Ignore audience for disabled clients by graziang · Pull Request #53095 · keycloak/keycloak

graziang · 2026-09-23T09:07:20Z

A disabled client is no longer added to the aud claim of a token:

RoleResolveUtil skips the client roles of disabled clients, so the "Audience Resolve" mapper no longer resolves them as an audience. Their roles also are removed from resource_access.
The "Audience" mapper skips an "Included Client Audience" of a disabled or missing client.
"Included Custom Audience" is not affected, as it is a string.
On refresh, the requested audience persisted in the refresh token is filtered to the clients that are still enabled, which also covers the Standard Token Exchange.

The refresh keeps succeeding, only without that client, consistently with a regular login. Token exchange is still rejected with invalid_client / Client disabled, as before.

Copilot

Copilot review overview

🟡 Changes recommended

A critical filtering bypass and two moderate audience-handling defects remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Block disabled clients in mapper-created audience entries · New

What changed in this PR

Excludes disabled clients from OIDC token audiences and client-role claims across login, refresh, and token-exchange flows.

Changes:

Filters disabled clients during role and audience resolution.
Adds regression tests for login, refresh, and token exchange.
Documents the changed behavior and upgrade impact.

File	Review
`tests/base/src/test/java/org/keycloak/tests/oauth/tokenexchange/StandardTokenExchangeRefreshBaseTokenV2Test.java`	Adds token-exchange refresh coverage.
`tests/base/src/test/java/org/keycloak/tests/oauth/AudienceDisabledClientTest.java`	Adds disabled-client audience tests.
`services/src/main/java/org/keycloak/utils/RoleResolveUtil.java`	Critical: Hardcoded-role mapping can recreate disabled-client entries, bypassing the intended filtering.
`services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java`	Moderate: Audience filtering occurs after access-token creation, so it does not affect the current refreshed access token.
`services/src/main/java/org/keycloak/protocol/oidc/mappers/AudienceProtocolMapper.java`	Moderate: An empty client audience suppresses the configured custom-audience fallback.
`docs/documentation/upgrading/topics/changes/changes-26_8_0.adoc`	Documents the upgrade behavior.
`docs/documentation/server_admin/topics/clients/oidc/con-audience.adoc`	Documents disabled-client audience handling.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

keycloak-github-bot · 2026-09-23T09:55:36Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.passwordless.WebAuthnPwdLessPropertyTest#timeout

Keycloak CI - WebAuthn IT

org.openqa.selenium.WebDriverException: 
unknown error: unhandled inspector error: {"code":-32000,"message":"Node with given id does not belong to the document"}
  (Session info: chrome=152.0.7977.82)
Build info: version: '4.46.0', revision: 'df5a634 df5a6341cbb5f8f06b836bd595752775627c80dc'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1022-azure', java.version: '25.0.4.1'
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

Copilot

Copilot review overview

🟡 Changes recommended

Refresh filtering is applied too late, and the intended refresh behavior must be reconciled with issue #53074.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Filter requested audiences before creating the access token · New

Resolved since last review (1)

Block disabled clients in mapper-created audience entries

Copilot

Copilot review overview

🟡 Changes recommended

The audience mapper still adds deleted clients to the aud claim.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Handle deleted clients like disabled clients before adding to aud · New

Resolved since last review (1)

Filter requested audiences before creating the access token

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-09-23T11:59:53Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employeeSigPostNoIdpKeyTest

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostEncTest

Keycloak CI - Adapter IT Strict Cookies

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Copilot

Copilot review overview

🟡 Changes recommended

Refresh behavior contradicts the linked issue’s required rejection semantics.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Reject refresh when any persisted audience client is disabled · New

Resolved since last review (1)

Handle deleted clients like disabled clients before adding to aud

Copilot

Copilot review overview

🟢 Approval recommended

The reviewed changes have regression coverage and no unresolved issues.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Reject refresh when any persisted audience client is disabled

Closes keycloak#53074 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>

graziang · 2026-09-23T13:49:22Z

                .userId(userId).getEvent();
        Tokens tokens = sendTokenRequest(loginEvent, userId, "openid profile email audience-scope", "test-app");

-        assertAudiences(tokens.accessToken, "test-app", "service-client", "confidential-cli");


The audience-confidential-cli mapper of the realm is ignored, as confidential-cli is not a client of this realm

Copilot

Copilot review overview

🔵 Needs a closer look

Security-sensitive audience, refresh, and token-exchange changes warrant final human review.

Review effort: Balanced
Findings: None

Copilot AI balanced review requested due to automatic review settings September 23, 2026 09:07

graziang requested a review from a team as a code owner September 23, 2026 09:07

keycloak-github-bot Bot added the team/core-protocols label Sep 23, 2026

Copilot started reviewing on behalf of graziang September 23, 2026 09:07 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/utils/RoleResolveUtil.java

keycloak-github-bot Bot added the flaky-test label Sep 23, 2026

keycloak-github-bot Bot reviewed Sep 23, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 23, 2026 10:02

graziang force-pushed the issue-53074 branch from c19572f to bed1049 Compare September 23, 2026 10:02

Copilot started reviewing on behalf of graziang September 23, 2026 10:02 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java Outdated

graziang force-pushed the issue-53074 branch from bed1049 to fdaa986 Compare September 23, 2026 11:16

Copilot AI review requested due to automatic review settings September 23, 2026 11:16

Copilot started reviewing on behalf of graziang September 23, 2026 11:17 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oidc/mappers/AudienceProtocolMapper.java Outdated

Copilot AI review requested due to automatic review settings September 23, 2026 11:58

graziang force-pushed the issue-53074 branch from fdaa986 to 850c88f Compare September 23, 2026 11:58

graziang requested review from a team as code owners September 23, 2026 11:58

Copilot started reviewing on behalf of graziang September 23, 2026 11:59 View session

keycloak-github-bot Bot reviewed Sep 23, 2026

View reviewed changes

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java

Copilot AI review requested due to automatic review settings September 23, 2026 12:25

graziang force-pushed the issue-53074 branch from 850c88f to dee5268 Compare September 23, 2026 12:25

Copilot started reviewing on behalf of graziang September 23, 2026 12:25 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Ignore audience for disabled clients

4ca4eb5

Closes keycloak#53074 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>

Copilot AI review requested due to automatic review settings September 23, 2026 13:48

graziang force-pushed the issue-53074 branch from dee5268 to 4ca4eb5 Compare September 23, 2026 13:48

Copilot started reviewing on behalf of graziang September 23, 2026 13:49 View session

graziang commented Sep 23, 2026

View reviewed changes

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Navigation Menu

Ignore audience for disabled clients - #53095

Ignore audience for disabled clients#53095
graziang wants to merge 1 commit into
keycloak:mainfrom
graziang:issue-53074

graziang commented Sep 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

keycloak-github-bot Bot commented Sep 23, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Sep 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

graziang Sep 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

graziang commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

keycloak-github-bot Bot commented Sep 23, 2026

Unreported flaky test detected

org.keycloak.testsuite.webauthn.passwordless.WebAuthnPwdLessPropertyTest#timeout

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Sep 23, 2026

Unreported flaky test detected

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employeeSigPostNoIdpKeyTest

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#salesPostEncTest

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

graziang Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

graziang commented Sep 23, 2026 •

edited

Loading