8000 [OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity by tdiesler · Pull Request #48321 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity - #48321

Merged
mposolda merged 2 commits into
keycloak:mainfrom
tdiesler:ghi48045
Apr 29, 2026
Merged

[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity#48321
mposolda merged 2 commits into
keycloak:mainfrom
tdiesler:ghi48045

Conversation

@tdiesler
@tdiesler tdiesler commented Apr 21, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

closes #48045

Proposes to change DPoP authorization scheme checks to case insensitive as per RFC9110-11.1

@tdiesler
tdiesler requested a review from a team as a code owner April 21, 2026 12:56
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Apr 21, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot
keycloak-github-bot Bot commented Apr 21, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.LoginTest#loginDifferentUserAfterDisabledUserThrownOut

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.TimeoutException: 
Navigation timed out after 10000 ms
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1010-azure', java.version: '25.0.2'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

@tdiesler
tdiesler force-pushed the ghi48045 branch 2 times, most recently from 0c2f9f4 to 5a95d54 Compare April 21, 2026 14:21
@tdiesler
tdiesler requested review from a team as code owners April 21, 2026 14:21
@tdiesler
tdiesler force-pushed the ghi48045 branch 7 times, most recently from dbba8a4 to e817cd5 Compare April 21, 2026 19:05
@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Apr 21, 2026
Closed
@tdiesler
tdiesler marked this pull request as draft April 22, 2026 14:16
@tdiesler
tdiesler marked this pull request as ready for review April 22, 2026 14:16
@mposolda
mposolda commented Apr 22, 2026
Copy link
Copy Markdown
Contributor

@tnorimat What do you think about this change? To me, it looks OK, but wanted to ask for your review as well .

@tnorimat
tnorimat commented Apr 23, 2026
Copy link
Copy Markdown
Contributor

@tdiesler Hello, I would like to confirm the following point.

It seems that you run OpenID Foundation's conformance test. It has several test plan.
Which test plan you run againt keycloak?

In OAuth-SIG activity, whenever the new keycloak version is released, I run the following test plan for FAPI 2.0 Final against that, and I confirm that keycloak can pass the test "fapi2-security-profile-final-access-token-type-header-case-sensitivity
" in both test plans.

  • fapi2-security-profile-final-test-plan (FAPI 2.0 Security Profile Final)
  • fapi2-message-signing-final-test-plan (FAPI 2.0 Message Signing Final)

@tnorimat
tnorimat commented Apr 23, 2026
Copy link
Copy Markdown
Contributor

@tdiesler Also, I would like to confirm the following point.

According to RFC 9110 Section 11.1, it says that Authorization Header's auth-scheme part is case-insensitive while Keycloak does not follow that. Is that right?

Keycloak have endpoints that receives Authorization header with access token. One of such the endpoint is UserInfo Endpoint. Mayby this endpoint accepts "Authorization: Bearer " while reject "Authorization: beareR".

@tdiesler
tdiesler commented Apr 23, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor Author

Keycloak have endpoints that receives Authorization header with access token. One of such the endpoint is UserInfo Endpoint.

I removed the duplicate constant definition for "Bearer", so it should now be easy to find usages of all those auth schema definitions from TokenUtil. Yes, that it is fixed for "DPoP" does not mean it works in a general way

Here is a follow up task: #48387

@tdiesler
tdiesler commented Apr 23, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor Author

I confirm that keycloak can pass the test

May that is not the latest for fapi2-security-profile-final-access-token-type-header-case-sensitivity - there have been lots of changes recently.

I do this https://cloud-native.slack.com/archives/C05KR0TL4P8/p1776924994786509

@tdiesler
tdiesler commented Apr 23, 2026
Copy link
Copy Markdown
Contributor Author

To me, it looks OK, but wanted to ask for your review as well

FYI, we talked about this PR in the call and @dteleguin also gave his ok.

@tnorimat
tnorimat commented Apr 23, 2026
Copy link
Copy Markdown
Contributor

@mposolda Hello,

@tnorimat What do you think about this change? To me, it looks OK, but wanted to ask for your review as well .

Yes, it also looks good to me. Do you think it is needed to add the new test?

@mposolda
mposolda commented Apr 23, 2026
Copy link
Copy Markdown
Contributor

Yes, it also looks good to me. Do you think it is needed to add the new test?

@tdiesler Yes, I agree that automated test will be good as mentioned by @tnorimat . Besides that, the changes in the PR are also good to me.

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Apr 27, 2026
Closed
@tdiesler
[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-h…
b30654e 
…eader-case-sensitivity

Signed-off-by: Thomas Diesler <tdiesler@proton.me>
@tdiesler
-- add basic Authorization scheme case-sensitivity testing
0a2ebf7 
Signed-off-by: Thomas Diesler <tdiesler@proton.me>
mposolda
mposolda approved these changes Apr 28, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdiesler Thanks for the PR and adding the test

@tnorimat Is this PR look ok to you? Can you please review/approve if it is?

@tnorimat
tnorimat commented Apr 29, 2026
Copy link
Copy Markdown
Contributor

@mposolda The codes looks good to me. However, the test was implemented as already-deprecated Arquillian Integration Test. It is up to you to decide whether it is OK or not.

mposolda
mposolda approved these changes Apr 29, 2026
View reviewed changes
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tnorimat Thanks! It is OK for now. We will need some dedicated follow-up work to migrate DPoPTest to the new testsuite.

@mposolda
mposolda merged commit c013a2f into keycloak:main Apr 29, 2026
93 of 95 checks passed
@tdiesler
tdiesler deleted the ghi48045 branch April 29, 2026 08:30
@stianst stianst mentioned this pull request Jun 1, 2026
Closed
sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026
@tdiesler @sashyo
[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-h…
dae0204 
…eader-case-sensitivity (keycloak#48321)

closes keycloak#48045


Signed-off-by: Thomas Diesler <tdiesler@proton.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mposolda mposolda mposolda approved these changes
+2 more reviewers
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
@tnorimat tnorimat tnorimat approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

@tnorimat tnorimat

Labels

flaky-test team/cloud-native team/core-clients team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity

3 participants

@tdiesler @mposolda @tnorimat
0