Closed
Description
Describe the bug
On Quarkus, EC cryptography is not available immediately upon startup; any calls involving EC-signed JWTs will thus fail. This includes, but is not limited to:
- sending EC-signed request objects;
- client authentication using EC-signed JWTs;
- sending DPoP requests with EC signature (upcoming feature).
This happens because BouncyCastle provider is not installed by default. Once it gets initialized by a different code path (e.g. token generation), EC becomes available.
The issue is not observed on Wildfly since the startup process is different and BouncyCastle provider gets installed by RestEasy.
Version
18
Expected behavior
Operations involving EC cryptography should always be processed correctly.
Actual behavior
Operations involving EC cryptography would fail with root cause:
java.security.NoSuchAlgorithmException: ECDSA KeyFactory not available
How to Reproduce?
- start Keycloak on Quarkus;
- send OIDC Authorization request with request object signed using EC algorithm
Anything else?
No response