[OID4VP] Delegate trust material to an external trust IdP by alias by dominikschlosser · Pull Request #51673 · keycloak/keycloak

dominikschlosser · 2026-08-12T10:49:42Z

@rmartinc @vaceksimon @mabartos This is required work for supporting the ETSI trust list integration thats needed for the EUDI ecosystem

@mposolda This does some refactoring for the TrustMaterialIdentityProvider and Cert chain validation / EKU requirements. So please review as well.

Trust delegation

Added trustMaterialIdps to the OID4VP idp config: comma-separated aliases of trust material identity providers (e.g. default-trust) supplying the trusted issuer keys and X.509 trust anchors. Takes precedence over the inline trustedIssuerJwks; config validation requires one of the two.
TrustMaterialSdJwtIssuerResolver mandates chain validation whenever the resolved trust material exposes X.509 anchors (HAIP 6.1.1): the credential's x5c must validate against the anchors and the chain leaf key verifies the signature; a credential without an x5c is rejected instead of silently falling back to key lookup. Only anchor-free configurations resolve trusted keys by kid/alg/iss hints.

Certificate chain validation moved out of the attestation code

Moved the generic PKIX chain validation from the package-private AttestationX509CertificateValidator to org.keycloak.crypto.X509CertificateChainValidator in core, so both OID4VCI attestation and OID4VP presentation verification share one implementation.
TrustMaterialIdentityProvider gained a default method validateX509Chain that validates the presented certificate chain against the provider's X.509 trust material. TrustMaterialResolver applies the same logic across several providers referenced by alias, replacing the removed AttestationX509CertificateValidator.

Required EKUs are configuration instead of being hardcoded

Renamed attestationExtendedKeyUsages to requiredExtendedKeyUsages (X509TrustMaterial.requiredExtendedKeyUsages accordingly): the leaf certificate must contain at least one of the configured OIDs, additional EKUs are fine, an empty list imposes no restriction.
Previously an EKU policy was mandatory for any X.509 trust material, which is an attestation-specific assumption. Issuer signing certificates in OID4VP are not bound to an attestation purpose though, so this had to be made more generic.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

mposolda · 2026-08-12T11:15:55Z

@forkimenjeckayang @Awambeng @IngridPuppet Just pinging you for the review (I am not able to add you directly as reviewers).

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-08-12T11:52:52Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.passwordless.WebAuthnPwdLessPropertyTest#timeout

Keycloak CI - WebAuthn IT

org.openqa.selenium.WebDriverException: 
unknown error: unhandled inspector error: {"code":-32000,"message":"Node with given id does not belong to the document"}
  (Session info: chrome=150.0.7871.128)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '25.0.3'
...

Report flaky test

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Signed-off-by: Dominik Schlosser <dominik.schlosser@gmail.com>

Copilot

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.

+            name="config.requiredExtendedKeyUsages"
+            label={t("requiredExtendedKeyUsages")}
+            labelIcon={t("requiredExtendedKeyUsagesHelp")}


mposolda

The updates in this PR looks good to me, but I did not verify the pieces related to VP.

Leaving to the @rmartinc , @mabartos , @vaceksimon .

@forkimenjeckayang @Awambeng @Ogenbertrand @IngridPuppet Anyone from your team available to review?

rmartinc

I tested this yesterday and it was working OK for the PID combined (configuring the trust using jwks and certificate). So I think it is OK. I'm approving and merging it.

@forkimenjeckayang @Awambeng @Ogenbertrand @IngridPuppet If anyone finds some issue, please fill a follow-up issue for the findings.

Thanks @dominikschlosser and all people involved here!

mabartos · 2026-08-25T12:25:22Z

@dominikschlosser @rmartinc Can you check this?

[Vulnerability] keycloak/keycloak: Improper Certificate Validation spaceraccoon/vulnerability-spoiler-alert#593

dominikschlosser · 2026-08-27T11:05:56Z

@mabartos I commented on the linked report, it is a false positive.

dominikschlosser requested a review from a team as a code owner August 12, 2026 10:49

Copilot AI balanced review requested due to automatic review settings August 12, 2026 10:49

dominikschlosser requested a review from a team as a code owner August 12, 2026 10:49

Copilot AI reviewed Aug 12, 2026

mposolda assigned mposolda and rmartinc Aug 12, 2026

keycloak-github-bot Bot added the flaky-test label Aug 12, 2026

keycloak-github-bot Bot mentioned this pull request Aug 12, 2026

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled #51600

Closed

keycloak-github-bot Bot reviewed Aug 12, 2026

View reviewed changes

stianst added the team/core-protocols label Aug 12, 2026

Copilot AI review requested due to automatic review settings August 12, 2026 17:15

dominikschlosser force-pushed the vp-trust-material-idp branch from 8944616 to 637f98e Compare August 12, 2026 17:15

Copilot AI reviewed Aug 12, 2026

Copilot AI review requested due to automatic review settings August 14, 2026 20:07

dominikschlosser force-pushed the vp-trust-material-idp branch from 637f98e to bdd4d3c Compare August 14, 2026 20:07

Copilot AI reviewed Aug 14, 2026

dominikschlosser force-pushed the vp-trust-material-idp branch from bdd4d3c to 056e005 Compare August 14, 2026 21:03

Copilot AI review requested due to automatic review settings August 14, 2026 21:03

Copilot AI reviewed Aug 14, 2026

Copilot AI review requested due to automatic review settings August 18, 2026 15:06

dominikschlosser force-pushed the vp-trust-material-idp branch from 056e005 to 9727b17 Compare August 18, 2026 15:06

Copilot AI reviewed Aug 18, 2026

Copilot AI review requested due to automatic review settings August 25, 2026 07:27

dominikschlosser force-pushed the vp-trust-material-idp branch from 9727b17 to d314ce1 Compare August 25, 2026 07:27

Copilot AI reviewed Aug 25, 2026

[OID4VP] Delegate trust material to an external trust IdP by alias

8cfad07

Signed-off-by: Dominik Schlosser <dominik.schlosser@gmail.com>

rmartinc force-pushed the vp-trust-material-idp branch from d314ce1 to 8cfad07 Compare August 25, 2026 08:46

Copilot AI review requested due to automatic review settings August 25, 2026 08:46

Copilot started reviewing on behalf of rmartinc August 25, 2026 08:47

View session

Copilot AI reviewed Aug 25, 2026

View reviewed changes

mposolda reviewed Aug 25, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/broker/trust/DefaultTrustIdentityProviderConfig.java Resolved

rmartinc approved these changes Aug 25, 2026

View reviewed changes

rmartinc merged commit 0c54fe8 into keycloak:main Aug 25, 2026
151 of 153 checks passed

github-actions Bot mentioned this pull request Aug 25, 2026

[Vulnerability] keycloak/keycloak: Improper Certificate Validation spaceraccoon/vulnerability-spoiler-alert#593

Open

Conversation

dominikschlosser commented Aug 12, 2026

Trust delegation

Certificate chain validation moved out of the attestation code

Required EKUs are configuration instead of being hardcoded

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

mposolda commented Aug 12, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Aug 12, 2026

Unreported flaky test detected

org.keycloak.testsuite.webauthn.passwordless.WebAuthnPwdLessPropertyTest#timeout

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mposolda left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rmartinc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mabartos commented Aug 25, 2026

Uh oh!

dominikschlosser commented Aug 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants