Add support for credential_response_encryption in credential request #53

Ogenbertrand · 2025-06-12T15:04:24Z

This PR aims at supporting credential_response_encryption during the issuing of credentials request. If the Client requested an encrypted response by including the credential_response_encryption object in the request, the Credential Issuer MUST encode the information in the Credential Response as a JWT using the parameters from the credential_response_encryption object. If the Credential Response is encrypted, the media type of the response MUST be set to application/jwt. If encryption was requested in the Credential Request and the Credential Response is not encrypted, the Client SHOULD reject the Credential Response.

See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request

Ogenbertrand · 2025-06-18T05:14:11Z

Ready to be reviewed.

IngridPuppet

I added a few comments. Please could you check?

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

...rc/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointTest.java

forkimenjeckayang

Left a few comments for you to check out

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponseEncryption.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponse.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialRequest.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

stephane-segning

Nothing much relevant to add to what the other said. Keep these points in mind:

Strict input validation for all encryption parameters – no socks with sandals allowed.
Encryption must be clearly configurable and documented, simple enough for everyone to understand and use.
Log debugging info responsibly; sensitive data (keys, credentials) results in can be skipped or strip (like se***)

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java

forkimenjeckayang

Left a few minor comments for you to revisit. Please check

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponseEncryption.java

...s/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponseEncryptionMetadata.java

stephane-segning

Good work. one last change please:

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

IngridPuppet

I acknowledge a great progress. Just a few more comments. Please, could you check?

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java

...t/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerWellKnownProviderTest.java

...rc/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointTest.java

IngridPuppet

LGTM

Signed-off-by: Ogenbertrand <[email protected]>

* Require setting DB kind for additional datasources Closes keycloak#41161 Signed-off-by: Martin Bartoš <[email protected]> * refining build time check for db kind to be tolerant of existing usage Signed-off-by: Steve Hawkins <[email protected]> --------- Signed-off-by: Martin Bartoš <[email protected]> Signed-off-by: Steve Hawkins <[email protected]> Co-authored-by: Steve Hawkins <[email protected]>

Closes keycloak#41488 Co-authored-by: Peter Zaoral <[email protected]> Signed-off-by: Martin Bartoš <[email protected]>

Closes keycloak#41491 Signed-off-by: Martin Bartoš <[email protected]>

…load Ensure that the Users page waits for userProfileProvidersEnabled to be defined before fetching users. This prevents federated users from being listed by default on first load, providing a consistent experience and avoiding confusion when user federation is enabled. Fixes keycloak#41044 Signed-off-by: Freeda Vales <[email protected]>

…eycloak#41490) Closes keycloak#41299 Signed-off-by: Martin Bartoš <[email protected]>

…1364) closes: keycloak#39766 Signed-off-by: Steve Hawkins <[email protected]>

Closes keycloak#41290 Signed-off-by: Alexander Schwartz <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Co-authored-by: Pedro Ruivo <[email protected]>

* task: better document property mapping closes: keycloak#40872 Signed-off-by: Steve Hawkins <[email protected]> * Update quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java Co-authored-by: Martin Bartoš <[email protected]> Signed-off-by: Steven Hawkins <[email protected]> * further refinements to the property mapping docs Signed-off-by: Steve Hawkins <[email protected]> * Apply suggestions from code review Co-authored-by: Martin Bartoš <[email protected]> Signed-off-by: Steven Hawkins <[email protected]> --------- Signed-off-by: Steve Hawkins <[email protected]> Signed-off-by: Steven Hawkins <[email protected]> Co-authored-by: Martin Bartoš <[email protected]>

Signed-off-by: Jon Koops <[email protected]>

* Make fileChooser platform independent. Fixes keycloak#41474 Signed-off-by: Stan Silvert <[email protected]> * Added node: prefix to imports. Signed-off-by: Stan Silvert <[email protected]> --------- Signed-off-by: Stan Silvert <[email protected]>

* Updated translation for Georgian Language: ka Co-authored-by: Temuri Doghonadze <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> Signed-off-by: Temuri Doghonadze <[email protected]> * Updated translation for Chinese (Traditional Han script) Language: zh_Hant Updated translation for Chinese (Traditional Han script) Language: zh_Hant Updated translation for Chinese (Traditional Han script) Language: zh_Hant Translated using Weblate (Chinese (Traditional Han script)) Translation: Keycloak/Theme base/admin Translate-URL: https://hosted.weblate.org/projects/keycloak/theme-baseadmin/zh_Hant/ Updated translation for Chinese (Traditional Han script) Language: zh_Hant Updated translation for Chinese (Traditional Han script) Language: zh_Hant Updated translation for Chinese (Traditional Han script) Language: zh_Hant Co-authored-by: Hosted Weblate <[email protected]> Co-authored-by: 秉虎 <[email protected]> Co-authored-by: 翁震軒 <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> Signed-off-by: 秉虎 <[email protected]> Signed-off-by: 翁震軒 <[email protected]> --------- Signed-off-by: Hosted Weblate <[email protected]> Signed-off-by: Temuri Doghonadze <[email protected]> Signed-off-by: 秉虎 <[email protected]> Signed-off-by: 翁震軒 <[email protected]> Co-authored-by: Temuri Doghonadze <[email protected]> Co-authored-by: 秉虎 <[email protected]> Co-authored-by: 翁震軒 <[email protected]>

Fixes keycloak#41405 Signed-off-by: Thomas Darimont <[email protected]>

Closes keycloak#26995 Signed-off-by: Oliver Cremerius <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Co-authored-by: Alexander Schwartz <[email protected]>

Closes keycloak#41354 Signed-off-by: rmartinc <[email protected]>

Closes keycloak#39079 Signed-off-by: Keshav Deshpande <[email protected]>

Closes keycloak#14644 Signed-off-by: Alexander Schwartz <[email protected]>

Closes keycloak#41551 Signed-off-by: Bjoern Eickvonder <[email protected]>

…int with HEAD method closes keycloak#41537 Signed-off-by: mposolda <[email protected]>

Closes keycloak#41186 Signed-off-by: Martin Bartoš <[email protected]>

…s and KERBEROS_PRINCIPAL was null on creation Closes keycloak#41520 Signed-off-by: Martin Kanis <[email protected]>

Closes keycloak#41471 Signed-off-by: Stan Silvert <[email protected]>

…41233) Closes keycloak#39293 Signed-off-by: forkimenjeckayang <[email protected]>

closes keycloak#41121 Signed-off-by: Takashi Norimatsu <[email protected]>

Fixes keycloak#41598 Signed-off-by: Stan Silvert <[email protected]>

…loak Closes keycloak#41176 Signed-off-by: rmartinc <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Co-authored-by: Alexander Schwartz <[email protected]>

Signed-off-by: Ogenbertrand <[email protected]>

This will handle even those sessions created by other tests. Closes keycloak#41545 Signed-off-by: Alexander Schwartz <[email protected]>

Signed-off-by: Ogenbertrand <[email protected]>

closes keycloak#40696 Signed-off-by: mposolda <[email protected]>

Ogenbertrand marked this pull request as draft June 12, 2025 15:04

Ogenbertrand marked this pull request as ready for review June 12, 2025 15:05

Ogenbertrand linked an issue Jun 12, 2025 that may be closed by this pull request

Keycloak: Add support for credential_response_encryption at credential endpoint #51

Closed

Ogenbertrand marked this pull request as draft June 12, 2025 15:31

Ogenbertrand requested review from IngridPuppet, forkimenjeckayang and stephane-segning June 12, 2025 16:13

IngridPuppet requested changes Jun 19, 2025

View reviewed changes

forkimenjeckayang requested changes Jun 19, 2025

View reviewed changes

stephane-segning requested changes Jun 19, 2025

View reviewed changes

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java Outdated Show resolved Hide resolved

Ogenbertrand requested review from stephane-segning, IngridPuppet and forkimenjeckayang June 23, 2025 16:04

Ogenbertrand mentioned this pull request Jun 24, 2025

[OID4VCI] : Update Credential Issuer Metadata Model for OID4VCI Draft-15 #55

Closed

2 tasks

forkimenjeckayang requested changes Jun 26, 2025

View reviewed changes

Ogenbertrand requested a review from forkimenjeckayang June 26, 2025 13:59

forkimenjeckayang approved these changes Jun 26, 2025

View reviewed changes

Ogenbertrand requested a review from francis-pouatcha June 27, 2025 09:46

stephane-segning requested changes Jun 30, 2025

View reviewed changes

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated Show resolved Hide resolved

Ogenbertrand requested a review from stephane-segning July 2, 2025 09:40

IngridPuppet reviewed Jul 7, 2025

View reviewed changes

Ogenbertrand requested a review from IngridPuppet July 7, 2025 14:51

IngridPuppet approved these changes Jul 8, 2025

View reviewed changes

add credential encryption support at the endpoint

1c0a916

Signed-off-by: Ogenbertrand <[email protected]>

Ogenbertrand force-pushed the issue-#39310 branch from 0fc1938 to 1c0a916 Compare July 9, 2025 13:01

Ogenbertrand removed a link to an issue Jul 9, 2025

Keycloak: Add support for credential_response_encryption at credential endpoint #51

Closed

Determine algorithms for credential_response_encryption

039650e

Signed-off-by: Ogenbertrand <[email protected]>

Ogenbertrand force-pushed the issue-#39310 branch from 3ca2994 to 039650e Compare July 10, 2025 12:16

rabase to latest

6f7ff74

Signed-off-by: Ogenbertrand <[email protected]>

mabartos and others added 30 commits July 29, 2025 14:48

Synchronize Maven surefire plugin with Quarkus

3243e95

Closes keycloak#41488 Co-authored-by: Peter Zaoral <[email protected]> Signed-off-by: Martin Bartoš <[email protected]>

ExternalLinks are broken in documentation

57cb321

Closes keycloak#41491 Signed-off-by: Martin Bartoš <[email protected]>

Missing comment generated by Liquibase executor in the custom script (k…

7cdb994

…eycloak#41490) Closes keycloak#41299 Signed-off-by: Martin Bartoš <[email protected]>

fix: adjusting the startup of the local api server for ci (keycloak#4…

a770204

…1364) closes: keycloak#39766 Signed-off-by: Steve Hawkins <[email protected]>

Reduce likelihood of multiple coordinators on concurrent startup

c9943af

Closes keycloak#41290 Signed-off-by: Alexander Schwartz <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Co-authored-by: Pedro Ruivo <[email protected]>

Use single worker to run tests on CI (keycloak#41541)

1ac1f37

Signed-off-by: Jon Koops <[email protected]>

Add details about client assertion to event

97dfbd2

Fixes keycloak#41405 Signed-off-by: Thomas Darimont <[email protected]>

add index for user_id and type on event_entity

27cd19e

Closes keycloak#26995 Signed-off-by: Oliver Cremerius <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Co-authored-by: Alexander Schwartz <[email protected]>

Create a new condition for credential type and add it to default flows

1f608fa

Closes keycloak#41354 Signed-off-by: rmartinc <[email protected]>

Change error to 400 for unknown user (keycloak#40939)

bee7e4b

Closes keycloak#39079 Signed-off-by: Keshav Deshpande <[email protected]>

Refresh token for an OAuth2 based IDP when retrieving the IDP token

e1b3afb

Closes keycloak#14644 Signed-off-by: Alexander Schwartz <[email protected]>

Support for RSA Key Size of 3072

c7cc162

Closes keycloak#41551 Signed-off-by: Bjoern Eickvonder <[email protected]>

Getting error 405 'Method Not Allowed' when calling the 'certs' endpo…

2dab730

…int with HEAD method closes keycloak#41537 Signed-off-by: mposolda <[email protected]>

Upgrade to Quarkus 3.25.0

37f799e

Closes keycloak#41186 Signed-off-by: Martin Bartoš <[email protected]>

LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal change…

235691b

…s and KERBEROS_PRINCIPAL was null on creation Closes keycloak#41520 Signed-off-by: Martin Kanis <[email protected]>

Log retry count for all Playwright runs. (keycloak#41472)

72bc02c

Closes keycloak#41471 Signed-off-by: Stan Silvert <[email protected]>

[OID4VCI] Update SD-JWT VCs Format Identifier to dc+sd-jwt (keycloak#…

43610cf

…41233) Closes keycloak#39293 Signed-off-by: forkimenjeckayang <[email protected]>

FAPI 2.0 Security Profile Final - Documentation

cb4e06b

closes keycloak#41121 Signed-off-by: Takashi Norimatsu <[email protected]>

Move flaky test to top so it will run first. (keycloak#41599)

eb814bb

Fixes keycloak#41598 Signed-off-by: Stan Silvert <[email protected]>

Add a securing-apps guide with the specifications implemented by keyc…

f45280a

…loak Closes keycloak#41176 Signed-off-by: rmartinc <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Co-authored-by: Alexander Schwartz <[email protected]>

Relax JWK 'use' validation for credential response encryption

9b9dd1c

Signed-off-by: Ogenbertrand <[email protected]>

Adjust the test to dynamically remove all sessions

31495ec

This will handle even those sessions created by other tests. Closes keycloak#41545 Signed-off-by: Alexander Schwartz <[email protected]>

return false when both alg and enc are null or empty

2bcefca

Signed-off-by: Ogenbertrand <[email protected]>

Wrap deprecated passkeys authenticator behind the feature

3cc8808

closes keycloak#40696 Signed-off-by: mposolda <[email protected]>

Merge branch 'main' into issue-keycloak#39310

6561a7d

Add support for credential_response_encryption in credential request #53

Are you sure you want to change the base?

Add support for credential_response_encryption in credential request #53

Uh oh!

Conversation

Ogenbertrand commented Jun 12, 2025

Uh oh!

Ogenbertrand commented Jun 18, 2025

Uh oh!

IngridPuppet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

forkimenjeckayang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stephane-segning left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

forkimenjeckayang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stephane-segning left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

IngridPuppet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

IngridPuppet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!