hide scopes from scopes_supported in discovery endpoint by cgeorgilakis · Pull Request #10409 · keycloak/keycloak

cgeorgilakis · 2022-02-23T11:45:48Z

cgeorgilakis · 2024-06-19T12:21:32Z

I have updated to latest main.
Could you review it in order to be able to hide a scope from scopes_supported in discovery endpoint?

ahus1 · 2024-06-19T12:55:00Z

The linting in the admin UI complains, please check the logs. I'm switching this PR to "draft" in the meantime. Please switch it back to "ready-for-review" when you want to have it reviewed again.

Unfortunately the Admin UI tests are currently unstable, see #30492 - if those tests fail again, it might be worth waiting for that issue to be closed first and then rebase, or asking a maintainer to re-run the tests.

dalbani · 2025-06-25T07:26:43Z

@cgeorgilakis: would you mind refreshing your PR, should you have the time to do so? If not, I'm willing to have a try, so that we can have hopefully have this feature added to Keycloak.
Thanks!

cgeorgilakis · 2025-06-25T08:08:33Z

@cgeorgilakis: would you mind refreshing your PR, should you have the time to do so? If not, I'm willing to have a try, so that we can have hopefully have this feature added to Keycloak. Thanks!

Unfortunatelly no this period. Feel free to rebase it and proceed with PR.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2025-10-23T13:57:21Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.fetchString(KeycloakTestingClient.java:185)
	at org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest.updateLDAPUsernameTest(LDAPProvidersIntegrationTest.java:1656)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
...

Report flaky test

cgeorgilakis · 2025-10-24T06:42:19Z

The linting in the admin UI complains, please check the logs. I'm switching this PR to "draft" in the meantime. Please switch it back to "ready-for-review" when you want to have it reviewed again.

Unfortunately the Admin UI tests are currently unstable, see #30492 - if those tests fail again, it might be worth waiting for that issue to be closed first and then rebase, or asking a maintainer to re-run the tests.

@ahus1 @dalbani I have rebased my PR, making all needed changes. It is ready for review.

keycloak-github-bot · 2025-10-24T07:54:07Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.fetchString(KeycloakTestingClient.java:185)
	at org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest.updateLDAPUsernameTest(LDAPProvidersIntegrationTest.java:1656)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

ahus1

Thank you for the updated PR. See below for two changes I ask for before this PR can be merged.

ahus1 · 2025-10-26T17:18:25Z

+        <DefaultSwitchControl
+          name={convertAttributeNameToForm<ClientScopeDefaultOptionalType>(
+            "attributes.hide.from.openid.provider.metadata",
+          )}
+          label={t("hideFromOpenIdProviderMetadata")}
+          labelIcon={t("hideFromOpenIdProviderMetadataHelp")}
+          stringify
+        />


I see that this is visible also for SAML scope. IMHO this should only be visible for OIDC scopes given its name. If there be an equivalent setting for SAML, it should be renamed to something generic.

I check if it is not SAML. As I have understood, there is also OID4VC_PROTOCOL scopes now.

ahus1 · 2025-10-26T17:20:04Z

+hideFromOpenIdProviderMetadata=Hide from OpenID Provider Metadata
+hideFromOpenIdProviderMetadataHelp=If on, this client scope will be hidden from OpenID Provider Metadata.


There is an existing option in the same dialog with the "Include in token scope", and this new option is inverting it by stating "Hide from..."

Please rework this new option to also be name "Include in ...". When doing this, this needs to be inverted to be true by default both in the back end and in the front end.

The main problem with this logic is the migration process from older version.
As I understand, this will need a migration method for making all scopes include.in.openid.provider.metadata to true .
Do we want it? That's why I named it hide.from.openid.provider.metadata.

@cgeorgilakis - thank you for reaching out. I agree a migration method would not be ideal. Instead of a migration, I would suggest to have a default of "true" both in the backend and the frontend. WDYT?

Closes keycloak#10388 Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>

cgeorgilakis · 2025-11-03T13:02:36Z

@ahus1 I have made the requested changes.
The failed test is not PR fault, it is due to Could not resolve dependencies for project org.keycloak:keycloak-quarkus-integration-tests:jar:999.0.0-SNAPSHOT.

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

ahus1 · 2025-11-03T14:32:00Z

@cgeorgilakis - thank you, looks great. Some small changes here: eosc-kc#1028

As I wasn't allowed push the changes directly (no permission), so I created a PR on top of this PR.

Please merge my PR, and then this PR is ready to be merged.

Best,
Alexander

Review

stianst added team/core area/oidc OpenID Connect / OAuth 2.0 — tokens, endpoints, scopes, DCR, PAR, DPoP labels Aug 30, 2023

stianst added team/core-shared and removed team/core labels Feb 13, 2024

cgeorgilakis force-pushed the RCIAM-859-hideFromOpenIDProviderMetadata branch from dabaff3 to b5922c3 Compare June 19, 2024 11:20

cgeorgilakis requested review from a team as code owners June 19, 2024 11:20

keycloak-github-bot Bot added team/ui team/cloud-native team/core-clients team/core-iam labels Jun 19, 2024

keycloak-github-bot Bot added the flaky-test label Jun 19, 2024

This was referenced Jun 19, 2024

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled #30188

Closed

Flaky test: org.keycloak.testsuite.oauth.TokenIntrospectionTest#testUnsupportedToken #30111

Closed

ahus1 marked this pull request as draft June 19, 2024 12:55

cgeorgilakis force-pushed the RCIAM-859-hideFromOpenIDProviderMetadata branch from b5922c3 to 840ef55 Compare June 20, 2024 06:18

keycloak-github-bot Bot mentioned this pull request Jun 20, 2024

Flaky test: org.keycloak.testsuite.organization.exportimport.OrganizationExportTest#testExport #30598

Closed

cgeorgilakis force-pushed the RCIAM-859-hideFromOpenIDProviderMetadata branch 2 times, most recently from d1c2971 to 0002987 Compare October 23, 2025 06:51

keycloak-github-bot Bot reviewed Oct 23, 2025

View reviewed changes

cgeorgilakis force-pushed the RCIAM-859-hideFromOpenIDProviderMetadata branch 2 times, most recently from 0b59579 to 307bd7e Compare October 24, 2025 06:38

cgeorgilakis marked this pull request as ready for review October 24, 2025 06:40

keycloak-github-bot Bot mentioned this pull request Oct 24, 2025

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP #42601

Closed

keycloak-github-bot Bot reviewed Oct 24, 2025

View reviewed changes

ahus1 requested changes Oct 26, 2025

View reviewed changes

ahus1 self-assigned this Nov 1, 2025

1798

cgeorgilakis force-pushed the RCIAM-859-hideFromOpenIDProviderMetadata branch from ff5e779 to 7d0a2c6 Compare November 3, 2025 09:26

RCIAM-859 hide scopes from scopes_supported in discovery endpoint

F438

f6f3f66

Closes keycloak#10388 Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>

cgeorgilakis force-pushed the RCIAM-859-hideFromOpenIDProviderMetadata branch from 7d0a2c6 to f6f3f66 Compare November 3, 2025 10:56

cgeorgilakis requested a review from ahus1 November 3, 2025 13:02

Review

c50501c

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

Merge pull request #1028 from ahus1/is-10409-review

87930bb

Review

ahus1 approved these changes Nov 3, 2025

View reviewed changes

ahus1 enabled auto-merge (squash) November 3, 2025 15:27

ahus1 merged commit 1c0d461 into keycloak:main Nov 3, 2025
80 checks passed

keycloak-github-bot Bot mentioned this pull request Nov 3, 2025

Flaky test: org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest #43754

Closed

Navigation Menu

Repository navigation

hide scopes from scopes_supported in discovery endpoint - #10409

hide scopes from scopes_supported in discovery endpoint#10409
ahus1 merged 3 commits into
keycloak:mainfrom
eosc-kc:RCIAM-859-hideFromOpenIDProviderMetadata

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		hideFromOpenIdProviderMetadata=Hide from OpenID Provider Metadata
		hideFromOpenIdProviderMetadataHelp=If on, this client scope will be hidden from OpenID Provider Metadata.

Conversation

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest

Uh oh!

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!