Migrate private-key-jwt custom provider broker tests by sguilhen · Pull Request #52387 · keycloak/keycloak

sguilhen · 2026-09-03T14:43:26Z

Migrates the private-key-jwt custom-provider broker tests to the new JUnit 5 framework, landing in tests/base/.../broker/oidc/.

Two commits, following the project's move-then-adapt pattern.

Dependency on #52383

This PR depends on #52383 landing first. Both PRs port MissingUseJwksRealmResourceProvider(+factory) to tests/custom-providers - #52383 needs it for KcOidcBrokerIdpPublicKeyMissingUseTest, this PR needs it for KcOidcBrokerPrivateKeyJwtMissingUseTest. Since this branch is off upstream/main and doesn't see #52383's not-yet-merged content, the port is duplicated here rather than reused. Whichever PR merges second will need a trivial rebase to drop the now-duplicate file addition - the content is identical either way.

Since this migrates the last legacy consumer of MissingUseJwks (the other one, KcOidcBrokerIdpPublicKeyMissingUseTest, is migrated in #52383), this PR is where its legacy original is finally removed - alongside UnsupportedKeyJwksRealmResourceProvider(+factory) and ClientIdRequiredJWTClientAuthenticator's own legacy originals, both used exclusively by the two tests migrated here (confirmed via grep - no other legacy consumers). The two legacy *RestResource helper classes (MissingUseJwksRestResource, UnsupportedKeyJwksRestResource) have no new-testsuite counterpart and are dropped with their providers. License headers stripped from all ported files to match this module's existing convention.

Adapted to the merged abstract-class baseline: all three concrete classes extend AbstractKcOidcBrokerTest with no realm field overrides (both provider and consumer use the default config) - just their respective @BeforeEach provider/client setup.

Carries forward the fixes from #52372/#52376/#52379/#52382/#52383 (independently re-derived per batch, this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and assertUserCreatedInConsumerRealm().

Testing

mvn test -Dtest=KcOidcBrokerPrivateKeyJwtMissingUseTest,KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest,KcOidcBrokerPrivateKeyJwtClientIdRequiredTest - 6/6 green
Re-ran KcOidcBrokerTest, KcOidcBrokerClientSecretBasicAuthTest, KcSamlBrokerTest (phase-1 baseline) - 6/6 green
mvn spotless:check clean
Confirmed no remaining source references to the removed legacy provider classes

Closes #52247

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Migrates the remaining OIDC broker private-key-jwt legacy tests and their supporting custom providers to the new JUnit 5 test framework and tests/* layout.

Changes:

Removes 3 legacy testsuite/integration-arquillian broker tests and replaces them with JUnit 5 equivalents under tests/base/.../broker/oidc/.
Moves custom RealmResourceProviders and a ClientAuthenticator SPI registration from testsuite-providers to tests/custom-providers.
Updates shared broker test base utilities (endpoint matching, user-profile settings, and common post-login assertion helper).

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest.java	Removes legacy JUnit 4 test (migrated to `tests/base`).
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerPrivateKeyJwtMissingUseTest.java	Removes legacy JUnit 4 test (migrated to `tests/base`).
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerPrivateKeyJwtClientIdRequiredTest.java	Removes legacy JUnit 4 test (migrated to `tests/base`).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory	Drops provider registrations from `testsuite-providers` (moved to `tests/custom-providers`).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/META-INF/services/org.keycloak.authentication.ClientAuthenticatorFactory	Drops client authenticator registration from `testsuite-providers` (moved to `tests/custom-providers`).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/UnsupportedKeyJwksRestResource.java	Refactors old REST resource into a RealmResourceProvider (but currently with naming/packaging issues).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/UnsupportedKeyJwksRealmResourceProviderFactory.java	Updates factory package (but currently appears to remain under old module path).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/UnsupportedKeyJwksRealmResourceProvider.java	Removes old wrapper provider (now inlined into the resource/provider class).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/MissingUseJwksRestResource.java	Refactors old REST resource into a RealmResourceProvider (but currently with naming/packaging issues).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/MissingUseJwksRealmResourceProviderFactory.java	Updates factory package (but currently appears to remain under old module path).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/MissingUseJwksRealmResourceProvider.java	Removes old wrapper provider (now inlined into the resource/provider class).
testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/broker/oidc/ClientIdRequiredJWTClientAuthenticator.java	Moves authenticator into `org.keycloak.tests.providers...` package (but currently appears to remain under old module path).
tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory	Registers moved RealmResourceProviderFactories for the new test server config.
tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.authentication.ClientAuthenticatorFactory	Registers moved ClientAuthenticatorFactory for the new test server config.
tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest.java	Adds migrated JUnit 5 private-key-jwt unsupported-key test.
tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPrivateKeyJwtMissingUseTest.java	Adds migrated JUnit 5 private-key-jwt missing-use test.
tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPrivateKeyJwtClientIdRequiredTest.java	Adds migrated JUnit 5 private-key-jwt client_id-required test.
tests/base/src/test/java/org/keycloak/tests/broker/AbstractKcOidcBrokerTest.java	Improves provider client lookup for endpoint redirect URI rewrites; widens helper visibility.
tests/base/src/test/java/org/keycloak/tests/broker/AbstractBrokerTest.java	Adds user-profile / broker-flow helpers used by migrated tests.
tests/base/src/test/java/org/keycloak/tests/broker/AbstractBrokerLoginTest.java	Adds shared post-login assertion helper and ensures it’s invoked.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+                .findFirst().orElseThrow();
+
+        ClientRepresentation client = providerRealm.admin().clients().findByClientId(CLIENT_ID).get(0);
+        client.setClientAuthenticatorType(ClientIdRequiredJWTClientAuthenticator.PROVIDER_ID);


Copilot

🔵 Needs a closer look

Shared broker lifecycle changes and the pending dependent-PR rebase warrant final human validation.

Review details

Files reviewed: 20/20 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot

🟢 Approval recommended

The migration preserves the legacy scenarios, correctly registers their supporting providers, and reports focused passing tests.

Review details

Files reviewed: 17/17 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot

🟢 Approval recommended

The migration preserves the legacy scenarios and provider registrations, provided the documented #52383 merge ordering is followed.

Review details

Files reviewed: 18/18 changed files
Comments generated: 0 new
Review effort level: Balanced

Pure git rename of the three legacy private-key-jwt custom-provider broker tests into the new testsuite oidc package. No content changes; the new-testsuite adaptation follows in the next commit. Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Migrate KcOidcBrokerPrivateKeyJwtMissingUseTest (JWKS without "use" field), KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest (JWKS with unsupported EC key), and KcOidcBrokerPrivateKeyJwtClientIdRequiredTest (custom client authenticator requiring client_id in request body). Ports UnsupportedKeyJwksRealmResourceProvider(+factory) and ClientIdRequiredJWTClientAuthenticator to tests/custom-providers (each used only by the test migrated here), plus re-ports MissingUseJwksRealmResourceProvider (+factory) already added by keycloak#52383 - this branch is off upstream/main and doesn't see that not-yet-merged PR, so it's duplicated here; expect a trivial rebase/dedup on whichever of keycloak#52383/this PR lands second, since both add the exact same file. **This PR depends on keycloak#52383 landing first** so the final merged history only carries one copy. Since this migrates the last legacy consumer of MissingUseJwks (the other, KcOidcBrokerIdpPublicKeyMissingUseTest, was migrated in keycloak#52383), this is where its legacy original is finally removed, alongside UnsupportedKeyJwks and ClientIdRequiredJWTClientAuthenticator's own legacy originals (both used exclusively by the two tests migrated here) - all three confirmed via grep to have no other legacy consumers before removal. The two legacy *RestResource helper classes (MissingUseJwksRestResource, UnsupportedKeyJwksRestResource) have no new-testsuite counterpart and are dropped with their providers. License headers stripped from the ported files to match this module's existing convention. Adapted to the merged abstract-class baseline: all three concrete classes extend AbstractKcOidcBrokerTest with no realm field overrides (both provider and consumer use the default config), just their respective @beforeeach provider/client setup. Carries forward the fixes from prior batches (independently re-derived per batch since this branch is off upstream/main): visibility widening, configureBrokerEndpoints() placeholder-matching fix, enableUnmanagedAttributes(), disableUpdateProfileOnFirstLogin(), and the assertUserCreatedInConsumerRealm() extraction. Closes keycloak#52247 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Copilot

🟢 Approval recommended

The migration preserves the tested behavior, correctly registers the relocated providers, and leaves no unresolved references or correctness issues.

Review details

Files reviewed: 17/17 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot AI balanced review requested due to automatic review settings September 3, 2026 14:43

sguilhen requested review from a team as code owners September 3, 2026 14:43

keycloak-github-bot Bot added team/continuous-delivery team/core-iam labels Sep 3, 2026

This was referenced Sep 3, 2026

Migrate KcOidcBrokerVaultTest #52388

Merged

Migrate KcOidcBrokerPassMaxAgeTest and port TestKeycloakOidcIdentityProviderFactory #52390

Merged

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Copilot started reviewing on behalf of sguilhen September 3, 2026 15:09

View session

Copilot AI review requested due to automatic review settings September 4, 2026 14:23

sguilhen force-pushed the 52247-broker-oidc-private-key-jwt-providers branch from dda5594 to f318e2b Compare September 4, 2026 14:23

Copilot started reviewing on behalf of sguilhen September 4, 2026 14:33

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 4, 2026 15:58

sguilhen force-pushed the 52247-broker-oidc-private-key-jwt-providers branch from f318e2b to 706798c Compare September 4, 2026 15:58

Copilot started reviewing on behalf of sguilhen September 4, 2026 16:09

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 4, 2026 16:13

sguilhen force-pushed the 52247-broker-oidc-private-key-jwt-providers branch from 706798c to f2d93d0 Compare September 4, 2026 16:13

Copilot started reviewing on behalf of sguilhen September 4, 2026 16:14

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

sguilhen added 2 commits September 4, 2026 15:55

Copilot AI review requested due to automatic review settings September 4, 2026 19:11

sguilhen force-pushed the 52247-broker-oidc-private-key-jwt-providers branch from f2d93d0 to 59c7ed9 Compare September 4, 2026 19:11

Copilot started reviewing on behalf of sguilhen September 4, 2026 19:20

View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

pedroigor approved these changes Sep 8, 2026

View reviewed changes

pedroigor merged commit 8b6dff8 into keycloak:main Sep 8, 2026
94 checks passed

This was referenced Sep 15, 2026

Migrate KcOidcFirstBrokerLoginDetectExistingUserTest to tests/base #52787

Merged

migration broker package #51881

Closed

sguilhen deleted the 52247-broker-oidc-private-key-jwt-providers branch September 21, 2026 18:57

Navigation Menu

Repository navigation

Migrate private-key-jwt custom provider broker tests - #52387

Migrate private-key-jwt custom provider broker tests#52387
pedroigor merged 2 commits into
keycloak:mainfrom
sguilhen:52247-broker-oidc-private-key-jwt-providers

sguilhen commented Sep 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

sguilhen commented Sep 3, 2026

Dependency on #52383

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants