Skip to content

SSF: use the originating event id as the SET txn - #53110

Open
thomasdarimont wants to merge 2 commits into
keycloak:mainfrom
thomasdarimont:issue/gh-48896-ssf-use-eventid-as-txn
Open

thomasdarimont wants to merge 2 commits into
keycloak:mainfrom
thomasdarimont:issue/gh-48896-ssf-use-eventid-as-txn

Conversation

@thomasdarimont

@thomasdarimont thomasdarimont commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

SETs derived from a Keycloak user or admin event now carry that event's id as txn instead of a random UUID. A SET a receiver reports back can thus be traced to the realm's user / admin event log, and every SET fanned out to multiple streams for one event shares a txn.

This matches SSF 1.0 §4.1.9: txn MUST be unique to the underlying event that caused the SET, and MAY be shared across SETs that stem from the same cause. The Keycloak event id is exactly that cause. https://openid.net/specs/openid-sharedsignals-framework-1_0-final.html#section-4.1.9

Verification, stream-updated and synthetic SETs have no originating event and keep a random UUID txn. The admin logout-all path now passes the admin event through so its SET gets the admin event id and is reported as admin-initiated.

Fixes #48896

Co-Authored-By: Claude Fable 5.1

SETs derived from a Keycloak user or admin event now carry that
event's id as txn instead of a random UUID. A SET a receiver reports
back can thus be traced to the realm's user / admin event log, and
every SET fanned out to multiple streams for one event shares a txn.

This matches SSF 1.0 §4.1.9: txn MUST be unique to the underlying
event that caused the SET, and MAY be shared across SETs that stem
from the same cause. The Keycloak event id is exactly that cause.
https://openid.net/specs/openid-sharedsignals-framework-1_0-final.html#section-4.1.9

Verification, stream-updated and synthetic SETs have no originating
event and keep a random UUID txn. The admin logout-all path now
passes the admin event through so its SET gets the admin event id
and is reported as admin-initiated.

Fixes keycloak#48896

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
Copilot AI balanced review requested due to automatic review settings September 23, 2026 12:16
@thomasdarimont
thomasdarimont requested a review from a team as a code owner September 23, 2026 12:16
@thomasdarimont thomasdarimont added the area/ssf Indicates an issue on Shared Signals Framework label Sep 23, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The implementation consistently applies originating event IDs while preserving random transactions for synthetic events.

Review effort: Balanced
Findings: None

What changed in this PR

Uses originating Keycloak event IDs as SSF txn claims for traceability and consistent fan-out correlation.

Changes:

  • Resolves txn from user/admin events, retaining UUID fallback.
  • Passes admin logout events through for correct attribution.
  • Adds unit and integration coverage.
File Description
SecurityEventTokenMapper.java Implements event-based txn resolution.
SecurityEventTokenMapperTest.java Tests IDs, fan-out, fallback, and admin logout.
SsfTransmitterPollDeliveryTests.java Verifies txn against the persisted event log.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
Copilot AI review requested due to automatic review settings September 23, 2026 12:38

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The implementation matches the stated SSF transaction semantics and includes focused unit and integration coverage.

Review effort: Balanced
Findings: None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ssf Indicates an issue on Shared Signals Framework team/core-iam

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SSF: Use User/Admin event eventId as SsfSecurityEventToken txn.

2 participants