Migrate KcOidcBrokerIdpPublicKeyMissingUseTest and port the MissingUseJwks provider by sguilhen · Pull Request #52383 · keycloak/keycloak

sguilhen · 2026-09-03T14:30:50Z

Migrates KcOidcBrokerIdpPublicKeyMissingUseTest to the new JUnit 5 framework, landing in tests/base/.../broker/oidc/. Uses a custom JWKS provider (serving keys without the "use" field) to verify broker login still works with public-key validation.

Two commits, following the project's move-then-adapt pattern.

Ports MissingUseJwksRealmResourceProvider(+factory) from the legacy testsuite-providers module to tests/custom-providers, registered via META-INF/services. The legacy original is intentionally not removed - KcOidcBrokerPrivateKeyJwtMissingUseTest (not yet migrated, tracked in #52247) references the same missing-use-jwks endpoint and needs the legacy registration until that migration lands and removes the last legacy consumer. #52247 is flagged as depending on this PR landing first, since it reuses this ported copy instead of re-porting it.

License headers dropped from the ported files to match this module's existing convention (no headers in the new testsuite, per #51859's review).

Adapted to the merged abstract-class baseline: the concrete class extends AbstractKcOidcBrokerTest with no realm field overrides at all (both provider and consumer use the default config) - just the @BeforeEach that points the consumer IdP's JWKS URL at the custom endpoint.

Carries forward the fixes from #52372/#52376/#52379/#52382 (independently re-derived per batch, this branch is off upstream/main): visibility widening, the configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction.

Testing

mvn test -Dtest=KcOidcBrokerIdpPublicKeyMissingUseTest - 2/2 green (required rebuilding+installing tests/custom-providers locally first, since the test server resolves it as a Maven dependency via CustomProvidersServerConfig)
Re-ran KcOidcBrokerTest, KcOidcBrokerClientSecretBasicAuthTest, KcSamlBrokerTest (phase-1 baseline) - 6/6 green
mvn spotless:check clean

Closes #52246

Copilot

🟡 Changes recommended

The JWKS provider still emits use for OKP keys, contrary to its intended behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Migrates the missing-use OIDC broker test to JUnit 5 and ports its custom JWKS provider.

Changes:

Adds and registers the custom missing-use JWKS provider.
Migrates the broker test to tests/base.
Updates shared broker test helpers.

File summaries

File	Description
`testsuite/.../KcOidcBrokerIdpPublicKeyMissingUseTest.java`	Removes the legacy test.
`tests/custom-providers/.../RealmResourceProviderFactory`	Registers the provider factory.
`tests/custom-providers/.../MissingUseJwksRealmResourceProviderFactory.java`	Adds provider construction and ID.
`tests/custom-providers/.../MissingUseJwksRealmResourceProvider.java`	Serves the customized JWKS.
`tests/base/.../KcOidcBrokerIdpPublicKeyMissingUseTest.java`	Adds the migrated JUnit 5 test.
`tests/base/.../AbstractKcOidcBrokerTest.java`	Improves endpoint configuration and visibility.
`tests/base/.../AbstractBrokerTest.java`	Adds profile-related test helpers.
`tests/base/.../AbstractBrokerLoginTest.java`	Extracts reusable post-login assertions.

Review details

Files reviewed: 8/8 changed files
Comments generated: 1
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟢 Approval recommended

The migration preserves the legacy behavior, correctly registers the provider, and includes appropriate regression testing.

Review details

Files reviewed: 8/8 changed files
Comments generated: 0 new
Review effort level: Balanced

…kage Pure git rename of the legacy IdP-public-key-missing-use broker test into the new testsuite oidc package. No content changes; the new-testsuite adaptation follows in the next commit. Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Copilot

🟢 Approval recommended

The migration preserves the intended coverage and correctly integrates the custom provider.

Review details

Files reviewed: 5/5 changed files
Comments generated: 0 new
Review effort level: Balanced

…eJwks provider Uses the MissingUseJwks custom provider to serve JWKS without the "use" field, verifying that broker login still works with public key validation. Ports MissingUseJwksRealmResourceProvider(+factory) from the legacy testsuite-providers module to tests/custom-providers, registered via META-INF/services. The legacy original is NOT removed - the not-yet-migrated KcOidcBrokerPrivateKeyJwtMissingUseTest (part of a later batch) still references the same "missing-use-jwks" endpoint and needs the legacy provider registration until that migration lands and removes the last legacy consumer. License headers dropped from the ported files to match this module's existing convention (no headers in the new testsuite). Adapted to the merged abstract-class baseline: the concrete class extends AbstractKcOidcBrokerTest with no realm field overrides at all (both provider and consumer use the default config), just the @beforeeach that points the consumer IDP's JWKS URL at the custom endpoint. Carries forward the fixes from prior batches (independently re-derived per batch since this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction. Closes keycloak#52246 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

@Disables

…roviderFactory Tests propagation of the max_age parameter for brokered logins using the TestKeycloakOidcIdentityProviderFactory custom provider. The IDP is created with the test-keycloak-oidc providerId at realm setup time since providerId is immutable after creation via the admin API. Ports TestKeycloakOidcIdentityProviderFactory to tests/custom-providers. The legacy original is kept in place (not removed) - it is still used by other, not-yet-migrated legacy tests (KcCustomOidcBrokerTest, KcOidcFirstBrokerLoginTest, PasskeysKcOidcFirstBrokerLoginTest), confirmed via grep. No dependency on the other custom-provider migrations (keycloak#52383, coordinate. Adapted to the merged abstract-class baseline: extends AbstractKcOidcBrokerTest for the shared infra (provider realm uses the default config, only consumer is customized), but overrides and @Disables the two inherited login tests (testLogInAsUserInIDP, testLoginWithExistingUser) - legacy explicitly @ignore'd the same inherited test for this exact configuration (no client-forwarded prompt, custom provider factory), so this mirrors that rather than risk introducing untested, possibly-failing coverage. The two real tests (loginWithExistingUser without the "test" prefix, and testEnforceReAuthenticationWhenMaxAgeIsSet) are independent methods that exercise the max_age-specific flows directly, matching the phase-2 branch this content was sourced from. The consumer IDP clears the prompt attribute set by the shared config so the broker does not force an interactive login, mirroring the legacy KcOidcBrokerConfigurationWithPassMaxAge; without it the ignore-max-age error path is never exercised. Carries forward the fixes from prior batches (independently re-derived per batch since this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction. Closes keycloak#52249 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Copilot

🟢 Approval recommended

The migration preserves the tested behavior, correctly registers the provider, and addresses the prior OKP-key issue.

Review details

Files reviewed: 6/6 changed files
Comments generated: 0 new
Review effort level: Balanced

@Disables

…roviderFactory Tests propagation of the max_age parameter for brokered logins using the TestKeycloakOidcIdentityProviderFactory custom provider. The IDP is created with the test-keycloak-oidc providerId at realm setup time since providerId is immutable after creation via the admin API. Ports TestKeycloakOidcIdentityProviderFactory to tests/custom-providers. The legacy original is kept in place (not removed) - it is still used by other, not-yet-migrated legacy tests (KcCustomOidcBrokerTest, KcOidcFirstBrokerLoginTest, PasskeysKcOidcFirstBrokerLoginTest), confirmed via grep. No dependency on the other custom-provider migrations (#52383, coordinate. Adapted to the merged abstract-class baseline: extends AbstractKcOidcBrokerTest for the shared infra (provider realm uses the default config, only consumer is customized), but overrides and @Disables the two inherited login tests (testLogInAsUserInIDP, testLoginWithExistingUser) - legacy explicitly @ignore'd the same inherited test for this exact configuration (no client-forwarded prompt, custom provider factory), so this mirrors that rather than risk introducing untested, possibly-failing coverage. The two real tests (loginWithExistingUser without the "test" prefix, and testEnforceReAuthenticationWhenMaxAgeIsSet) are independent methods that exercise the max_age-specific flows directly, matching the phase-2 branch this content was sourced from. The consumer IDP clears the prompt attribute set by the shared config so the broker does not force an interactive login, mirroring the legacy KcOidcBrokerConfigurationWithPassMaxAge; without it the ignore-max-age error path is never exercised. Carries forward the fixes from prior batches (independently re-derived per batch since this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction. Closes #52249 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Migrate KcOidcBrokerPrivateKeyJwtMissingUseTest (JWKS without "use" field), KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest (JWKS with unsupported EC key), and KcOidcBrokerPrivateKeyJwtClientIdRequiredTest (custom client authenticator requiring client_id in request body). Ports UnsupportedKeyJwksRealmResourceProvider(+factory) and ClientIdRequiredJWTClientAuthenticator to tests/custom-providers (each used only by the test migrated here), plus re-ports MissingUseJwksRealmResourceProvider (+factory) already added by keycloak#52383 - this branch is off upstream/main and doesn't see that not-yet-merged PR, so it's duplicated here; expect a trivial rebase/dedup on whichever of keycloak#52383/this PR lands second, since both add the exact same file. **This PR depends on keycloak#52383 landing first** so the final merged history only carries one copy. Since this migrates the last legacy consumer of MissingUseJwks (the other, KcOidcBrokerIdpPublicKeyMissingUseTest, was migrated in keycloak#52383), this is where its legacy original is finally removed, alongside UnsupportedKeyJwks and ClientIdRequiredJWTClientAuthenticator's own legacy originals (both used exclusively by the two tests migrated here) - all three confirmed via grep to have no other legacy consumers before removal. The two legacy *RestResource helper classes (MissingUseJwksRestResource, UnsupportedKeyJwksRestResource) have no new-testsuite counterpart and are dropped with their providers. License headers stripped from the ported files to match this module's existing convention. Adapted to the merged abstract-class baseline: all three concrete classes extend AbstractKcOidcBrokerTest with no realm field overrides (both provider and consumer use the default config), just their respective @beforeeach provider/client setup. Carries forward the fixes from prior batches (independently re-derived per batch since this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction. Closes keycloak#52247 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Migrate KcOidcBrokerPrivateKeyJwtMissingUseTest (JWKS without "use" field), KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest (JWKS with unsupported EC key), and KcOidcBrokerPrivateKeyJwtClientIdRequiredTest (custom client authenticator requiring client_id in request body). Ports UnsupportedKeyJwksRealmResourceProvider(+factory) and ClientIdRequiredJWTClientAuthenticator to tests/custom-providers (each used only by the test migrated here), plus re-ports MissingUseJwksRealmResourceProvider (+factory) already added by #52383 - this branch is off upstream/main and doesn't see that not-yet-merged PR, so it's duplicated here; expect a trivial rebase/dedup on whichever of #52383/this PR lands second, since both add the exact same file. **This PR depends on #52383 landing first** so the final merged history only carries one copy. Since this migrates the last legacy consumer of MissingUseJwks (the other, KcOidcBrokerIdpPublicKeyMissingUseTest, was migrated in #52383), this is where its legacy original is finally removed, alongside UnsupportedKeyJwks and ClientIdRequiredJWTClientAuthenticator's own legacy originals (both used exclusively by the two tests migrated here) - all three confirmed via grep to have no other legacy consumers before removal. The two legacy *RestResource helper classes (MissingUseJwksRestResource, UnsupportedKeyJwksRestResource) have no new-testsuite counterpart and are dropped with their providers. License headers stripped from the ported files to match this module's existing convention. Adapted to the merged abstract-class baseline: all three concrete classes extend AbstractKcOidcBrokerTest with no realm field overrides (both provider and consumer use the default config), just their respective @beforeeach provider/client setup. Carries forward the fixes from prior batches (independently re-derived per batch since this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction. Closes #52247 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Copilot AI balanced review requested due to automatic review settings September 3, 2026 14:30

sguilhen requested review from a team as code owners September 3, 2026 14:30

keycloak-github-bot Bot added team/continuous-delivery team/core-iam labels Sep 3, 2026

Copilot started reviewing on behalf of sguilhen September 3, 2026 14:43

View session

sguilhen mentioned this pull request Sep 3, 2026

Migrate private-key-jwt custom provider broker tests #52387

Merged

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Comment thread .../main/java/org/keycloak/tests/providers/broker/oidc/MissingUseJwksRealmResourceProvider.java Resolved

This was referenced Sep 3, 2026

Migrate KcOidcBrokerVaultTest #52388

Merged

Migrate KcOidcBrokerPassMaxAgeTest and port TestKeycloakOidcIdentityProviderFactory #52390

Merged

Copilot AI review requested due to automatic review settings September 4, 2026 11:54

sguilhen force-pushed the 52246-broker-oidc-idp-public-key-missing-use branch from 26cabc6 to 57c575e Compare September 4, 2026 11:54

Copilot started reviewing on behalf of sguilhen September 4, 2026 11:55

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

sguilhen force-pushed the 52246-broker-oidc-idp-public-key-missing-use branch from 57c575e to f31a814 Compare September 4, 2026 12:20

Copilot AI review requested due to automatic review settings September 4, 2026 15:58

sguilhen force-pushed the 52246-broker-oidc-idp-public-key-missing-use branch from f31a814 to eded7de Compare September 4, 2026 15:58

Copilot started reviewing on behalf of sguilhen September 4, 2026 15:58

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

sguilhen force-pushed the 52246-broker-oidc-idp-public-key-missing-use branch from eded7de to 8b536ec Compare September 4, 2026 16:13

Copilot AI review requested due to automatic review settings September 4, 2026 16:13

Copilot started reviewing on behalf of sguilhen September 4, 2026 16:14

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

pedroigor approved these changes Sep 4, 2026

View reviewed changes

pedroigor merged commit 4e7c79c into keycloak:main Sep 4, 2026
94 checks passed

sguilhen deleted the 52246-broker-oidc-idp-public-key-missing-use branch September 21, 2026 18:57

Navigation Menu

Repository navigation

Migrate KcOidcBrokerIdpPublicKeyMissingUseTest and port the MissingUseJwks provider - #52383

Migrate KcOidcBrokerIdpPublicKeyMissingUseTest and port the MissingUseJwks provider#52383
pedroigor merged 2 commits into
keycloak:mainfrom
sguilhen:52246-broker-oidc-idp-public-key-missing-use

sguilhen commented Sep 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

sguilhen commented Sep 3, 2026

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants