Simplify public key registration with OIDC client registration #48525
+107
−60
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment has been minimized.
This comment has been minimized.
michalvavrik
approved these changes
Jun 23, 2025
| } catch (NoSuchAlgorithmException e) { | ||
| throw new RuntimeException("Failed to generate key id", e); | ||
| } | ||
| private ClientMetadata createClientMetadata(String keycloakUrl) { |
There was a problem hiding this comment.
You can drop keycloakUrl as the client URI is not set anymore, but it's a test so probably not wort fixing.
sberyozkin
force-pushed
the
oidc_client_reg_public_key
branch
from
7e9e10c to
fbb7056
Compare
Status for workflow
|
gastaldi
approved these changes
Jun 23, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I've been planning to do it for a while, this minor PR makes it easier to deal with the advanced cases where the client metadata must include the public key in JWK format, the test code we have for it is good for tests, but is unlikely to work for users in general, but it was the only way to do it since the ClientMetadata builder API that I originally added was pretty limited in what it could do.
So I added two
jwksmethods to the builder to supplyPublicKeydirectly, defaulting to theuse=sig- which I expect to be the only case anyway as we don't deal at the OIDC level with OIDC providers supplying encryption keys in the public JWK set.I also added one
jwksmethod accepting a Map when users need to have more JWK properties like key id (it does not have to be crypto-safe but only unique in a given key set), and other properties.In the updated test example, I also dropped the
client_uriproperty which implies, in the dynamic client reg case, that in this case it can be for example Quarkus that supplies this page... OIDC provider may allocate it itself in some cases too. It is not important for the test in any case.