OpenId Federation OP back end by cgeorgilakis · Pull Request #41419 · keycloak/keycloak

cgeorgilakis · 2025-07-25T10:47:12Z

This is the initial PR for supporting OpenID Federation with Keycloak being an OP and explicit registration, accepting only Entity Statement. Ui will be a separate PR, documentation will be enhanced based on it. Some code parts are taken from the OpenID Federation extensions, taking into account that we are in core Keycloak, needed bug fixes and code improvements , compliant with latest OpenID Federation specification version.

Some key points for the PR:

OpenID Federation is disabled by default and can be enabled with required configuration (more in ui part). Inspiration : https://www.authlete.com/developers/oidcfed/#configuring-federation
Keycloak as a proxy can participate in more than one Federation(Trust Anchor) with different configuration options especially for RP part, trust marks etc (future features). That’s why it is separated table.
Tests for explicit client registration has been done with a real test OpenID Federation(Trust Anchor, RP) via the help of golang lighthouse OpenID Federation implementation
I have added tests for Federation Entity Configuration. For adding testing for explicit registration we need to mock REST API for Trust Anchor Entity Configuration, fetch and list endpoints. Take into account that they are JWT signed statement. Moreover, we need to create a mock jwt valid during test execution for client explicit registrations. How could we develop it? I have only a mock Java code for create a RP entity Statement based on mock keys. Should it be a separate issue?

For more opened issues related to explicit client registration in an OP, you could see the epic issues.

cgeorgilakis · 2025-07-25T13:02:39Z

Information for testing this PR.

You will need to add the following realm configurations:
- "openidFederationOrganizationName " - "Keycloak foundation" (optional)
- "openidFederationLifespan" - "100000" (optinal default to 86400 – one day)
- "openidFederationEnabled" - "true"
- "openidFederationAuthorityHints" - "https://trust-anchor.sandbox.eosc.grnet.gr"
Moreover, you will need to create a trust anchor(federation) configuration using :

curl --request POST \
--url <root>/admin/realms/{realm-name}/openid-federations \
--header 'Authorization: Bearer {token} \
--header 'Content-Type: application/json' \
--data '{
  	"trustAnchor": "https://trust-anchor.sandbox.eosc.grnet.gr",
  	"clientRegistrationTypesSupported": [
  		"EXPLICIT"
  	],
  	"entityTypes": [
  		"OPENID_PROVIDER"
  	]
  }'

After you will be able to observe the signed JWT Federation Entity Configuration from /realms/{realm-name}/.well-known/openid-federation as described in the documentaion
For testing explicit registration, you will need to start server commenting the aud check in the class OpenIdFederationClientRegistrationService lines 146-148.

After you could execute the request :
curl --request POST \ --url <root>/realms/{realm-name}/openid-federation/clients-registrations \ --header 'Accept: application/entity-statement+jwt' \ --header 'Content-Type: application/entity-statement+jwt' \ --data {jwt}

For jwt you could use the signed JWT Federation Entity Configuration of our OpenID Federation RP signed JWT Entity Configuration, enrolled in the mentioned Trust Anchor (https://trust-anchor.sandbox.eosc.grnet.gr). This Trust Anchor is a docker deployment of an Trust Anchor implementation (see lighthouse deployment instructions.

After successfully request, an OIDC Client will be created, with only the difference that it will contain the attribute OIDCConfigAttributes.EXPIRATION_TIME. Response will contains the Explicit Client Registration Response.

On the client attribute OIDCConfigAttributes.EXPIRATION_TIME time, client will be disabled. Before or after the client expiration, you could execute the same request with an updated JWT Entity Configuration in order to enable client and extend expiration.
For a more real case scenario:
- You could provide us the JWT Federation Entity Configuration from /realms/{realm-name}/.well-known/openid-federation. We could enroll this Keycloak as OP in our OpenID Federation (https://trust-anchor.sandbox.eosc.grnet.gr).
- After I could execute from our egi-dev RP instance, a full explicit registration scenario. This will create your Keycloak instance as OpenID Federation in our egi-dev RP instance and a client of our egi-dev RP instance in your Keycloak. Maybe we will only need to add appropriate mappers and scopes for realising user attributes.
- After you will be able to login in our egi-dev RP instance with your users (fe account console).

cgeorgilakis · 2025-07-28T14:27:25Z

I want here to mention that our proposed implementation is based on EntityStatement which is the default body parameter described in the specification (see chapters 12.2 and 10, appendix A.3.2).
Body with Trust Chains (alternative way based on protocol) as body return Response.Status.NOT_IMPLEMENTED. I personally do not know which should be the appropriate checks in that case. Unfortunatelly, OpenID Federation conformance tests are only based on this body type.

pruivo

I didn't review the business logic as it is not my area of expertise. Added some suggestions here and there.
Related to Infinispan, I suspect the TaskCancellationEvent is broken when running in a clustered environment.

cgeorgilakis · 2025-08-01T12:07:53Z

I have made the following changes:

Remove Policies. Policies are required and I can provide a PR for the related issue, after merging this PR.
If Trunst Anchor fetch endpoint contains RPMetadata (optional), RPMetadata for registration should be changes based on fetch endpoint.
Propagate task cancellation for client disable in other nodes
Implement PR comments by @pruivo

pruivo

It looks good to me from the Infinispan perspective. I notice some warning reports from IntelliJ during code analysis.

pruivo · 2025-08-01T17:41:36Z

+            try {
+                statement = trustChainProcessor.parseAndValidateSelfSigned(body);
+            } catch (InvalidTrustChainException ex) {
+                ex.printStackTrace();


Don't print the stack trace to System.out. Log an error message.

pruivo · 2025-08-01T17:42:08Z

+                        }
+                    }
+                } catch (Exception ex) {
+                    ex.printStackTrace();


pruivo · 2025-08-01T17:42:19Z

+            jwtProcessor.process(token, null);
+
+        } catch(IOException | ParseException | BadJOSEException | JOSEException ex) {
+            ex.printStackTrace();


and here :)

pruivo · 2025-08-01T17:44:10Z

+    private AdminPermissionEvaluator auth;
+    private AdminEventBuilder adminEvent;


Those can be final too.

pruivo · 2025-08-01T17:46:32Z

+    }
+
+    private ConfigurableJWTProcessor<SecurityContext> produceJwtProcessor(JSONWebKeySet jwks) throws IOException, ParseException {
+        String jsonKey = om.writeValueAsString(jwks);


I'm unsure but I think you can remove om static field and use

Suggested change

String jsonKey = om.writeValueAsString(jwks);

String jsonKey = JsonSerialization.mapper.writeValueAsString(jwks);

I could use JsonSerialization similar methods. I have removed om ObjectMapper.

pruivo · 2025-08-01T17:49:27Z

+package org.keycloak.models;
+
+import java.io.Serializable;
+import java.util.ArrayList;


unused import

pruivo · 2025-08-01T17:50:07Z

@@ -54,6 +56,7 @@
 import org.keycloak.storage.UserStorageUtil;
 import org.keycloak.storage.client.ClientStorageProvider;

+import java.util.ArrayList;


unused import

pruivo · 2025-08-01T17:50:25Z

@@ -33,6 +33,8 @@
 import jakarta.persistence.NamedQuery;
 import jakarta.persistence.OneToMany;
 import jakarta.persistence.Table;
+
+import java.util.ArrayList;


unused import

pruivo · 2025-08-01T17:50:38Z

@@ -17,13 +17,15 @@

 package org.keycloak.models;

+import java.util.ArrayList;


unused import

pruivo · 2025-08-01T17:52:50Z

+                        } catch (IllegalArgumentException e) {
+                            return null;
+                        }
+                    } else if (alg instanceof String string) {


Intellij reports alg instanceof String string is always false. If so, it can be removed.

cgeorgilakis · 2025-08-07T13:02:06Z

It looks good to me from the Infinispan perspective. I notice some warning reports from IntelliJ during code analysis.

I have made the requested changes. See my extra comment.

stianst · 2025-09-04T12:35:48Z

I think it would make a lot of sense to build on the concept of identity providers to provide this trust relationship rather than introducing a whole new thing. See #42197

Also, look at #42229 (client assertions via 3rd party OIDC) or #42314 (client assertions via SPIFFE).

Closes keycloak#40511 Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>

bucchi · 2025-09-23T12:21:07Z

+    public void setOpenIdFederationList(List<OpenIdFederationEntity> openIdFederationList) {
+        this.openIdFederationList.clear();
+        if (openIdFederationList != null && !openIdFederationList.isEmpty()) {
+            this.openIdFederationList.addAll(openIdFederationList);


With my test code for Automatic Client Registration, an exception below is thrown here.

java.lang.UnsupportedOperationException
at java.base/java.util.ImmutableCollections.uoe(ImmutableCollections.java:142)
at java.base/java.util.ImmutableCollections$AbstractImmutableCollection.addAll(ImmutableCollections.java:148)
at org.hibernate.collection.spi.PersistentBag.addAll(PersistentBag.java:435)
at org.keycloak.models.jpa.entities.RealmEntity.setOpenIdFederationList(RealmEntity.java:619)
at org.keycloak.models.jpa.RealmAdapter.setOpenIdFederationGeneralConfig(RealmAdapter.java:1178)

One of the way for you to fix that is the modification of line 153
List<OpenIdFederationEntity> openIdFederationList = List.of();
to
List<OpenIdFederationEntity> openIdFederationList = new ArrayList<>();

You are right. I have fixed it.

c B9FE georgilakis · 2026-10-30T14:05:00Z

PR is closed, as it is old and we are reviewing our code with LLM for security fixes.
Moroever, need to be discussed for the way we will proceed with OPenId Federation epic.

cgeorgilakis requested review from a team as code owners July 25, 2025 10:47

keycloak-github-bot Bot added team/cloud-native team/core-clients team/core-iam team/production-readiness labels Jul 25, 2025

cgeorgilakis marked this pull request as draft July 28, 2025 06:34

cgeorgilakis force-pushed the 40511_openid_federation_op branch 2 times, most recently from 431a482 to b107ae6 Compare July 31, 2025 12:03

pruivo requested changes Jul 31, 2025

View reviewed changes

cgeorgilakis force-pushed the 40511_openid_federation_op branch 3 times, most recently from c63cc6e to 7ab9481 Compare August 1, 2025 12:03

cgeorgilakis requested a review from pruivo August 1, 2025 12:08

pruivo reviewed Aug 1, 2025

View reviewed changes

cgeorgilakis force-pushed the 40511_openid_federation_op branch from 4c1401f to a93b5a2 Compare August 7, 2025 12:45

cgeorgilakis requested a review from pruivo August 7, 2025 13:02

OpenId Federation OP back end

1937821

Closes keycloak#40511 Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>

cgeorgilakis force-pushed the 40511_openid_federation_op branch from 54f4346 to 1937821 Compare September 17, 2025 10:22

check that RP is registered as RP in immediate superior

e3abee6

bucchi reviewed Sep 23, 2025

View reviewed changes

change List.of to new ArrayList

d768a50

stianst added team/core-protocols and removed team/cloud-native team/core-clients team/core-iam team/production-readiness labels May 21, 2026

cgeorgilakis closed this Oct 30, 2026

		private AdminPermissionEvaluator auth;
		private AdminEventBuilder adminEvent;

	String jsonKey = om.writeValueAsString(jwks);
	String jsonKey = JsonSerialization.mapper.writeValueAsString(jwks);

		@@ -17,13 +17,15 @@

		package org.keycloak.models;

		import java.util.ArrayList;

Conversation

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

With my test code for Automatic Client Registration, an exception below is thrown here.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants