Feature/38310 tls client auth idp brokering - #51414

services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java:308

• This overload bypasses legacy validate(RealmModel) overrides in subclasses. For example, GoogleIdentityProviderConfig's issuer check and the generic OAuth provider's required-claim checks no longer run now that RepresentationToModel calls only this overload; dispatch through validate(realm) before the common checks (or migrate every existing override).

    public void validate(KeycloakSession session, RealmModel realm) {

services/src/main/java/org/keycloak/connections/httpclient/DefaultHttpClientFactory.java:206

• With the supported disable-trust-manager=true setting, configureBuilder sets the disable flag and HttpClientBuilder.build() replaces this supplied SSL context with a new context initialized with null key managers (HttpClientBuilder.java:270-275). The resulting mTLS client never presents the selected certificate, so tls_client_auth fails; preserve the custom key managers when applying the passthrough trust manager.

        if (sslContext != null) {
            builder.sslContext(sslContext);

server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpRequest.java:258

• The owned client is closed only when client.execute throws, but createHttpRequest, form/entity creation, and header configuration can all throw before this try (for example for an invalid URL or a POST with no content). Those failures leak the dedicated client; widen the cleanup guard to cover the entire request-construction path.

        try {
            return new SimpleHttpResponse(client.execute(httpRequest), maxConsumedResponseSize, objectMapper, this::onCloseRequest);
        } catch (IOException | RuntimeException e) {
            onCloseRequest();
            throw e;

services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java:746

• This overload resets max-consumed-response-size to the hard-coded 10 MB default, unlike SimpleHttp.create(session), so every mTLS backchannel request ignores the operator's configured response-size limit. Carry HttpClientProvider.getMaxConsumedResponseSize() onto the owned client.

        return SimpleHttp.create(buildMtlsHttpClient(), CLOSE_CLIENT);

services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java:309

• Calling the new overload here bypasses existing subclasses that override only validate(RealmModel). In particular, the anonymous config in OAuth2IdentityProviderFactory.java:59-75 will no longer reject missing user-info/claim settings, so invalid generic OAuth IdPs can now be persisted; invoke the legacy overload before the new session-dependent checks (or keep the shared checks in that overload).

    public void validate(KeycloakSession session, RealmModel realm) {
        SslRequired sslRequired = realm.getSslRequired();

services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java:746

• This overload initializes SimpleHttp with DEFAULT_MAX_CONSUMED_RESPONSE_SIZE, so mTLS responses ignore the provider's configured max-consumed-response-size while non-mTLS requests honor it. Carry the provider limit onto the owned-client request as well.

        return SimpleHttp.create(buildMtlsHttpClient(), CLOSE_CLIENT);

js/apps/admin-ui/src/identity-providers/add/OIDCAuthentication.tsx:53

• Swallowing the expected 403 leaves certKeyProviderOptions empty, so an administrator with manage-identity-providers but not view-realm can select tls_client_auth but cannot supply its required key provider and every save is rejected. Either expose the eligible providers through an endpoint authorized for IdP management or clearly require/report the additional permission instead of silently rendering an unusable form.

      try {
        const keysMetadata = await adminClient.realms.getKeys({ realm });
        return keysMetadata.keys ?? [];
      } catch (error) {
        console.warn(

js/apps/admin-ui/src/identity-providers/add/OIDCAuthentication.tsx:68

• The keys endpoint includes DISABLED keys, but this filter offers every entry with a certificate; selecting a disabled provider then deterministically fails the server-side isEnabled() validation. Filter the options to the ACTIVE/PASSIVE statuses accepted by IdpClientCertificateResolver.

      if (k.certificate && k.providerId && !seen.has(k.providerId)) {

services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java:309

• Changing this override to the session-aware overload bypasses existing validate(RealmModel) overrides in subclasses. For example, the generic OAuth provider's required user-info/claim checks and GoogleIdentityProviderConfig's issuer validation no longer run during create/update; dispatch the legacy overload before the new session-dependent checks.

    public void validate(KeycloakSession session, RealmModel realm) {
        SslRequired sslRequired = realm.getSslRequired();

services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java:742

• This SimpleHttp.create overload always uses DEFAULT_MAX_CONSUMED_RESPONSE_SIZE, so mTLS backchannel calls ignore the server's configured response-size limit that SimpleHttp.create(session) honors. Carry the provider limit over to avoid changing the memory bound only for tls_client_auth requests.

        return SimpleHttp.create(buildMtlsHttpClient(), CLOSE_CLIENT);

js/apps/admin-ui/src/identity-providers/add/OIDCAuthentication.tsx:68

• The selector includes DISABLED certificate keys, while IdpClientCertificateResolver only accepts ACTIVE or PASSIVE keys. Selecting such an offered provider therefore guarantees that create/update is rejected; filter options by enabled status.

      if (k.certificate && k.providerId && !seen.has(k.providerId)) {