Weakness/49238 keycloak 27 remove deprecated client key generation endpoints by jimmychakkalakal · Pull Request #51679 · keycloak/keycloak

jimmychakkalakal · 2026-08-12T12:38:14Z

Remove deprecated client key generation REST endpoints

Remove the generate, generateAndDownload, and download endpoints from ClientAttributeCertificateResource. These endpoints stored private keys in client attributes, which is a security concern. Clients must now generate keys locally and upload only the certificate/public key.

Changes:
- Remove REST endpoints and admin client methods (Java +
    TypeScript)
- Remove privateKey field from CertificateRepresentation
    (Java + TS)
- Remove SAML private key storage (SamlClient,
    SamlConfigAttributes, TypedClientAttribute,
    SamlProtocolFactory, CertificateInfoHelper)
- Update SAML installation providers to use placeholder
    for private keys
- Delete ExportSamlKeyDialog, make SamlKeysDialog
    import-only
- Remove GenerateKeyDialog component, keep KeyForm for
    import flows
- Add Liquibase migration to drop private key columns
    from client attrs
- Update all tests to generate keys locally instead of
    via server API
- Add upgrade documentation in changes-27_0_0.adoc

Closes #49238

Copilot

Pull request overview

Removes deprecated client key-generation/download endpoints and prevents Keycloak from storing client private keys.

Changes:

Removes private-key endpoints and representation fields.
Converts Admin UI workflows to certificate import.
Adds database cleanup, tests, and migration documentation.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`testsuite/.../AbstractClientAuthSignedJWTTest.java`	Generates test keys locally.
`testsuite/.../KeystoreUtils.java`	Removes private-key representations and unused helpers.
`tests/.../ClientAuthSecretSignedJWTTest.java`	Sets test certificates locally.
`tests/.../PermissionsTest.java`	Removes endpoint permission checks.
`tests/.../CredentialsTest.java`	Replaces generation tests with upload tests.
`test-framework/.../CryptoKeyStore.java`	Stops exposing generated private keys.
`services/.../CertificateInfoHelper.java`	Stops reading and storing client private keys.
`services/.../ClientAttributeCertificateResource.java`	Removes deprecated REST endpoints.
`services/.../TypedClientAttribute.java`	Removes typed private-key attributes.
`services/.../SamlProtocolFactory.java`	Stops persisting generated SAML private keys.
`services/.../SamlConfigAttributes.java`	Removes SAML private-key constants.
`services/.../SamlClient.java`	Removes private-key accessors and unused setters.
`services/.../ModAuthMellonClientInstallation.java`	Excludes private keys from installation ZIPs.
`services/.../KeycloakSamlSubsystemCliInstallation.java`	Emits private-key placeholders.
`services/.../KeycloakSamlClientInstallation.java`	Emits private-key placeholders in XML.
`server-spi-private/.../KeycloakModelUtils.java`	Stops returning generated private keys.
`model/jpa/.../jpa-changelog-master.xml`	Registers the 27.0 migration.
`model/jpa/.../jpa-changelog-27.0.0.xml`	Deletes stored client private-key attributes.
`js/libs/keycloak-admin-client/test/clients.spec.ts`	Tests certificate upload and retrieval.
`js/libs/keycloak-admin-client/src/resources/clients.ts`	Removes deprecated client methods.
`js/libs/keycloak-admin-client/src/defs/certificateRepresentation.ts`	Removes the private-key field.
`js/apps/admin-ui/test/utils/files/cert.pem`	Adds an upload test certificate.
`js/apps/admin-ui/test/clients/saml.ts`	Adds certificate-import test support.
`js/apps/admin-ui/test/clients/saml.spec.ts`	Tests import-only SAML configuration.
`js/apps/admin-ui/src/index.ts`	Removes obsolete dialog exports.
`js/apps/admin-ui/.../SamlKeysDialog.tsx`	Makes SAML setup import-only.
`js/apps/admin-ui/.../SamlKeys.tsx`	Removes generation and export actions.
`js/apps/admin-ui/.../Keys.tsx`	Removes OIDC key generation.
`js/apps/admin-ui/.../GenerateKeyDialog.tsx`	Retains only the shared import form.
`js/apps/admin-ui/.../ExportSamlKeyDialog.tsx`	Deletes SAML key export UI.
`integration/admin-client-core/.../ClientAttributeCertificateResource.java`	Removes deprecated Java client methods.
`docs/.../changes/changes.adoc`	Registers 27.0 migration notes.
`docs/.../changes/changes-27_0_0.adoc`	Documents the breaking API change.
`core/.../CertificateRepresentation.java`	Removes private-key API serialization.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Remove the generate, generateAndDownload, and download endpoints from ClientAttributeCertificateResource. These endpoints stored private keys in client attributes, which is a security concern. Clients must now generate keys locally and upload only the certificate/public key. Changes: - Remove REST endpoints and admin client methods (Java + TypeScript) - Remove privateKey field from CertificateRepresentation (Java + TS) - Remove SAML private key storage (SamlClient, SamlConfigAttributes, TypedClientAttribute, SamlProtocolFactory, CertificateInfoHelper) - Update SAML installation providers to use placeholder for private keys - Delete ExportSamlKeyDialog, make SamlKeysDialog import-only - Remove GenerateKeyDialog component, keep KeyForm for import flows - Add Liquibase migration to drop private key columns from client attrs - Update all tests to generate keys locally instead of via server API - Add upgrade documentation in changes-27_0_0.adoc Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

Copilot

Pull request overview

Copilot reviewed 35 out of 35 changed files in this pull request and generated no new comments.

Suppressed comments (4)

model/jpa/src/main/resources/META-INF/jpa-changelog-27.0.0.xml:22

The removed endpoint accepted any {attr} value and stored the key as <attr>.private.key, so this allowlist leaves private keys generated under custom prefixes in the database. Delete every attribute whose name ends in .private.key to satisfy the migration's security goal.

            <where>NAME IN ('saml.signing.private.key', 'saml.encryption.private.key', 'jwt.credential.private.key')</where>

services/src/main/java/org/keycloak/services/clienttype/client/TypedClientAttribute.java:71

Removing these typed attributes without removing saml.encryption.private.key and saml.signing.private.key from services/src/main/resources/keycloak-default-client-types.json:182,218 leaves the global SAML client type API advertising options that the delegate no longer recognizes. Remove both JSON properties as part of this change.

    SAML_ENCRYPTION_CERTIFICATE("saml.encryption.certificate", null),

integration/admin-client-core/src/main/java/org/keycloak/admin/client/resource/ClientAttributeCertificateResource.java:46

This admin-client Javadoc still says /upload can upload a private key, although the server now extracts only the certificate. Update it so consumers are not told that removed behavior remains supported.

     * Upload certificate and eventually private key

js/libs/keycloak-admin-client/src/resources/clients.ts:998

The admin-client README still lists all three removed methods/endpoints at js/libs/keycloak-admin-client/README.md:285-287. Update that API documentation together with this removal so users are not directed to nonexistent operations.

  public uploadKey = this.makeUpdateRequest<

These exports reference a deleted file and a removed component. Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

keycloak-github-bot · 2026-08-13T12:13:18Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPSearchForUsersPaginationTest#testPagination

Keycloak CI - Base IT (5)

java.lang.AssertionError: 

Expected: a collection with size <10>
     but: collection size was <2>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

These exports reference a deleted file and a removed component. Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

keycloak-github-bot Bot added the team/core-protocols label Aug 12, 2026

jimmychakkalakal requested a balanced review from Copilot August 12, 2026 12:39

Copilot started reviewing on behalf of jimmychakkalakal August 12, 2026 12:41 View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

jimmychakkalakal force-pushed the weakness/49238-Keycloak-27-Remove-Deprecated-Client-Key-Generation-Endpoints branch 2 times, most recently from 074232d to 3bec486 Compare August 12, 2026 17:49

jimmychakkalakal force-pushed the weakness/49238-Keycloak-27-Remove-Deprecated-Client-Key-Generation-Endpoints branch 2 times, most recently from 5714ae3 to 9d25dfd Compare August 13, 2026 08:51

jimmychakkalakal requested a balanced review from Copilot August 13, 2026 08:51

Copilot started reviewing on behalf of jimmychakkalakal August 13, 2026 08:52 View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

jimmychakkalakal force-pushed the weakness/49238-Keycloak-27-Remove-Deprecated-Client-Key-Generation-Endpoints branch from 9d25dfd to 2229fdd Compare August 13, 2026 09:56

Remove dangling ExportSamlKeyDialog and GenerateKeyDialog re-exports

bb1a53f

These exports reference a deleted file and a removed component. Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

jimmychakkalakal force-pushed the weakness/49238-Keycloak-27-Remove-Deprecated-Client-Key-Generation-Endpoints branch from 2229fdd to bb1a53f Compare August 13, 2026 10:05

Remove dangling ExportSamlKeyDialog and GenerateKeyDialog re-exports

4276a03

These exports reference a deleted file and a removed component. Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

keycloak-github-bot Bot added the flaky-test label Aug 13, 2026

keycloak-github-bot Bot mentioned this pull request Aug 13, 2026

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled #51600

Open

keycloak-github-bot Bot reviewed Aug 13, 2026

View reviewed changes

jimmychakkalakal added 2 commits August 13, 2026 15:40

Remove dangling ExportSamlKeyDialog and GenerateKeyDialog re-exports

6dfe9a2

These exports reference a deleted file and a removed component. Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

Remove dangling ExportSamlKeyDialog and GenerateKeyDialog re-exports

0eec5a1

These exports reference a deleted file and a removed component. Closes keycloak#49238 Signed-off-by: Jimmy Chakkalakal <jimmy.chakkalakal@ibm.com>

Navigation Menu

Uh oh!

Weakness/49238 keycloak 27 remove deprecated client key generation endpoints - #51679

Weakness/49238 keycloak 27 remove deprecated client key generation endpoints#51679
jimmychakkalakal wants to merge 5 commits into
keycloak:mainfrom
jimmychakkalakal:weakness/49238-Keycloak-27-Remove-Deprecated-Client-Key-Generation-Endpoints

jimmychakkalakal commented Aug 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

keycloak-github-bot Bot commented Aug 13, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jimmychakkalakal commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot commented Aug 13, 2026

Unreported flaky test detected

org.keycloak.testsuite.federation.ldap.LDAPSearchForUsersPaginationTest#testPagination

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jimmychakkalakal commented Aug 12, 2026 •

edited

Loading