#50798 Apply protocol defaults when creating clients through Admin AP… by arnabnandy7 · Pull Request #50801 · keycloak/keycloak

arnabnandy7 · 2026-07-10T20:04:44Z

Apply protocol defaults when creating clients through Admin API v2

Reuse LoginProtocolFactory client defaults in the Admin API v2 creation path. Preserve omitted SAML fields and add interoperability coverage for OIDC backchannel logout and SAML creation defaults.

Closes #50798

Splits from #50894

Copilot

Pull request overview

This PR ensures Admin API v2 client creation applies the same protocol-specific defaults as the legacy (v1-based) creation flow by reusing LoginProtocolFactory.setupClientDefaults, and adds interoperability tests to verify key defaults for minimal OIDC and SAML client creation.

Changes:

Invoke LoginProtocolFactory.setupClientDefaults(...) during Admin API v2 client creation to apply protocol defaults before validation.
Preserve “omitted vs explicitly set” semantics for specific SAML fields so protocol defaults are applied correctly.
Add interop tests asserting OIDC backchannel logout and SAML creation defaults are applied when creating minimal clients via v2.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
rest/admin-v2/services/src/main/java/org/keycloak/services/client/DefaultClientService.java	Apply protocol factory defaults during v2 client creation (with SAML omission-preservation for primitive-backed fields).
rest/admin-v2/tests/src/test/java/org/keycloak/tests/admin/client/v2/InteropTest.java	Add minimal OIDC/SAML creation interop tests to validate protocol defaults are applied.

shawkins · 2026-07-13T18:34:11Z

Thank you for the PR, the other thing still missing is

keycloak/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java

Line 350 in 1ecbb5d

    
           if (Profile.isFeatureEnabled(Profile.Feature.CLIENT_TYPES) && resourceRep.getType() != null) {

arnabnandy7 · 2026-07-13T18:39:39Z

Thank you for the PR, the other thing still missing is

keycloak/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java

Line 350 in 1ecbb5d

if (Profile.isFeatureEnabled(Profile.Feature.CLIENT_TYPES) && resourceRep.getType() != null) {

I'll look into it

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-13T19:37:39Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: Expected error event ==> expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

arnabnandy7 · 2026-07-13T21:47:48Z

Addressed the remaining client-type creation path and follow-up review findings in 2f77c90. Admin API v2 now preserves omitted client-type defaults, applies explicit values through type validation, restores ordinary service-account flow handling, and exposes the requested type to client policy contexts.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 11 comments.

arnabnandy7 · 2026-07-13T21:54:44Z

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

the flaky test is not caused by this PR

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 11 comments.

michalvavrik

Thank you for your PR.

I suspect Copilot comments regarding NPEs (this one #50801 (comment)) and PATCH/PUT with explicit null on typed clients (this one #50801 (comment)) are right. The fact that PR CI is not failing means there is gap in test coverage.

Please have a look if there is something on it.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

shawkins

LGTM, thank you @arnabnandy7

edit - removed the approval due to the failing test. Looking into that now.

michalvavrik · 2026-07-16T13:49:04Z

That PR CI failure is suspicious, I haven't checked yet (I can do it later), but did you investigate @arnabnandy7 if it is related or flaky?


Error:  Failures: 
Error:    ClientApiV2Test.createJwtClientWithoutSecret:1103 
Expected: null
     but: was "H4691osA5ZalXznmS0TQ7Ee4yZdNVnzfZhFxilQr4w3A9QFviUDrsxsTSutEOyAIfZa0E9dud7ZqZODhvIOhl4"

arnabnandy7 · 2026-07-16T14:20:27Z

That PR CI failure is suspicious, I haven't checked yet (I can do it later), but did you investigate @arnabnandy7 if it is related or flaky?
Error:  Failures: 
Error:    ClientApiV2Test.createJwtClientWithoutSecret:1103 
Expected: null
     but: was "H4691osA5ZalXznmS0TQ7Ee4yZdNVnzfZhFxilQr4w3A9QFviUDrsxsTSutEOyAIfZa0E9dud7ZqZODhvIOhl4"

Not related to my changes.

shawkins · 2026-07-16T14:39:46Z

Not related to my changes.

Unfortunately it is related to the changes here. The OIDCLoginProtocolFactory will generate a secret for all non-public clients. However the v2 logic expects that to happen only if specific auth methods are used.

To keep that convention, either the generated secret will need cleared prior to the v2 logic setting a generated one, or we'll need to only conditionally call setupClientDefaults for non-OIDC clients and make sure that any needed defaulting logic from OIDCLoginProtocolFactory is forked.

arnabnandy7 · 2026-07-16T15:36:15Z

Not related to my changes.

Unfortunately it is related to the changes here. The OIDCLoginProtocolFactory will generate a secret for all non-public clients. However the v2 logic expects that to happen only if specific auth methods are used.

To keep that convention, either the generated secret will need cleared prior to the v2 logic setting a generated one, or we'll need to only conditionally call setupClientDefaults for non-OIDC clients and make sure that any needed defaulting logic from OIDCLoginProtocolFactory is forked.

Sorry I was travelling so I thought it was referred to previous CI failure. As I can see the issue will add a fix to make createJwtClientWithoutSecret pass while preserving automatic secret generation for client-secret and client-secret-jwt

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

arnabnandy7 · 2026-07-16T15:55:03Z

@shawkins @michalvavrik your review is required

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

shawkins

LGTM, thanks @arnabnandy7

Let's get another @keycloak/cloud-native review, and then this can be merged.

michalvavrik · 2026-07-20T20:48:16Z

+                && oidcClient.getAuth() != null
+                && !isClientSecret(oidcClient.getAuth().getMethod())
+                && isBlank(oidcClient.getAuth().getSecret())) {
+            // OIDCLoginProtocolFactory generates a secret for every confidential client, while Admin API v2


but you do this even when factory == null, how should I understand this comment then?

I'm ok with leaving it as is, but it's certainly fine to move this block into the preceding if (factory != null) block.

Yeah, not a bug, I I wasn't certain that it can't have side effects which brought me to reading the comment. At least the comment is wrong, but I am fine with it as is.

Copilot AI review requested due to automatic review settings July 10, 2026 20:04

arnabnandy7 requested review from a team as code owners July 10, 2026 20:04

Copilot started reviewing on behalf of arnabnandy7 July 10, 2026 20:05 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 18:40

Copilot started reviewing on behalf of arnabnandy7 July 13, 2026 18:40 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread rest/admin-v2/services/src/main/java/org/keycloak/services/client/DefaultClientService.java

Comment thread rest/admin-v2/tests/src/test/java/org/keycloak/tests/admin/client/v2/InteropTest.java

keycloak-github-bot Bot added the flaky-test label Jul 13, 2026

keycloak-github-bot Bot reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 21:22

arnabnandy7 requested a review from a team as a code owner July 13, 2026 21:22

Copilot started reviewing on behalf of arnabnandy7 July 13, 2026 21:22 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread rest/admin-v2/services/src/main/java/org/keycloak/services/client/DefaultClientService.java Outdated

Comment thread rest/admin-v2/services/src/main/java/org/keycloak/services/client/DefaultClientService.java Outdated

Copilot AI review requested due to automatic review settings July 13, 2026 21:26

Copilot started reviewing on behalf of arnabnandy7 July 13, 2026 21:26 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 21:46

Copilot started reviewing on behalf of arnabnandy7 July 13, 2026 21:46 View session

arnabnandy7 force-pushed the fix/client-v2-creation branch from 2f77c90 to 2c7d27a Compare July 13, 2026 21:49

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 21:52

Copilot started reviewing on behalf of arnabnandy7 July 13, 2026 21:53 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

michalvavrik reviewed Jul 14, 2026

View reviewed changes

Copilot AI reviewed Jul 14, 2026

View reviewed changes

shawkins previously approved these changes Jul 16, 2026

View reviewed changes

shawkins self-requested a review July 16, 2026 13:45

Preserve secretless OIDC authentication

57e3ab4

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>

Copilot AI review requested due to automatic review settings July 16, 2026 15:37

arnabnandy7 dismissed shawkins’s stale review via 57e3ab4 July 16, 2026 15:37

Copilot started reviewing on behalf of arnabnandy7 July 16, 2026 15:51 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Merge branch 'main' into fix/client-v2-creation

5a68501

Copilot AI review requested due to automatic review settings July 16, 2026 15:53

Copilot started reviewing on behalf of arnabnandy7 July 16, 2026 16:05 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

arnabnandy7 requested a review from michalvavrik July 16, 2026 17:14

Merge branch 'main' into fix/client-v2-creation

59488c5

Copilot AI review requested due to automatic review settings July 19, 2026 13:29

Copilot started reviewing on behalf of arnabnandy7 July 19, 2026 13:30 View session

Copilot AI reviewed Jul 19, 2026

View reviewed changes

Preserve explicitly supplied OIDC secrets

ebe3bcf

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>

Copilot AI review requested due to automatic review settings July 19, 2026 14:06

Copilot started reviewing on behalf of arnabnandy7 July 19, 2026 14:06 View session

Copilot AI reviewed Jul 19, 2026

View reviewed changes

shawkins approved these changes Jul 20, 2026

View reviewed changes

michalvavrik reviewed Jul 20, 2026

View reviewed changes

michalvavrik approved these changes Jul 21, 2026

View reviewed changes

vmuzikar merged commit 1aac3fe into keycloak:main Jul 21, 2026
91 checks passed

Uh oh!

Conversation

arnabnandy7 commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

shawkins commented Jul 13, 2026

Uh oh!

arnabnandy7 commented Jul 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 13, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arnabnandy7 commented Jul 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arnabnandy7 commented Jul 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michalvavrik left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

shawkins left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

arnabnandy7 commented Jul 10, 2026 •

edited

Loading

shawkins left a comment •

edited

Loading

arnabnandy7 commented Jul 16, 2026 •

edited

Loading

shawkins commented Jul 16, 2026 •

edited

Loading