[OID4VCI] Make key_attestations_required configurable in Admin Console - #51261
Conversation
Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
There was a problem hiding this comment.
Pull request overview
Adds Admin Console configuration and integration coverage for OID4VCI key-attestation requirements.
Changes:
- Adds key-attestation controls and persistence.
- Adds issuer metadata and missing-attestation enforcement tests.
- Introduces a dedicated key-attestation credential scope fixture.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCJWTIssuerEndpointTest.java |
Tests rejection when required attestation is missing. |
tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java |
Verifies key-attestation metadata. |
tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java |
Adds the configured test scope. |
js/apps/admin-ui/test/client-scope/oid4vci-client-scope.spec.ts |
Tests UI persistence. |
js/apps/admin-ui/src/client-scopes/details/ScopeForm.tsx |
Adds configuration controls. |
js/apps/admin-ui/src/client-scopes/details/oid4vciAttributes.ts |
Registers attributes for cleanup. |
js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties |
Adds labels and help text. |
mposolda
left a comment
There was a problem hiding this comment.
@forkimenjeckayang Thanks for your PR! I found some inconsistencies in well-known metadata and IMO would be good to doublecheck test coverage a bit more with integration test, but I think this might be handled in a follow-up issues. I will create them once this is merged.
|
@forkimenjeckayang FYI. Created follow-ups #51347 , #51348 and #51349 . I hope all of them are just minor polishing and more automated tests coverage (hopefully not new major changes needed in the codebase) |
Thank you @mposolda |
…ak#51261) Closes keycloak#51179 Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com> Signed-off-by: alehhu <159355663+alehhu@users.noreply.github.com>
This adds Admin Console support for configuring
vc.key_attestations_requiredon OID4VCI credential client scopes.The OID4VCI client-scope form now supports:
Integration coverage was added to verify that:
key_attestations_requiredis included in issuer metadata underproof_types_supportedinvalid_proofwhen key attestation is required but missingCloses #51179