Repository navigation
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
The Jackson 3 migration affects persisted WebAuthn credentials and mdoc wire encoding, requiring runtime compatibility validation for legacy credentials and ML-DSA across supported JDK/provider combinations that could not be performed here.
No open issues 🎉
What changed in this PR
Upgrades WebAuthn4j to 0.32.0 to enable ML-DSA support in Keycloak’s WebAuthn flows, adopting the required Jackson 3 dependencies while adding legacy credential compatibility coverage.
Changes:
- Adds ML-DSA-44, ML-DSA-65, and ML-DSA-87 to registration algorithm mapping and admin UI policy options.
- Updates Jackson dependencies and migrates mdoc CBOR serialization to Jackson 3.
- Adds ML-DSA and compatibility tests, plus documentation of browser and cryptographic-provider requirements.
| File | Description |
|---|---|
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/TestClassProvider.java |
Updates test class inclusion for Jackson 3. |
tests/webauthn/src/test/resources/webauthn/jackson2-credentials.json |
Adds legacy credential and assertion fixtures. |
tests/webauthn/src/test/java/org/keycloak/tests/webauthn/WebAuthnPasswordlessMLDSATest.java |
Extends ML-DSA tests to passwordless flows. |
tests/webauthn/src/test/java/org/keycloak/tests/webauthn/WebAuthnMLDSATest.java |
Tests ML-DSA registration, authentication, and invalid signatures. |
tests/webauthn/src/test/java/org/keycloak/tests/webauthn/WebAuthnJackson2CompatibilityTest.java |
Tests authentication with Jackson 2 credential fixtures. |
services/src/test/java/org/keycloak/credential/WebAuthnCredentialSerializationTest.java |
Tests legacy key and attestation serialization compatibility. |
services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java |
Maps ML-DSA policy names to COSE algorithm identifiers. |
quarkus/runtime/pom.xml |
Includes Jackson 3 runtime dependencies. |
pom.xml |
Upgrades WebAuthn4j and imports the Jackson 3 BOM. |
js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx |
Adds ML-DSA policy options. |
integration/admin-client-jackson3/pom.xml |
Uses centrally managed Jackson versions. |
docs/documentation/server_admin/topics/authentication/webauthn.adoc |
Documents ML-DSA availability and requirements. |
core/src/test/java/org/keycloak/mdoc/CborUtilTest.java |
Adds nested-map and tagged-CBOR encoding tests. |
core/src/main/java/org/keycloak/mdoc/CborUtil.java |
Migrates CBOR serialization to Jackson 3 APIs. |
Review effort: Balanced
There was a problem hiding this comment.
🔵 Needs a closer look
The WebAuthn4j/Jackson 3 migration requires runtime validation of persisted-credential compatibility and ML-DSA across supported JDK and FIPS configurations, but the necessary dependencies and browser runtime are unavailable for this review.
No open issues 🎉
Review effort: Balanced
There was a problem hiding this comment.
Needs to be wrapped in a feature (WEBAUTHN_ML_DSA) as specifications are not finalised at this point.
We can target preview for 27. If this PR is the complete work needed then you can just introduce the feature as preview straight away, if there is follow-up work needed, including testing, then do experimental initially.
Closes keycloak#50085 Closes keycloak#50086 Signed-off-by: Martin Bartoš <mabartos@redhat.com>
There was a problem hiding this comment.
🔵 Needs a closer look
The WebAuthn4j/Jackson 3 upgrade requires runtime validation of legacy credentials, persisted-CBOR compatibility, and ML-DSA across supported JDKs and cryptographic providers, but dependency-backed checks are unavailable and browser tests may be skipped.
No open issues 🎉
Review effort: Balanced
|
@keycloak/cloud-native @michalvavrik Could you please check this, as it needs Jackson 3? Thanks! |
Uh oh!
There was an error while loading. Please reload this page.