[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption by tdiesler · Pull Request #50576 · keycloak/keycloak

tdiesler · 2026-07-02T13:49:56Z

Adjusts OID4VCI credential-offer creation so that Authorization Code Grant offers no longer assume the same client_id is used for both offer creation and subsequent redemption, addressing "wallets may authenticate/redeem using their own client".

Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers).
Keep pre-authorized code offers bound to the authenticated client.
Update Javadoc section headings to explicitly name the corresponding grant types.

Copilot

Pull request overview

Adjusts OID4VCI credential-offer creation so that Authorization Code Grant offers no longer assume the same client_id is used for both offer creation and subsequent redemption, addressing #48188 (wallets may authenticate/redeem using their own client).

Changes:

Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers).
Keep pre-authorized code offers bound to the authenticated client.
Update Javadoc section headings to explicitly name the corresponding grant types.

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java:446

The Javadoc for the authorization-code offer section doesn’t mention the newly introduced behavior that these offers are no longer bound to the client_id used to create them (only pre-authorized offers are). Adding an explicit bullet here would help prevent future regressions and clarify the intended security model (client authorization is enforced via configured credential scopes/policies, not by matching the creator client_id).

     * <b>Authorization Code Grant Offer</b>
     * <ul>
     *   <li>If targetUser is null or empty, the generated offer is "anonymous"</li>
     *   <li>If targetUser is equal to the current login, the offer is "self issued"</li>
     *   <li>If targetUser is none of the above, the offer is "targeted"</li>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

dominikschlosser · 2026-07-03T10:39:37Z

@tdiesler LGTM but i just wonder why no test has to be changed for this? Maybe you should add one?

tdiesler · 2026-07-03T12:47:58Z

@tdiesler LGTM but i just wonder why no test has to be changed for this? Maybe you should add one?

Yes, good catch - I added the wanted test coverage

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

IngridPuppet

Thx

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

…d for offer creation and redemption closes keycloak#48188 Signed-off-by: Thomas Diesler <tdiesler@proton.me> * Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers). * Keep pre-authorized code offers bound to the authenticated client. * Update Javadoc section headings to explicitly name the corresponding grant types.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings July 2, 2026 13:49

tdiesler requested a review from a team as a code owner July 2, 2026 13:49

keycloak-github-bot Bot added the team/core-protocols label Jul 2, 2026

Copilot started reviewing on behalf of tdiesler July 2, 2026 13:51 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

tdiesler mentioned this pull request Jul 2, 2026

[OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption #48188

Open

2 tasks

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch 2 times, most recently from f496177 to 6267e81 Compare July 2, 2026 14:49

Copilot AI review requested due to automatic review settings July 3, 2026 09:30

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 6267e81 to 74e363e Compare July 3, 2026 09:30

Copilot started reviewing on behalf of tdiesler July 3, 2026 09:31 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 74e363e to 57b9979 Compare July 3, 2026 09:38

Copilot AI review requested due to automatic review settings July 3, 2026 12:46

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 57b9979 to 0b1cf55 Compare July 3, 2026 12:46

Copilot started reviewing on behalf of tdiesler July 3, 2026 12:47 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Outdated

dominikschlosser reviewed Jul 3, 2026

View reviewed changes

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Outdated

dominikschlosser approved these changes Jul 3, 2026

View reviewed changes

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 0b1cf55 to 5c2a54b Compare July 3, 2026 14:46

Copilot AI review requested due to automatic review settings July 3, 2026 14:51

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5c2a54b to 5fc887a Compare July 3, 2026 14:51

Copilot started reviewing on behalf of tdiesler July 3, 2026 14:51 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Outdated

IngridPuppet approved these changes Jul 7, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 08:12

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5fc887a to 9e21a77 Compare July 13, 2026 08:12

Copilot started reviewing on behalf of tdiesler July 13, 2026 08:13 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java Outdated

Copilot AI review requested due to automatic review settings July 13, 2026 08:30

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 9e21a77 to 5fc887a Compare July 13, 2026 08:30

Copilot started reviewing on behalf of tdiesler July 13, 2026 08:31 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 14, 2026 14:44

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5fc887a to 1f19a27 Compare July 14, 2026 14:44

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Copilot started reviewing on behalf of tdiesler July 14, 2026 15:11 View session

Copilot AI review requested due to automatic review settings July 14, 2026 18:27

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 1f19a27 to b2a132e Compare July 14, 2026 18:27

Copilot started reviewing on behalf of tdiesler July 14, 2026 18:28 View session

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 234c341 to b2a132e Compare July 14, 2026 18:30

Copilot AI reviewed Jul 14, 2026

View reviewed changes

tdiesler mentioned this pull request Jul 14, 2026

[OID4VCI] Explicit client association for pre-authorized offers #50897

Open

Copilot AI review requested due to automatic review settings July 14, 2026 19:00

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from b2a132e to 5fc887a Compare July 14, 2026 19:00

Copilot started reviewing on behalf of tdiesler July 14, 2026 19:00 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 15, 2026 06:18

tdiesler force-pushed the ghi48188-auth-code-offer-client-binding branch from 5fc887a to 6b8ed25 Compare July 15, 2026 06:18

Copilot started reviewing on behalf of tdiesler July 15, 2026 06:18 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Uh oh!

Conversation

tdiesler commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

dominikschlosser commented Jul 3, 2026

Uh oh!

tdiesler commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

IngridPuppet left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tdiesler commented Jul 2, 2026 •

edited

Loading