Skip to content

Allow cross-client exchange of DPoP-bound tokens#51019

Open
arnabnandy7 wants to merge 1 commit into
keycloak:mainfrom
arnabnandy7:fix/dpop-cross-client-token-exchange
Open

Allow cross-client exchange of DPoP-bound tokens#51019
arnabnandy7 wants to merge 1 commit into
keycloak:mainfrom
arnabnandy7:fix/dpop-cross-client-token-exchange

Conversation

@arnabnandy7

Copy link
Copy Markdown
Contributor

Summary

Permit a different authorized client to exchange a DPoP-bound subject token after validating proof of possession.

The requester must remain within the subject token’s audience, and the supplied DPoP proof must match the token’s cnf.jkt binding. Audience checks and restrictions for non-DPoP sender-constrained tokens remain unchanged.

Testing

  • Verified the services reactor compiles.
  • Verified same-client and cross-client DPoP token exchange.
  • Verified missing and mismatched DPoP proofs are rejected.
  • Ran spotless:check.

Closes #51014

Copilot AI review requested due to automatic review settings July 19, 2026 16:29
@arnabnandy7
arnabnandy7 requested review from a team as code owners July 19, 2026 16:29

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Enables authorized cross-client exchange of DPoP-bound subject tokens while preserving proof-of-possession and audience requirements.

Changes:

  • Relaxes the same-client restriction for DPoP-bound tokens.
  • Adds cross-client exchange coverage.
  • Updates security and upgrade documentation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
StandardTokenExchangeProvider.java Implements cross-client DPoP exchange validation.
DPoPTest.java Tests successful cross-client exchange.
token-exchange.adoc Documents sender-constrained token rules.
dpop.adoc Documents cross-client DPoP requirements.
changes-26_8_0.adoc Adds an upgrade note.

Permit a different authorized client to exchange a DPoP-bound subject token after validating proof of possession. Keep audience checks and non-DPoP sender constraints unchanged.

Closes keycloak#51014

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
Copilot AI review requested due to automatic review settings July 19, 2026 16:50
@arnabnandy7
arnabnandy7 force-pushed the fix/dpop-cross-client-token-exchange branch from 2fcd3e7 to 44d5874 Compare July 19, 2026 16:50

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Standard Token Exchange V2 refuses cross-client exchange of DPoP-bound subject_tokens

2 participants