[OpenID4VCI] Add support for mDoc (#48095) by dominikschlosser · Pull Request #48582 · keycloak/keycloak

dominikschlosser · 2026-04-29T11:25:32Z

Closes #48095

Adds support for issuance of mDoc credentials.

OID4VCI Conformance Tests passed using mdoc credential_format:

oid4vci-1_0-issuer-metadata-test
oid4vci-1_0-issuer-metadata-test-signed
oid4vci-1_0-issuer-happy-flow

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-04-29T15:38:33Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.ResetPasswordTest#resetPasswordWrongSmtp

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.NoSuchElementException: 
Unable to locate element: .pf\-m\-success
For documentation on this error, please visit: https://www.selenium.dev/documentation/webdriver/troubleshooting/errors#no-such-element-exception
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '25.0.2'
...

Report flaky test

org.keycloak.testsuite.forms.ResetPasswordTest#resetPassword

Keycloak CI - Forms IT (firefox)

java.lang.AssertionError: 
type
Expected: is "SEND_RESET_PASSWORD"
     but: was "SEND_RESET_PASSWORD_ERROR"
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
...

Report flaky test

IngridPuppet

Hello @dominikschlosser - I've gone through just a tiny part of the PR so far. I hope to send my complete review by Thursday. Thank you for implementing this support for mDoc credentials.

IngridPuppet

Hello @dominikschlosser - I went through the entire PR and left a few additional comments. Please could you check them?

dominikschlosser · 2026-05-15T15:55:19Z

@IngridPuppet Thank you very much for your review. I addressed your changes in a second commit so you can follow easier. I will squash them into one commit after successful re-review. Could you please look at it again?

tdiesler · 2026-07-03T11:01:12Z

The client scope UI does not seem to have nor list the correct format

dominikschlosser · 2026-07-03T11:47:58Z

The client scope UI does not seem to have nor list the correct format

Weird...

tdiesler · 2026-07-03T11:59:53Z

Try ...

restart with no database
enable oid4vci on the master realm
look at the client scope

for me the format does not show. Neither on additional realms that are created with oid4vci enabled

tdiesler · 2026-07-03T12:03:08Z

I ran the HAIP tests with mdoc

There seems to be small glitch with fapi2-security-profile-final-refresh-token

dominikschlosser · 2026-07-03T12:06:06Z

@tdiesler Thanks i will look into it.
@VinodAnandan If we merge #50577 before this one, the mDoc tests will also run nightly. Currently only happy flow is included.

tdiesler · 2026-07-03T12:53:07Z

The client scope UI does not seem to have nor list the correct format

Weird...

LOL, yes it was nothing.

dominikschlosser · 2026-07-03T13:08:33Z

I ran the HAIP tests with mdoc
There seems to be small glitch with fapi2-security-profile-final-refresh-token

It works now after rebasing this branch onto main.

Copilot

Pull request overview

Copilot reviewed 85 out of 85 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 85 out of 85 changed files in this pull request and generated 3 comments.

tdiesler · 2026-07-03T13:58:17Z

Confirmed, it works after rebase

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-03T14:14:27Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenTimeIsValid

Keycloak CI - Adapter IT Strict Cookies

org.jboss.arquillian.graphene.enricher.exception.PageObjectInitializationException: 
Can not instantiate Page Object 
class org.keycloak.testsuite.adapter.page.SalesPostClockSkewServlet
 declared in: 
org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenHasExpired

Keycloak CI - Adapter IT Strict Cookies

org.jboss.arquillian.graphene.enricher.exception.PageObjectInitializationException: 
Can not instantiate Page Object 
class org.keycloak.testsuite.adapter.page.SalesPostClockSkewServlet
 declared in: 
org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest
...

Report flaky test

Copilot

Pull request overview

Copilot reviewed 86 out of 86 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 86 out of 86 changed files in this pull request and generated 3 comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-09T15:47:48Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test01_ldapOnlyGroupMappings

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <4> but was: <3>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertEquals.failNotEqual(AssertEquals.java:197)
	at org.junit.jupiter.api.AssertEquals.assertEquals(AssertEquals.java:150)
...

Report flaky test

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum diff size. Try reducing the number of changed files and lines, and requesting a review from Copilot again.

edewit

it's fine from a UI point of view

Copilot

Pull request overview

Copilot reviewed 86 out of 86 changed files in this pull request and generated 4 comments.

+        if (StringUtil.isNotBlank(credentialModel.getSigningKeyId())) {
+            return resolveKeyAlgorithm(keycloakSession, credentialModel.getSigningKeyId())
+                    .orElse(fallbackSigningAlgorithm);


Copilot

Pull request overview

Copilot reviewed 86 out of 86 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/protocol/oid4vc/model/Claim.java:84

A client scope can be switched to mso_mdoc without revalidating its existing mappers (the issuance path explicitly accounts for this), but metadata generation does not validate the required namespace. A mapper missing mdoc.namespace therefore gets an unprefixed path from getMetadataAttributePath() and is advertised as an invalid mDoc claim, while issuance later rejects the same configuration. Validate the mDoc namespace here and omit or reject invalid mapper metadata consistently.

+        List<String> allowedBindingMethods = VCFormat.MSO_MDOC.equals(format)
+                ? List.of(CRYPTOGRAPHIC_BINDING_METHOD_COSE_KEY)
+                : List.of(CRYPTOGRAPHIC_BINDING_METHOD_JWK);


+    private static Optional<String> resolveKeyAlgorithm(KeycloakSession keycloakSession, String signingKeyId) {
+        return keycloakSession.keys()
+                .getKeysStream(keycloakSession.getContext().getRealm())
+                .filter(key -> signingKeyId.equals(key.getKid()))
+                .findAny()
+                .map(KeyWrapper::getAlgorithm);


IngridPuppet

New updates look good to me. I struggled to identify what changed since last time I reviewed, but could get a superset from adorsys@d889b40. I think it'd help that you keep some history between feedback submissions 😅 Thanks.

VinodAnandan · 2026-07-21T23:42:52Z

@rmartinc @mposolda The mDoc community contribution has already gone through community review and received approval. It has also been validated against the OpenID Conformance Test Suite.
At the moment, the PR is blocked on the Keycloak IBM core team. If possible, could you please help us move it forward?
In practice, many members of the Keycloak community will need mDOC support to meet regulatory and interoperability requirements to use OID4VCI and OID4VP, so getting this contribution merged would provide significant value to users.
We would greatly appreciate any help you can provide. Thank you very much for your time and support.

dominikschlosser · 2026-08-05T21:21:53Z

To better understand mdoc vs sd-jwt, i created a blog post: https://dominikschlosser.github.io/blog/2026/08/05/credential-formats-eudi-ecosystem.html

Copilot

Pull request overview

Copilot reviewed 86 out of 86 changed files in this pull request and generated no new comments.

Suppressed comments (3)

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialSigningAlgorithmResolver.java:134

This validates only that some active key with the same algorithm has a certificate, not that a configured signingKeyId identifies that key. If the selected key lacks a certificate while another ES256 key has one, metadata advertises ES256 but signing still uses the selected key and every issuance fails; validate the exact configured key's status/use/certificate before accepting it.
js/apps/admin-ui/src/utils/useIsFeatureEnabled.ts:18
The server reports this feature as OID4VC_MDOC (the Profile.Feature enum name), while this hook compares feature names exactly. With OID4VC_VCI_MDOC, isMdocEnabled is always false and the Admin UI never exposes the mDoc format even when the feature is enabled.

  OpenId4VCIMdoc = "OID4VC_VCI_MDOC",

core/src/main/java/org/keycloak/mdoc/MdocCose.java:54

RFC 9360 §2 requires x5chain to be a byte string for one certificate and an array only for two or more certificates. Generated mDoc keys commonly have a single certificate, so always serializing a list produces a non-conformant IssuerAuth that strict wallets may reject.

        Map<Integer, List<byte[]>> unprotectedHeader = Collections.singletonMap(
                HEADER_X5CHAIN, certificateChain.stream().map(MdocCose::encodeCertificate).collect(Collectors.toList())
        );

Signed-off-by: Dominik Schlosser <dominik.schlosser@gmail.com>

Copilot

Pull request overview

Copilot reviewed 86 out of 86 changed files in this pull request and generated no new comments.

Suppressed comments (2)

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialSigningAlgorithmResolver.java:144

A configured signingKeyId is reduced to only its algorithm here, then accepted whenever any active certified key has that algorithm. The signer remains pinned to the original ID (AbstractCredentialSigner.java:53-56), so a missing, disabled, or certificate-less pinned key can still be advertised as usable and every issuance then fails; validate the exact pinned key (including status, signing use, and certificate chain) and do not fall back while retaining an unusable ID.
js/apps/admin-ui/src/utils/useIsFeatureEnabled.ts:18
The server exposes this feature as OID4VC_MDOC (Profile.Feature.OID4VC_MDOC, and ServerInfoAdminResource serializes feature.name()), so this value never matches the enabled feature list. As a result, the admin console hides the mDoc format even when the feature is enabled.

  OpenId4VCIMdoc = "OID4VC_VCI_MDOC",

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-08-06T00:39:02Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPSearchForUsersPaginationTest#testPagination

Keycloak CI - Base IT (5)

java.lang.AssertionError: 

Expected: a collection with size <10>
     but: collection size was <2>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

VinodAnandan · 2026-08-07T07:35:10Z

This PR has already been reviewed and approved by the SIG member and has been open for over four months. @vaceksimon , @rmartinc : could you please help review and merge the PR when you get a chance? Your help would be greatly appreciated.

dominikschlosser requested review from a team as code owners April 29, 2026 11:25

keycloak-github-bot Bot added the team/cloud-native label Apr 29, 2026

dominikschlosser force-pushed the ghi48095 branch 2 times, most recently from 5def263 to ebd25d0 Compare April 29, 2026 14:08

keycloak-github-bot Bot added the flaky-test label Apr 29, 2026

This was referenced Apr 29, 2026

Flaky test: org.keycloak.testsuite.authz.PolicyEvaluationTest# #48446

Closed

Flaky test: org.keycloak.testsuite.model.session.UserSessionProviderModelTest#testCreateUserSessionsParallel #48120

Closed

keycloak-github-bot Bot reviewed Apr 29, 2026

View reviewed changes

dominikschlosser force-pushed the ghi48095 branch 12 times, most recently from c3894f2 to 675869c Compare May 6, 2026 12:30

tdiesler reviewed May 7, 2026

View reviewed changes

Comment thread .../java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCMdocAuthorizationDetailsFlowTest.java

IngridPuppet reviewed May 12, 2026

View reviewed changes

Comment thread core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java

Comment thread core/src/main/java/org/keycloak/mdoc/CborUtil.java

Comment thread core/src/main/java/org/keycloak/mdoc/CborUtil.java

dominikschlosser force-pushed the ghi48095 branch 2 times, most recently from f23ab1b to eff6546 Compare May 12, 2026 16:37

IngridPuppet reviewed May 13, 2026

View reviewed changes

dominikschlosser force-pushed the ghi48095 branch 2 times, most recently from f45bc18 to ccf3a20 Compare May 15, 2026 15:51

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java

Copilot AI reviewed Jul 3, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Jul 3, 2026

View reviewed changes

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread ...va/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactoryTest.java Outdated

Comment thread core/src/main/java/org/keycloak/mdoc/CborUtil.java

Comment thread js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties Outdated

keycloak-github-bot Bot reviewed Jul 9, 2026

View reviewed changes

Copilot AI reviewed Jul 9, 2026

edewit previously approved these changes Jul 10, 2026

View reviewed changes

Copilot AI reviewed Jul 10, 2026

View reviewed changes

keycloak-github-bot Bot mentioned this pull request Jul 10, 2026

Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest #49944

Closed

Copilot AI reviewed Jul 10, 2026

View reviewed changes

IngridPuppet approved these changes Jul 16, 2026

View reviewed changes

Copilot AI reviewed Aug 5, 2026

View reviewed changes

[OpenID4VCI] Add support for mDoc (keycloak#48095)

d6653d2

Signed-off-by: Dominik Schlosser <dominik.schlosser@gmail.com>

Copilot AI reviewed Aug 5, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Aug 6, 2026

View reviewed changes

Uh oh!

Conversation

dominikschlosser commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Apr 29, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.ResetPasswordTest#resetPasswordWrongSmtp

org.keycloak.testsuite.forms.ResetPasswordTest#resetPassword

Uh oh!

Uh oh!

IngridPuppet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

IngridPuppet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dominikschlosser commented May 15, 2026

Uh oh!

tdiesler commented Jul 3, 2026

Uh oh!

dominikschlosser commented Jul 3, 2026

Uh oh!

tdiesler commented Jul 3, 2026

Uh oh!

tdiesler commented Jul 3, 2026

Uh oh!

dominikschlosser commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tdiesler commented Jul 3, 2026

Uh oh!

dominikschlosser commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tdiesler commented Jul 3, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 3, 2026

Unreported flaky test detected

org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenTimeIsValid

org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenHasExpired

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

dominikschlosser commented Apr 29, 2026 •

edited

Loading

dominikschlosser commented Jul 3, 2026 •

edited

Loading

VinodAnandan commented Jul 21, 2026 •

edited

Loading