Repository navigation
verifiable credential in account console - #48940
Conversation
| // Construct the AIA action parameter | ||
| const config = { | ||
| credential_configuration_id: credential.credentialScopeName, | ||
| client_id: "account-console", |
There was a problem hiding this comment.
Is it possible to remove this line and avoid using client_id as a parameter inside AIA? As in real scenario, this client would be a wallet, but "account-console" client does not represent OID4VCI wallet.
It is OK if credential-offer is not target for any specific client as we have other protections in place to make sure that just allowed clients are able to obtain the verifiable credential (as the client needs to have the "optional scope" available, which is target to the specific credential)
| @Produces(MediaType.APPLICATION_JSON) | ||
| @NoCache | ||
| public Response getCredentials() { | ||
| auth.requireOneOf(AccountRoles.VIEW_VERIFIABLE_CREDENTIALS, AccountRoles.MANAGE_VERIFIABLE_CREDENTIALS); |
There was a problem hiding this comment.
| auth.requireOneOf(AccountRoles.VIEW_VERIFIABLE_CREDENTIALS, AccountRoles.MANAGE_VERIFIABLE_CREDENTIALS); | |
| auth.requireOneOf(AccountRoles.MANAGE_ACCOUNT, AccountRoles.VIEW_VERIFIABLE_CREDENTIALS, AccountRoles.MANAGE_VERIFIABLE_CREDENTIALS); |
Is it possible to include also MANAGE_ACCOUNT role here? That role is used in the account console in all other endpoints and user with this role is able to do anything in the account console.
This will also make sure that by default, account console "Verifiable credentials" work automatically for any user, which is aligned with other Keycloak "account" functionality.
I assume this may need some changes in the UI as well?
There was a problem hiding this comment.
@mposolda I was thinking if it makes sense to not have the new roles at all and just use MANAGE_ACCOUNT for delete and VIEW_PROFILE for get. WDYT?
There was a problem hiding this comment.
I think it is OK to have as you have in this PR right now. That is what was agreed for OID4VCI preview feature and is also aligned with some other account-console functionality (like consents or federated identities)
| @DELETE | ||
| @Path("/{credentialScopeName}") | ||
| public Response revokeCredential(@PathParam("credentialScopeName") String credentialScopeName) { | ||
| auth.require(AccountRoles.MANAGE_VERIFIABLE_CREDENTIALS); |
There was a problem hiding this comment.
| auth.require(AccountRoles.MANAGE_VERIFIABLE_CREDENTIALS); | |
| auth.require(AccountRoles.MANAGE_ACCOUNT, AccountRoles.MANAGE_VERIFIABLE_CREDENTIALS); |
Same like the other comment above.
@mposolda applied your suggestions, I was thinking if it makes sense to not have the new roles at all and just use MANAGE_ACCOUNT for delete and VIEW_PROFILE for get. It would be simpler to set up, but it wouldn't be possible to allow you to just remove the credentials and not do anything else on the account. So maybe it's okay to keep them. |
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testSavedPostRequestKeycloak CI - Adapter IT Strict Cookies |
There was a problem hiding this comment.
@graziang Thanks! Hope to merge once test failures are fixed (but I think they are unrelated as Javascript UI fails in other PRs as well... :-/ So maybe it might just need rebase once this is fixed in Keycloak main though...
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testSavedPostRequestKeycloak CI - Adapter IT Strict Cookies |
Closes keycloak#48576 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
Closes keycloak#48576 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
Closes keycloak#48576 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
Closes #48576
VIEW_VERIFIABLE_CREDENTIALSandMANAGE_VERIFIABLE_CREDENTIALSaccount client roles, created automatically for new realms, but not added as scope mapping to account console client. should we do it?AccountVerifiableCredentialResourcewith get/delete endpoints for credentials with roles checkAccountRestServiceRolesTestScreenshot:
