[OID4VCI] Fix IssuerKeyAttestationTest conformance failures - #51404
Conversation
|
@mposolda @dominikschlosser @tdiesler @thomasdarimont @forkimenjeckayang @VinodAnandan Could you please take a look when you get a chance? |
There was a problem hiding this comment.
🟡 Not ready to approve
The shared certificate helper applies the VCI-specific emailProtection EKU to OID4VP certificates.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Updates OID4VCI conformance trust configuration and certificates for hardened x5c validation.
Changes:
- Adds an X.509 trust-material IdP for the attester CA.
- Generates CA and leaf certificates with required constraints and usages.
- Removes the obsolete server truststore workaround.
File summaries
| File | Description |
|---|---|
VciConformanceRealmConfig.java |
Configures attester X.509 trust material and client references. |
IssuerKeyAttestationTest.java |
Uses the standard server configuration. |
ConformanceSigningKey.java |
Generates PKIX-compliant CA and leaf certificates. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Balanced
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
The conformance realm now trusts the attester CA through an X.509 trust-material identity provider. ConformanceSigningKey generates a valid v3 CA and an end-entity attestation certificate, and IssuerKeyAttestationTest no longer relies on the server truststore. Closes keycloak#51399 Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
Signed-off-by: Awambeng Rodrick <awambengrodrick@gmail.com>
There was a problem hiding this comment.
🟢 Ready to approve
The changes consistently address the hardened validation requirements without leaving unresolved issues.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Balanced
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
|
@Awambeng Very nice, thank you. LGTM! |
vaceksimon
left a comment
There was a problem hiding this comment.
LGTM, thanks @Awambeng
This PR fixes the OID4VCI conformance suite (IssuerKeyAttestationTest) failures after the key-attestation x5c validation hardening introduced in #51042.
The updated validation requires attester certificate chains to be resolved through trust-material identity providers instead of the server truststore. The conformance setup is updated to provide the required trust material and generate certificates compliant with the new validation rules.
Key changes:
Add a
conformance-attester-x509trust-material IdP to the VCI conformance realm, trusting the attester CA with theemailProtectionattestation extended key usage, and configure the clientoid4vci.attester_trust_idpsattribute.Generate compliant test certificates in
ConformanceSigningKey:keyCertSign/cRLSignkey usagesRemove the obsolete
truststore-pathsworkaround fromIssuerKeyAttestationTestand use the base server configuration.Closes #51399