Skip to content

[OID4VCI] Add advanced key attestation integration tests - #51395

Merged
mposolda merged 3 commits into
keycloak:mainfrom
adorsys:issue-51348
Aug 13, 2026
Merged

[OID4VCI] Add advanced key attestation integration tests#51395
mposolda merged 3 commits into
keycloak:mainfrom
adorsys:issue-51348

Conversation

@forkimenjeckayang

@forkimenjeckayang forkimenjeckayang commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Adds full OID4VCI integration coverage for credential configurations with
key_attestations_required enabled.

The tests cover the complete authorization, token, and credential issuance
flow for:

  • JWT proof with a kid-based key attestation
  • Attestation proof with a kid header
  • JWT proof with an x5c-based key attestation
  • Attestation proof with an x5c certificate chain

The tested credential configuration issues SD-JWT credentials and supports
both jwt and attestation proof types. Each successful flow verifies that
the issued SD-JWT contains a cnf.jwk holder binding that matches the exact
key supplied by the validated proof.

Additional fix

The integration tests uncovered an issue in the key-attestation requirement
setters. Configured resistance-level lists were serialized as empty strings
because the list argument was not passed to String.join.

This fixes serialization in both CredentialScopeModel and
CredentialScopeRepresentation.

closes #51348

@forkimenjeckayang
Add advanced OID4VCI key attestation tests
a9064ab 
Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
Copilot AI balanced review requested due to automatic review settings August 3, 2026 12:20
@forkimenjeckayang
forkimenjeckayang requested a review from a team as a code owner August 3, 2026 12:20
@forkimenjeckayang forkimenjeckayang mentioned this pull request Aug 3, 2026
Open
Copilot AI reviewed Aug 3, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds end-to-end OID4VCI coverage for key-attested SD-JWT issuance and fixes resistance-level serialization.

Changes:

  • Tests JWT and attestation proofs using kid and x5c.
  • Verifies SD-JWT holder-key binding.
  • Correctly serializes key-attestation resistance levels.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
tests/base/.../OID4VCIssuerTestBase.java Configures the attestation scope for SD-JWT and both proof types.
tests/base/.../OID4VCKeyAttestationTest.java Adds four complete issuance-flow scenarios.
services/.../CredentialScopeRepresentation.java Fixes resistance-level list serialization.
server-spi-private/.../CredentialScopeModel.java Fixes model-level resistance-list serialization.

@mposolda mposolda self-assigned this Aug 11, 2026
mposolda
mposolda reviewed Aug 11, 2026
View reviewed changes

@mposolda mposolda left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@forkimenjeckayang Thanks! PR looks good to me, however there are conflicts (probably due your other PR, which was merged in the meantime). Are you please able to rebase to fix the conflict?

@mposolda

mposolda commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@forkimenjeckayang I've merged another PR, which is also related to your changes #51356 . Maybe after rebase your PR, there is no need to change the CredentialScopeModel and CredentialScopeRepresentation in your PR as the bug you mentioned might be already fixed by that other PR? But not 100% sure...

@forkimenjeckayang
address merge conflict
e2606c6 
Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
Copilot AI review requested due to automatic review settings August 13, 2026 09:39
Copilot AI reviewed Aug 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Aug 13, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Aug 13, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test01_ldapOnlyGroupMappings

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <4> but was: <3>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertEquals.failNotEqual(AssertEquals.java:197)
	at org.junit.jupiter.api.AssertEquals.assertEquals(AssertEquals.java:150)
...

Report flaky test

Copilot AI review requested due to automatic review settings August 13, 2026 11:39
Copilot AI reviewed Aug 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

mposolda
mposolda approved these changes Aug 13, 2026
View reviewed changes

@mposolda mposolda left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@forkimenjeckayang Thanks!

@mposolda
mposolda merged commit b9ce5fd into keycloak:main Aug 13, 2026
94 checks passed
theohh0 pushed a commit to theohh0/keycloak that referenced this pull request Aug 13, 2026
@forkimenjeckayang @theohh0
[OID4VCI] Add advanced OID4VCI key attestation tests (keycloak#51395)
ec536eb 
closes keycloak#51348

Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
Signed-off-by: theohh0 <theo.hinton-hallows@ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@mposolda mposolda mposolda approved these changes
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

Labels

flaky-test team/core-protocols

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Advanced integration tests with key_attestations_required

4 participants

@forkimenjeckayang @mposolda @stianst