Repository navigation
Conversation
Closes keycloak#38664 Signed-off-by: Palash Thakur <117917450+palasht75@users.noreply.github.com>
e25af4c to
a5d99f5
Compare
|
@palasht75 can you please rebase to the latest main? |
There was a problem hiding this comment.
I think that PR is not complete. If we accept this change, we should rather update it on all relevant places. At least, it may update also at least the documentation https://www.keycloak.org/docs/latest/server_admin/index.html#_client-credentials .
Another thing is, that we have lots of options on various places, which allow both asymmetric and symmetric algorithms. For example, client has various options like "ID Token signature algorithms" etc. I am not sure if tooltips of those should be updated as well or if we can keep them as they are? This may need additional review whether to update or keep those. For the inspiration, here is OIDC dynamic client registration specification (some of Keycloak client options are "mapped" to OIDC dynamic client registration options https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata ).
|
Thanks, @palasht75, for your contribution and for starting the work to clarify MAC terminology. I’m continuing the work separately and expanding the updates to other relevant algorithm settings and documentation, so I’m closing this PR. |
Summary
Updates the Admin Console wording for HMAC algorithms used with
client_secret_jwt.Previously, the Admin Console referred to HS256, HS384, and HS512 as "Signature algorithm" options in this context. This change uses MAC terminology for the HMAC-based client secret JWT authenticator while preserving signature terminology where it applies to actual signature algorithms.
Closes #38664.
Testing
Using Java 21 / the repository-required frontend tooling:
cd js && corepack pnpm install --prefer-offline --frozen-lockfile- PASScd js && corepack pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-ui lint- PASScd js && corepack pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-ui test- PASScd js && corepack pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-ui build- PASSbash -c "$(sed 's/\\r$//' mvnw)" ./mvnw spotless:check- PASScd js && corepack pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-ui exec playwright install chromium- PASScd js && corepack pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-ui test:integration -- test/clients/details.spec.ts --project=chromium- PASScd js && corepack pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-ui test:integration -- test/clients/advanced.spec.ts --project=chromium- PASSRisk
The change is scoped to Admin Console terminology for client authentication algorithm selection.
No supported algorithms, stored configuration values, API behavior, or client authentication behavior are changed.