Repository navigation
Issue 38664 contextual mac algorithm - #54482
Open
jimmychakkalakal wants to merge 3 commits into
Open
jimmychakkalakal wants to merge 3 commits into
jimmychakkalakal wants to merge 3 commits into
Conversation
jimmychakkalakal
force-pushed
the
issue-38664-contextual-mac-algorithm
branch
from
October 30, 2026 12:45
96e854d to
091508b
Compare
jimmychakkalakal
force-pushed
the
issue-38664-contextual-mac-algorithm
branch
from
November 6, 2026 14:53
091508b to
037b06e
Compare
Closes keycloak#38664 Signed-off-by: Palash Thakur <117917450+palasht75@users.noreply.github.com> # Conflicts: # js/apps/admin-ui/test/clients/details.spec.ts
Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
jimmychakkalakal
force-pushed
the
issue-38664-contextual-mac-algorithm
branch
from
November 6, 2026 14:57
037b06e to
04e6726
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Switching from private_key_jwt to client_secret_jwt can retain and submit an incompatible RS256 value despite a blank selection, while the shared tooltip misstates the default and contextual label tests remain incomplete.
3 open issues
What changed in this PR
Updates Admin Console terminology to distinguish symmetric MAC algorithms from asymmetric signature algorithms, extending the clarification from #48988 to contextual client settings and related documentation.
Changes:
- Adds selection-dependent labels and tooltips to advanced OpenID Connect settings.
- Uses MAC terminology for client-secret JWT authentication and filters identity-provider options to symmetric algorithms.
- Updates administrator documentation and adds Credentials-tab regression tests.
| File | Description |
|---|---|
js/apps/admin-ui/test/clients/details.ts |
Adds helpers for algorithm labels and options. |
js/apps/admin-ui/test/clients/details.spec.ts |
Tests MAC versus signature terminology in Credentials. |
js/apps/admin-ui/src/identity-providers/add/OIDCAuthentication.tsx |
Adjusts assertion labels and options by authentication method. |
js/apps/admin-ui/src/clients/credentials/SignedJWT.tsx |
Uses MAC labels for client-secret JWT authentication. |
js/apps/admin-ui/src/clients/advanced/FineGrainOpenIdConnect.tsx |
Makes algorithm labels and tooltips selection-dependent. |
js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties |
Adds contextual labels and key-usage explanations. |
docs/documentation/server_admin/topics/identity-broker/oidc.adoc |
Clarifies OIDC client assertion algorithms and defaults. |
docs/documentation/server_admin/topics/identity-broker/oauth2.adoc |
Clarifies OAuth2 client assertion algorithms and defaults. |
docs/documentation/server_admin/topics/clients/oidc/con-confidential-client-credentials.adoc |
Explains shared-secret JWT authentication using MAC terminology. |
Review effort: Balanced
Co-authored-by: Palash Thakur <117917450+palasht75@users.noreply.github.com> Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>
jimmychakkalakal
force-pushed
the
issue-38664-contextual-mac-algorithm
branch
from
November 6, 2026 15:47
04e6726 to
374ffb6
Compare
jimmychakkalakal
marked this pull request as ready for review
November 6, 2026 16:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
• Clarifies algorithm labels in the client’s advanced OpenID Connect settings.
• Shows “MAC algorithm” for symmetric choices, “signature algorithm” for asymmetric choices, and a neutral label
when no algorithm is selected.
• Updates the tooltips to explain which key is used for each algorithm type.
This addresses the terminology concern raised in PR #48988 (#48988) for client settings that offer both algorithm types.
Closes #38664.
Co-authored by Palash Thakur (@palasht75) (https://github.com/palasht75).