(26.6) Check consento for JWT Authorization Grant by graziang · Pull Request #52115 · keycloak/keycloak

graziang · 2026-08-27T07:16:54Z

Closes #52028

(cherry picked from commit 99da283)

Closes keycloak#52028 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com> (cherry picked from commit 99da283)

lhanusov · 2026-08-27T09:37:20Z


            String scopeParam = getRequestedScopes();

+            if (!TokenManager.verifyConsentStillAvailable(session, user, client, TokenManager.getRequestedClientScopes(session, scopeParam, client, user))) {


this one differs from the original cherry pick, please can you elaborate on it? thanks

verifyConsentStillAvailable has been refactored in 26.7 as part of parameterized scopes feature, I'm passing the scope parameter as a stream like before

thanks for the explanation

lhanusov · 2026-08-27T09:39:06Z

there are 2 failures in the compatibility checks

pskopek

The backported code looks fine! The test issues are not related to the change (looks like infrastructure issue). We can try to re-run a bit later.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-08-27T11:20:30Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Keycloak CI - Forms IT (chrome)

java.lang.AssertionError: Expected LoginUsernameOnlyPage but was localhost (https://localhost:8543/auth/realms/test/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%3A8543%2Fauth%2Frealms%2Fmaster%2Fapp%2Fauth&client_id=test-app)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:39)
	at org.keycloak.testsuite.pages.LoginPage.open(LoginPage.java:292)
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-08-27T13:43:59Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Keycloak CI - Forms IT (chrome)

java.lang.AssertionError: Expected LoginUsernameOnlyPage but was localhost (https://localhost:8543/auth/realms/test/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%3A8543%2Fauth%2Frealms%2Fmaster%2Fapp%2Fauth&client_id=test-app)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:39)
	at org.keycloak.testsuite.pages.LoginPage.open(LoginPage.java:292)
...

Report flaky test

keycloak-github-bot · 2026-08-27T17:53:32Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Keycloak CI - Forms IT (chrome)

java.lang.AssertionError: Expected LoginUsernameOnlyPage but was localhost (https://localhost:8543/auth/realms/test/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%3A8543%2Fauth%2Frealms%2Fmaster%2Fapp%2Fauth&client_id=test-app)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:39)
	at org.keycloak.testsuite.pages.LoginPage.open(LoginPage.java:292)
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-08-28T05:17:37Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Keycloak CI - Forms IT (chrome)

java.lang.AssertionError: Expected LoginUsernameOnlyPage but was localhost (https://localhost:8543/auth/realms/test/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%3A8543%2Fauth%2Frealms%2Fmaster%2Fapp%2Fauth&client_id=test-app)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:39)
	at org.keycloak.testsuite.pages.LoginPage.open(LoginPage.java:292)
...

Report flaky test

graziang requested a review from a team as a code owner August 27, 2026 07:16

keycloak-github-bot Bot added the team/core-protocols label Aug 27, 2026

graziang changed the title ~~Check consento for JWT Authorization Grant~~ (26.6) Check consento for JWT Authorization Grant Aug 27, 2026

keycloak-github-bot Bot added the flaky-test label Aug 27, 2026

keycloak-github-bot Bot mentioned this pull request Aug 27, 2026

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled #51600

Closed

Check consento for JWT Authorization Grant

a2900eb

Closes keycloak#52028 Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com> (cherry picked from commit 99da283)

graziang force-pushed the backport-52079-26.6 branch from 96b5351 to a2900eb Compare August 27, 2026 08:21

lhanusov reviewed Aug 27, 2026

View reviewed changes

pskopek reviewed Aug 27, 2026

View reviewed changes

lhanusov approved these changes Aug 27, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Aug 27, 2026

View reviewed changes

mposolda self-assigned this Aug 27, 2026

mposolda approved these changes Aug 27, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Aug 27, 2026

View reviewed changes

keycloak-github-bot Bot reviewed Aug 28, 2026

View reviewed changes

mposolda merged commit 8424659 into keycloak:release/26.6 Aug 28, 2026
224 of 260 checks passed


		String scopeParam = getRequestedScopes();

		if (!TokenManager.verifyConsentStillAvailable(session, user, client, TokenManager.getRequestedClientScopes(session, scopeParam, client, user))) {

Conversation

graziang commented Aug 27, 2026

Uh oh!

lhanusov Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

graziang Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

lhanusov Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

lhanusov commented Aug 27, 2026

Uh oh!

pskopek left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Aug 27, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Aug 27, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Uh oh!

keycloak-github-bot Bot commented Aug 27, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Aug 28, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithProperty

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants