Emit credential_id on UPDATE_CREDENTIAL events from built-in required actions - #50787
Open
nunofaria11 wants to merge 1 commit into
Open
Emit credential_id on UPDATE_CREDENTIAL events from built-in required actions#50787nunofaria11 wants to merge 1 commit into
nunofaria11 wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates Keycloak’s built-in credential required actions to include Details.CREDENTIAL_ID on UPDATE_CREDENTIAL events, aligning create/update-side auditing with existing REMOVE_CREDENTIAL behavior so event consumers can identify the exact credential row affected.
Changes:
- Emit
Details.CREDENTIAL_IDonUPDATE_CREDENTIALforUpdatePassword,UpdateTotp, andWebAuthnRegister. - Hydrate OTP credential IDs by setting the created ID back onto the passed
OTPCredentialModelduring persistence. - Extend tests to assert
credential_idis present (and for WebAuthn, equals the stored credential representation’s ID).
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnIdlessTest.java | Asserts UPDATE_CREDENTIAL includes Details.CREDENTIAL_ID matching the stored WebAuthn credential row. |
| testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java | Asserts TOTP UPDATE_CREDENTIAL includes a non-null Details.CREDENTIAL_ID. |
| testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionResetPasswordTest.java | Asserts password UPDATE_CREDENTIAL includes a non-null Details.CREDENTIAL_ID. |
| services/src/main/java/org/keycloak/credential/OTPCredentialProvider.java | Sets the generated credential ID back onto the input OTPCredentialModel after storing. |
| services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java | Captures created credential and emits its ID via Details.CREDENTIAL_ID. |
| services/src/main/java/org/keycloak/authentication/requiredactions/UpdateTotp.java | Emits Details.CREDENTIAL_ID from the OTP credential model when available. |
| services/src/main/java/org/keycloak/authentication/requiredactions/UpdatePassword.java | Looks up the password credential post-update and emits its ID via Details.CREDENTIAL_ID when available. |
nunofaria11
force-pushed
the
enhance-update-credential-events-with-credential-id
branch
from
July 14, 2026 16:45
7d01f41 to
d7ea7a3
Compare
nunofaria11
force-pushed
the
enhance-update-credential-events-with-credential-id
branch
from
July 15, 2026 07:26
c5b2153 to
41adbd0
Compare
nunofaria11
force-pushed
the
enhance-update-credential-events-with-credential-id
branch
from
July 15, 2026 07:28
41adbd0 to
3adb8b3
Compare
nunofaria11
force-pushed
the
enhance-update-credential-events-with-credential-id
branch
4 times, most recently
from
July 15, 2026 11:16
515f705 to
85eefc5
Compare
… actions UpdatePassword, UpdateTotp and WebAuthnRegister now set Details.CREDENTIAL_ID on the generic UPDATE_CREDENTIAL event, matching REMOVE_CREDENTIAL which already carries the credential id. This lets event consumers identify which credential row was created or updated when a user has multiple credentials of the same type. The OTP credential id is surfaced by hydrating it in OTPCredentialProvider.createCredential, consistent with PasswordCredentialProvider; the WebAuthn id is read from the createCredential return value. For passwords, updateCredential only returns a boolean and the update may be handled entirely by a federated CredentialInputUpdater (e.g. LDAP in WRITABLE edit mode), so the id is emitted only when the local password row actually changed across the update: a local write creates a new row or re-stamps createdDate, while a federated write leaves any local row untouched. Closes keycloak#50247 Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nuno Faria <nuno.faria@getflip.com>
nunofaria11
force-pushed
the
enhance-update-credential-events-with-credential-id
branch
from
July 20, 2026 12:35
85eefc5 to
8f3253d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UpdatePassword, UpdateTotp and WebAuthnRegister now set Details.CREDENTIAL_ID on the generic UPDATE_CREDENTIAL event, matching REMOVE_CREDENTIAL which already carries the credential id. This lets event consumers identify which credential row was created or updated when a user has multiple credentials of the same type.
The OTP credential id is surfaced by hydrating it in OTPCredentialProvider.createCredential, consistent with PasswordCredentialProvider; password and WebAuthn ids are read from the credential lookup and the createCredential return value respectively.
Closes #50247
Aided by Claude Code (opus 4.8).