Repository navigation
Rename 'Pre-Authorized Code Lifespan' to 'Credential Offer Lifespan' - #47563
Conversation
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabledKeycloak CI - Java Distribution IT (windows-latest - temurin - 21) |
b022605 to
36841de
Compare
|
@officialasishkumar Could you please rebase your PR on top of latest main? Hopefully that helps with merge conflicts. |
36841de to
2532d15
Compare
|
Rebased onto latest main. There was one merge conflict in |
There was a problem hiding this comment.
Pull request overview
Renames the OID4VCI realm setting previously labeled “Pre-Authorized Code Lifespan” to “Credential Offer Lifespan” to reflect that the configured expiry applies to credential offers across both authorization_code and pre-authorized_code flows, while keeping backward compatibility for existing realms.
Changes:
- Backend: introduces
credentialOfferLifespanSrealm attribute (with deprecated legacy key fallback) and renames default lifespan constants accordingly. - Admin Console: updates Tokens tab field to read/write
attributes.credentialOfferLifespanSand updates the label/help i18n keys. - Docs & tests: updates documentation and Java/Playwright tests to reference the new attribute/constant names.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java | Updates tests to use the renamed default credential-offer lifespan constant. |
| tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/JwtPreAuthCodeHandlerTest.java | Updates lifespan constant reference used for expiry assertions. |
| tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java | Updates expiry test to use the new default credential-offer lifespan constant. |
| services/src/main/java/org/keycloak/protocol/oid4vc/issuance/requiredactions/VerifiableCredentialOfferAction.java | Reads new realm attribute with fallback to legacy key when computing offer expiry. |
| services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java | Defines new realm attribute key/constant names, deprecates old ones, and applies fallback logic. |
| js/apps/admin-ui/test/realm-settings/oid4vci-attributes.spec.ts | Updates UI tests to target the new attribute key in the Tokens tab form and persisted realm attributes. |
| js/apps/admin-ui/src/realm-settings/TokensTab.tsx | Switches the TimeSelector field to attributes.credentialOfferLifespanS and new i18n keys. |
| js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties | Renames label/help keys and improves the English help text to clarify applicability. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_zh_Hant.properties | Renames i18n keys for the setting in community locale bundle. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_zh_Hans.properties | Renames i18n keys for the setting in community locale bundle. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_tr.properties | Renames i18n keys for the setting in community locale bundle. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_sv.properties | Renames i18n keys for the setting in community locale bundle. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ru.properties | Renames i18n keys for the setting in community 8000 locale bundle. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_fr.properties | Renames i18n keys for the setting in community locale bundle. |
| js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_es.properties | Renames i18n keys for the setting in community locale bundle. |
| docs/documentation/server_admin/topics/oid4vci/vc-issuer-configuration.adoc | Updates the documented realm attribute name and description to match the new semantics. |
| label={t("credentialOfferLifespan")} | ||
| labelIcon={t("credentialOfferLifespanHelp")} |
There was a problem hiding this comment.
The admin UI now references the i18n keys credentialOfferLifespan/credentialOfferLifespanHelp, but at least one community locale file (e.g. messages_cs.properties) still only defines the old preAuthorizedCodeLifespan* keys. This will cause missing translations for those locales; please add the new keys (or update/alias the old ones) across all locale bundles.
| label={t("credentialOfferLifespan")} | |
| labelIcon={t("credentialOfferLifespanHelp")} | |
| label={t("credentialOfferLifespan", { | |
| defaultValue: t("preAuthorizedCodeLifespan"), | |
| })} | |
| labelIcon={t("credentialOfferLifespanHelp", { | |
| defaultValue: t("preAuthorizedCodeLifespanHelp"), | |
| })} |
| int codeLifeSpan = Optional.ofNullable(realm.getAttribute(CREDENTIAL_OFFER_LIFESPAN_REALM_ATTRIBUTE_KEY)) | ||
| .or(() -> Optional.ofNullable(realm.getAttribute(CODE_LIFESPAN_REALM_ATTRIBUTE_KEY))) | ||
| .map(Integer::valueOf) | ||
| .orElse(DEFAULT_CODE_LIFESPAN_S); | ||
| .orElse(DEFAULT_CREDENTIAL_OFFER_LIFESPAN_S); | ||
| int expiresAt = timeProvider.currentTimeSeconds() + codeLifeSpan; |
There was a problem hiding this comment.
codeLifeSpan now represents the credential offer lifespan (realm attribute credentialOfferLifespanS), so the variable name is misleading. Rename it (and any derived names) to reflect credential offers to avoid confusion with authorization/pre-authorized codes.
There was a problem hiding this comment.
Renamed codeLifeSpan to credentialOfferLifespan here so the local naming matches the renamed realm attribute.
| credentialOfferLifespan=預授權代碼持續時間 | ||
| credentialOfferLifespanHelp=預授權代碼的持續時間。 |
There was a problem hiding this comment.
These translated strings still mention “pre-authorized code” even though the setting was renamed to “Credential Offer Lifespan” and now applies to credential offers for multiple grant flows. Please update the label/help translation to match the new meaning (or fall back to English until a correct translation is available).
| credentialOfferLifespan=預授權代碼持續時間 | |
| credentialOfferLifespanHelp=預授權代碼的持續時間。 | |
| credentialOfferLifespan=Credential Offer Lifespan | |
| credentialOfferLifespanHelp=The lifespan of the credential offer. |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
| credentialOfferLifespan=预授权代码持续时间 | ||
| credentialOfferLifespanHelp=预授权代码的持续时间。 |
There was a problem hiding this comment.
These translated strings still mention “pre-authorized code” even though the setting was renamed to “Credential Offer Lifespan” and now applies to credential offers for multiple grant flows. Please update the label/help translation to match the new meaning (or fall back to English until a correct translation is available).
| credentialOfferLifespan=预授权代码持续时间 | |
| credentialOfferLifespanHelp=预授权代码的持续时间。 | |
| credentialOfferLifespan=凭证提供生命周期 | |
| credentialOfferLifespanHelp=凭证提供的生命周期。 |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
| credentialOfferLifespan=Ön Yetkilendirilmiş Kod Ömrü | ||
| credentialOfferLifespanHelp=Önceden yetkilendirilmiş kodun geçerlilik süresi. |
There was a problem hiding this comment.
These translated strings still mention “pre-authorized code” even though the setting was renamed to “Credential Offer Lifespan” and now applies to credential offers for multiple grant flows. Please update the label/help translation to match the new meaning (or fall back to English until a correct translation is available).
| credentialOfferLifespan=Ön Yetkilendirilmiş Kod Ömrü | |
| credentialOfferLifespanHelp=Önceden yetkilendirilmiş kodun geçerlilik süresi. | |
| credentialOfferLifespan=Kimlik Bilgisi Teklifi Ömrü | |
| credentialOfferLifespanHelp=Kimlik bilgisi teklifinin geçerlilik süresi. |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
| credentialOfferLifespan=Förhandsauktoriserad kod Livslängd | ||
| credentialOfferLifespanHelp=Livslängden för den förauktoriserade koden. |
There was a problem hiding this comment.
These translated strings still mention “pre-authorized code” even though the setting was renamed to “Credential Offer Lifespan” and now applies to credential offers for multiple grant flows. Please update the label/help translation to match the new meaning (or fall back to English until a correct translation is available).
| credentialOfferLifespan=Förhandsauktoriserad kod Livslängd | |
| credentialOfferLifespanHelp=Livslängden för den förauktoriserade koden. | |
| credentialOfferLifespan=Livslängd för erbjudande om autentiseringsuppgifter | |
| credentialOfferLifespanHelp=Livslängden för erbjudandet om autentiseringsuppgifter. |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
| credentialOfferLifespan=Время жизни предавторизованного кода | ||
| credentialOfferLifespanHelp=Время жизни предавторизованного кода. |
There was a problem hiding this comment.
These translated strings still mention “pre-authorized code” even though the setting was renamed to “Credential Offer Lifespan” and now applies to credential offers for multiple grant flows. Please update the label/help translation to match the new meaning (or fall back to English until a correct translation is available).
| credentialOfferLifespan=Время жизни предавторизованного кода | |
| credentialOfferLifespanHelp=Время жизни предавторизованного кода. | |
| credentialOfferLifespan=Время жизни предложения учетных данных | |
| credentialOfferLifespanHelp=Время жизни предложения учетных данных. |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
| credentialOfferLifespan=Durée de vie du code de pré-autorisation | ||
| credentialOfferLifespanHelp=La durée de vie du code de pré-autorisation. |
There was a problem hiding this comment.
These translated strings still mention “code de pré-autorisation” after renaming the setting to “Credential Offer Lifespan” (credential offers across multiple grant flows). Please update the label/help translation to reflect credential offers, not only pre-authorized codes.
| credentialOfferLifespan=Durée de vie du code de pré-autorisation | |
| credentialOfferLifespanHelp=La durée de vie du code de pré-autorisation. | |
| credentialOfferLifespan=Durée de vie de l'offre d'identifiants | |
| credentialOfferLifespanHelp=La durée de vie de l'offre d'identifiants. |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
| credentialOfferLifespan=Duración del código preautorizado | ||
| credentialOfferLifespanHelp=La vida útil del código preautorizado. |
There was a problem hiding this comment.
These translated strings still mention “código preautorizado” after renaming the setting to “Credential Offer Lifespan” (credential offers across multiple grant flows). Please update the label/help translation to reflect credential offers, not only pre-authorized codes.
| credentialOfferLifespan=Duración del código preautorizado | |
| credentialOfferLifespanHelp=La vida útil del código preautorizado. | |
| credentialOfferLifespan=Duración de la oferta de credencial | |
| credentialOfferLifespanHelp=La vida útil de la oferta de credencial. |
There was a problem hiding this comment.
Removed the stale locale-specific entry here so this falls back to the English credential-offer wording until a reviewed translation is available.
There was a problem hiding this comment.
@officialasishkumar Thanks for the updates. Added one more inline comment (sorry if I missed in previous review). Could you please doublecheck?
| @@ -70,12 +70,50 @@ export const RealmSettingsTokensTab = ({ | |||
|
|
|||
| const { control, register, reset, formState, handleSubmit } = | |||
| useFormContext<RealmRepresentation>(); | |||
| const credentialOfferLifespanDefaultValue = | |||
| realm.attributes?.["credentialOfferLifespanS"] ?? | |||
| realm.attributes?.["preAuthorizedCodeLifespanS"] ?? | |||
There was a problem hiding this comment.
Minor note (sorry if I did not mentioned it earlier):
OID4VCI is experimental feature. As such, it does not need any backwards compatibility. For the sake of siplicity, please remove any references to preAuthorizedCodeLifespanS (from both UI and tests and also from the server code), so that we don't need to have the codebase unnecessary complicated.
There was a problem hiding this comment.
Done. Removed all references to preAuthorizedCodeLifespanS from the UI (fallback logic and legacy cleanup in TokensTab.tsx), the server code (deprecated constants and .or() fallbacks in OID4VCIssuerEndpoint.java and VerifiableCredentialOfferAction.java), the migration test in oid4vci-attributes.spec.ts, and the stale Czech localization entries. Also rebased on latest main.
The OID4VCI realm setting displayed in the admin console Tokens tab as "Pre-Authorized Code Lifespan" was misleading because the underlying attribute controls the expiry of credential offers, which apply to both the authorization_code and pre-authorized_code grant flows. This commit renames the setting across the entire codebase: - Rename realm attribute from "preAuthorizedCodeLifespanS" to "credentialOfferLifespanS" in the Java code, with the old attribute key kept as a deprecated constant for backwards compatibility - Add fallback logic to read the legacy attribute name when the new one is not present, ensuring existing deployments continue to work - Rename Java field and constants to reflect the new naming - Update admin console label to "Credential Offer Lifespan" with an improved help text clarifying both grant flows are affected - Rename translation keys in all community locale files (es, fr, ru, sv, tr, zh_Hans, zh_Hant) - Update TokensTab.tsx and Playwright tests to use the new attribute - Update server administration documentation Closes keycloak#47274 Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
Put short string arguments on a single line with page.getByTestId() to satisfy prettier formatting rules. Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
5a4c28c to
18d53d8
Compare
OID4VCI is an experimental feature and does not require backwards compatibility. Remove the deprecated CODE_LIFESPAN_REALM_ATTRIBUTE_KEY and DEFAULT_CODE_LIFESPAN_S constants, the legacy attribute fallback logic in the UI and server code, and the migration test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
1460763 to
8b34064
Compare
Signed-off-by: Marek Posolda <mposolda@gmail.com>
There was a problem hiding this comment.
@officialasishkumar Thanks! There was conflict introduced in the meantime. I've tried to fix that manually and introduced a commit to your PR for that. Hopefully that helps and we would be able to merge this finally.
|
Thanks |
Translation Changes NotificationLanguage maintainers: Please review the translation changes in your language in Weblate. The following languages have been updated in this PR: Czech (
|
…eycloak#47563) Closes keycloak#47274 Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> Signed-off-by: Marek Posolda <mposolda@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Marek Posolda <mposolda@gmail.com>
The OID4VCI realm setting displayed in the admin console Tokens tab as "Pre-Authorized Code
Lifespan" was misleading because the underlying attribute (
preAuthorizedCodeLifespanS) controlsthe expiry of credential offers, which apply to both the
authorization_codeandpre-authorized_codegrant flows — not just the pre-authorized code flow.This commit renames the setting across the entire codebase:
preAuthorizedCodeLifespanStocredentialOfferLifespanS,with the old attribute key kept as a
@Deprecated(forRemoval = true)constant for backwardscompatibility. Added fallback logic in
OID4VCIssuerEndpointandVerifiableCredentialOfferActionto read the legacy attribute name when the new one is not present, ensuring existing deployments
continue to work without reconfiguration.
clarifying both grant flows are affected. Updated
TokensTab.tsxto use the new attribute name.zh_Hans, zh_Hant). Translated text values are preserved and should be updated by native speakers.
vc-issuer-configuration.adocwith the new attribute name and description.Closes #47274