses the existing mapper infrastructure rather than introducing server-side configuration, keeping it lightweight
Falls back to default ["sub","iss"] enforcement when the mapper is removed or the list is empty
Strips enforce_claims from the resulting act claim to prevent leaking into the delegation chain

@rmartinc @keycloak/core-authn Could you please check it? Thanks!

Copilot

Pull request overview

Adds configurable may_act claim enforcement for token exchange delegation.

Changes:

Adds mapper-driven claim matching with default sub/iss enforcement.
Removes enforcement metadata from generated act claims.
Adds documentation and delegation tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
`TokenExchangeDelegationTest.java`	Tests configurable enforcement and fallback behavior.
`TokenExchangeDelegationProvider.java`	Implements generic claim enforcement.
`OIDCLoginProtocolFactory.java`	Adds the default enforcement mapper.
`token-exchange.adoc`	Documents enforced-claim configuration.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-20T10:16:27Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testEmptyBaseUrl

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Closes keycloak#50979 Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/TokenExchangeDelegationProvider.java:177

A present null value is treated as absent, so may_act: {"sub": null} passes the mandatory-key check and then skips the default actor binding entirely. Skip only claims whose key is absent, and reject a present null value as a mismatch.

            if (mayActValue == null) {
                continue;

keycloak-github-bot · 2026-07-20T11:21:44Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

mabartos · 2026-07-21T08:19:44Z

Put on hold for now based on the offline discussion.

mabartos self-assigned this Jul 17, 2026

mabartos force-pushed the KC-50979 branch from 1919be7 to 8a8b43d Compare July 17, 2026 12:59

mabartos marked this pull request as ready for review July 20, 2026 09:05

mabartos requested a review from a team as a code owner July 20, 2026 09:05

Copilot AI review requested due to automatic review settings July 20, 2026 09:05

Copilot started reviewing on behalf of mabartos July 20, 2026 09:05 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

Comment thread .../src/main/java/org/keycloak/protocol/oidc/tokenexchange/TokenExchangeDelegationProvider.java Outdated

mabartos marked this pull request as draft July 20, 2026 09:10

mabartos force-pushed the KC-50979 branch from 8a8b43d to 073737b Compare July 20, 2026 09:21

mabartos marked this pull request as ready for review July 20, 2026 09:22

Copilot AI review requested due to automatic review settings July 20, 2026 09:22

Copilot started reviewing on behalf of mabartos July 20, 2026 09:22 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

mabartos marked this pull request as draft July 20, 2026 10:05

mabartos force-pushed the KC-50979 branch from 073737b to 675511e Compare July 20, 2026 10:15

keycloak-github-bot Bot added the flaky-test label Jul 20, 2026

keycloak-github-bot Bot reviewed Jul 20, 2026

View reviewed changes

Configurable may_act claim enforcement

2257ae5

Closes keycloak#50979 Signed-off-by: Martin Bartoš <mabartos@redhat.com>

mabartos force-pushed the KC-50979 branch from 675511e to 2257ae5 Compare July 20, 2026 10:27

mabartos marked this pull request as ready for review July 20, 2026 10:27

Copilot AI review requested due to automatic review settings July 20, 2026 10:27

Copilot started reviewing on behalf of mabartos July 20, 2026 10:28 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

Comment thread .../src/main/java/org/keycloak/protocol/oidc/tokenexchange/TokenExchangeDelegationProvider.java

keycloak-github-bot Bot reviewed Jul 20, 2026

View reviewed changes

mabartos marked this pull request as draft July 21, 2026 08:19

mabartos added the status/hold PR should not be merged. On hold for later. label Jul 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Configurable may_act claim enforcement#50980

Configurable may_act claim enforcement#50980
mabartos wants to merge 1 commit into
keycloak:mainfrom
mabartos:KC-50979

mabartos commented Jul 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Jul 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

keycloak-github-bot Bot commented Jul 20, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

mabartos commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mabartos commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 20, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testEmptyBaseUrl

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

keycloak-github-bot Bot commented Jul 20, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mabartos commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mabartos commented Jul 17, 2026 •

edited

Loading