8000 Support for JWE IDToken and UserInfo tokens in OIDC brokers by rmartinc · Pull Request #21355 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Support for JWE IDToken and UserInfo tokens in OIDC brokers - #21355

Merged
pedroigor merged 1 commit into
keycloak:mainfrom
rmartinc:issue-21254
Jul 4, 2023
Merged

Support for JWE IDToken and UserInfo tokens in OIDC brokers#21355
pedroigor merged 1 commit into
keycloak:mainfrom
rmartinc:issue-21254

Conversation

@rmartinc
@rmartinc rmartinc commented Jun 30, 2023
Copy link
Copy Markdown
Contributor

Closes #21254

Adding JWE management for the OIDC brokering. The realm keys are used to decrypt the token. This way the IdP can use the realm jwks endpoint to obtain the public key to encrypt with. No configuration is needed, the OIDC provider now just checks if the token is JWE or JWS.

A new test that extends AbstractBrokerTest is added. It configures encryption in the provider clients to use JWE for IDToken and UserInfo. The test can be extended to setup different algorithms. The second test does just that, it sets up default algs.

Do you think that we should add the tests to other workflows? (FIPS for example.)

@rmartinc
rmartinc requested review from a team as code owners June 30, 2023 12:30
@rmartinc
rmartinc requested a review from a team June 30, 2023 12:30
@rmartinc
rmartinc requested a review from a team as a code owner June 30, 2023 12:30
pedroigor
pedroigor previously approved these changes Jun 30, 2023
View reviewed changes
@pedroigor
pedroigor commented Jun 30, 2023
Copy link
Copy Markdown
Contributor

@rmartinc As you pointed out, we might want to include this one in FIPS test job.

@rmartinc
rmartinc commented Jun 30, 2023
Copy link
Copy Markdown
Contributor Author

I have just thought about documentation. Wait for the moment, I think we need to add a paragraph in the admin server and a point in the release notes.

@rmartinc
rmartinc force-pushed the issue-21254 branch 2 times, most recently from 7173508 to 78fd33f Compare July 1, 2023 08:17
@ghost ghost added the flaky-test label Jul 1, 2023
@ghost ghost mentioned this pull request Jul 1, 2023
Closed
@pedroigor
pedroigor enabled auto-merge (rebase) July 3, 2023 15:21
@ghost ghost mentioned this pull request Jul 4, 2023
Closed
@ghost
ghost commented Jul 4, 2023
Copy link
Copy Markdown

Unreported flaky test detected

If the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#displayAvailableAuthenticators

Keycloak CI - WebAuthn IT (firefox)

java.lang.AssertionError: Expected SigningInPage but was Keycloak Account Management (https://localhost:8543/auth/realms/test/account/#/security/signingin&state=1e1317b9-f10d-42c4-8005-52f472e5b260&session_state=ae27d699-4e59-4d7f-88bc-16243ce9110e&code=b63a2014-89b8-4db0-a006-095201e5bc46.ae27d699-4e59-4d7f-88bc-16243ce9110e.2d41f093-189e-4ac0-a5a2-409348bb76d4)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.page.AbstractPage.assertCurrent(AbstractPage.java:110)
	at jdk.internal.reflect.GeneratedMethodAccessor538.invoke(Unknown Source)
...

Report flaky test

@pedroigor
pedroigor merged commit 09e30b3 into keycloak:main Jul 4, 2023
ghost
ghost reviewed Jul 4, 2023
View reviewed changes
@ghost ghost left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pedroigor pedroigor pedroigor approved these changes
+1 more reviewer
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test team/cloud-native

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Support for JWE IDToken and UserInfo tokens in OIDC brokers

2 participants

@rmartinc @pedroigor
0