8000 fix: don't return the secret unless generated by shawkins · Pull Request #53028 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

fix: don't return the secret unless generated - #53028

Closed
shawkins wants to merge 1 commit into
keycloak:mainfrom
shawkins:iss52731
Closed

shawkins wants to merge 1 commit into
keycloak:mainfrom
shawkins:iss52731

Conversation

@shawkins
@shawkins shawkins commented Sep 21, 2026 •
Copy link
Copy Markdown
Contributor

closes: #52197

Strict interpretation of the medium term goal - #52197 (comment)

The only real downside is that we'll need to change a lot of tests.

Other possible behaviors:

  • return the secret for any mutative operation
  • behavior like v1 and still allow those with manage permission to read secrets

@vmuzikar @abstractj can I get a confirmation on the direction here?

closing to discuss more on the issue

closes: keycloak#52731

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
@shawkins
shawkins requested review from a team as code owners September 21, 2026 21:04
Copilot AI balanced review requested due to automatic review settings September 21, 2026 21:04
@shawkins
shawkins marked this pull request as draft September 21, 2026 21:04
Copilot AI left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Unrelated PATCH requests can rotate client secrets, and existing tests remain incompatible with the new contract.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2 High severity · 1 Low severity

Open (3)
What changed in this PR

Restricts Admin API v2 client-secret responses to newly generated or rotated secrets.

Changes:

  • Omits persisted secrets from model mappings.
  • Returns secrets only after generation or rotation.
  • Documents the revised API contract.
File Description
OIDCClientModelSchema.java Stops copying persisted secrets.
ClientResourceTypeProvider.java Tracks and returns generated secrets.
OIDCClientRepresentation.java Documents secret visibility.
openapi.json Updates generated API documentation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@shawkins shawkins closed this Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Admin API v2 returns plaintext client secret to view-clients role holders

2 participants

0