Stop storing client private keys in the database - #51612

services/src/main/java/org/keycloak/services/resources/admin/ClientAttributeCertificateResource.java:186

• Although the client attributes receive infoForStorage, the original upload representation (including an extracted private key) is still written to the admin event at line 188. Use the sanitized representation for the event as well so keystore uploads do not persist private keys in event storage.

            CertificateRepresentation infoForStorage = new CertificateRepresentation();
            infoForStorage.setCertificate(info.getCertificate());
            infoForStorage.setPublicKey(info.getPublicKey());
            infoForStorage.setKid(info.getKid());
            CertificateInfoHelper.updateClientModelCertificateInfo(client, infoForStorage, attributePrefix);

js/libs/keycloak-admin-client/src/resources/clients.ts:1015

• The newly deprecated method is still called without suppression in ExportSamlKeyDialog.tsx:36 and clients.spec.ts:980. With the workspace's no-deprecated rule, those callers cause lint errors.

  /**
   * @deprecated Private keys are no longer stored on the server. The downloaded
   *             keystore will only contain the certificate.
   */

js/libs/keycloak-admin-client/src/resources/clients.ts:1032

• Keys.tsx:87 and clients.spec.ts:955 still call this newly deprecated method without suppressing @typescript-eslint/no-deprecated, so the strict TypeScript lint configuration will reject them.

  /**
   * @deprecated Clients should generate their own key pairs and upload only the
   *             public key/certificate.
   */

tests/base/src/test/java/org/keycloak/tests/admin/client/CredentialsTest.java:147

• getKeyInfo() now strips private keys independently of storage, so this assertion would pass even if generate() still persisted the private-key attribute. Verify the underlying client model/database attribute directly to cover the security requirement.

        // But server should not have stored it
        CertificateRepresentation certFromGet = certRsc.getKeyInfo();
        assertNull(certFromGet.getPrivateKey(), "private key should not be stored on server");

services/src/main/java/org/keycloak/services/resources/admin/ClientAttributeCertificateResource.java:204

• This Javadoc still says the download contains a private key, contradicting the newly updated operation description and the implementation, which now obtains a public-only representation. Update it to state that the keystore contains only the public certificate.

     * @deprecated Clients should manage their own private keys.

js/apps/admin-ui/src/clients/keys/ExportSamlKeyDialog.tsx:37

• This action is now misleading because downloadKey returns a certificate-only keystore, while the dialog is still titled “Export SAML Keys” and KeyForm requires a key password described as the private-key password. Operators may mistake this export for a private-key backup; rename it as certificate export and remove the key-password field, or remove the deprecated action.

      // eslint-disable-next-line @typescript-eslint/no-deprecated
      const keyStore = await adminClient.clients.downloadKey(

integration/admin-client-core/src/main/java/org/keycloak/admin/client/resource/ClientAttributeCertificateResource.java:90

• The new deprecation text conflicts with the method description above, which still promises a keystore containing the private key. Update the public admin-client Javadoc to state that only the certificate is returned so callers do not treat this endpoint as private-key recovery.

     * @deprecated Clients should manage their own private keys.

services/src/main/java/org/keycloak/services/util/CertificateInfoHelper.java:173

• The updated JWKS upload test uses a public-only fixture, so it does not exercise the security behavior added here. Add coverage with private RSA/EC (and ideally symmetric/OKP) parameters that verifies both the stored JWKS and getKeyInfo() output omit every entry in this set.

    private static final Set<String> JWK_PRIVATE_KEY_PARAMS = Set.of("d", "p", "q", "dp", "dq", "qi", "oth", "k");

    public static String stripPrivateKeyParams(String jwks) {

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java:557

• This assertion verifies equivalence after re-serialization, but it doesn’t validate the new security behavior (that private JWK parameters are removed before storing). Add an assertion here that the stored JWKS_STRING (or the parsed actual keys) does not contain private parameters like d/p/q/dp/dq/qi/oth/k, so the test directly covers the private-key stripping requirement.

            JSONWebKeySet expected = JsonSerialization.readValue(jwks, JSONWebKeySet.class);
            JSONWebKeySet actual = JsonSerialization.readValue(client.getAttributes().get(OIDCConfigAttributes.JWKS_STRING), JSONWebKeySet.class);
            Assertions.assertEquals(JsonSerialization.writeValueAsString(expected), JsonSerialization.writeValueAsString(actual));

tests/base/src/test/java/org/keycloak/tests/admin/client/CredentialsTest.java:156

• adminEvents.poll() can return null, which would cause a NullPointerException at event.getRepresentation() and produce a less actionable test failure. Add an explicit assertNotNull(event, ...) (and potentially assertNotNull(event.getRepresentation(), ...)) before accessing it so failures clearly indicate the missing admin event.

        AdminEventRepresentation event = adminEvents.poll();
        assertFalse(event.getRepresentation().contains(cert.getPrivateKey()), "admin event should not contain private key");
        CertificateRepresentation expectedEventRep = new CertificateRepresentation();
        expectedEventRep.setCertificate(cert.getCertificate());
        AdminEventAssertion.assertEvent(event, OperationType.ACTION, AdminEventPaths.clientCertificateGenerateSecretPath(accountClient.toRepresentation().getId(), "jwt.credential"), expectedEventRep, ResourceType.CLIENT);