Skip to content

Add generated keys provider for ML-DSA - #55099

Open
stianst wants to merge 1 commit into
keycloak:mainfrom
stianst:ml-dsa
Open

Add generated keys provider for ML-DSA#55099
stianst wants to merge 1 commit into
keycloak:mainfrom
stianst:ml-dsa

Conversation

@stianst

@stianst stianst commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

Closes #44142

Signed-off-by: stianst stianst@gmail.com

@stianst
stianst requested a review from a team as a code owner November 12, 2026 11:35
Copilot AI balanced review requested due to automatic review settings November 12, 2026 11:35

This comment was marked as outdated.

Sign in to view

Copilot AI balanced review requested due to automatic review settings November 12, 2026 11:53

This comment was marked as outdated.

Sign in to view

Copilot AI balanced review requested due to automatic review settings November 12, 2026 12:01
Copilot AI reviewed Nov 12, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues remain for the experimental ML-DSA key-provider change.

No open issues 🎉

2 resolved since last review

Review effort: Balanced

lhanusov
lhanusov approved these changes Nov 13, 2026
View reviewed changes

@lhanusov lhanusov left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stianst LGTM, thanks 👍

Comment thread tests/base/src/test/java/org/keycloak/tests/common/SeverWithOAuthMlDsaEnabled.java Resolved
Comment thread tests/base/src/test/java/org/keycloak/tests/keys/GeneratedMlDsaKeyProviderTest.java Resolved
Copilot AI balanced review requested due to automatic review settings November 13, 2026 13:18
Copilot AI reviewed Nov 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Configurations with stored keys but no algorithm pass validation without persisting the ML-DSA-65 default, causing the provider to fail during key loading.

1 open issue

Review effort: Balanced

Comment thread services/src/main/java/org/keycloak/keys/GeneratedMlDsaKeyProviderFactory.java Resolved
@stianst
Add generated keys provider for ML-DSA
172f63e 
Closes keycloak#44142

Signed-off-by: stianst <stianst@gmail.com>
Copilot AI balanced review requested due to automatic review settings November 13, 2026 13:52
Copilot AI reviewed Nov 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Create/import requests with both stored-key fields bypass validation, allowing unusable key material to be persisted and potentially causing fallback to a different key.

1 open issue
1 resolved since last review

Review effort: Balanced

Comment thread services/src/main/java/org/keycloak/keys/GeneratedMlDsaKeyProviderFactory.java
Comment on lines +115 to +118
if (!(model.contains(Attributes.PRIVATE_KEY_KEY) && model.contains(Attributes.PUBLIC_KEY_KEY))) {
generateKeys(model, algorithm);
logger.debugv("Generated keys for {0}", realm.getName());
}
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Nov 13, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Nov 13, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.broker.KcSamlFirstBrokerLoginTest#testRequiredRegistrationEmailAsUserName

Keycloak CI - FIPS IT (non-strict)

jakarta.ws.rs.InternalServerErrorException: HTTP 500 Internal Server Error
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus(ClientInvocation.java:250)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.DefaultEntityExtractorFactory$3.extractEntity(DefaultEntityExtractorFactory.java:41)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:146)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
...

Report flaky test

@ahus1 ahus1 mentioned this pull request Nov 13, 2026
Closed
2 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+2 more reviewers
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
@lhanusov lhanusov lhanusov approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

flaky-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add generated keys provider for ML-DSA (OIDC)

3 participants

@stianst @lhanusov