Repository navigation
Replies: 3 comments
|
I had same issue on Keycloak 26.2. |
0 replies
|
Thank you, I missed that, |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Bug Description
When uploading a client signing or encryption key (JKS, PEM, etc.) via the "Keys" tab in the Admin Console for a SAML client, the key material is not stored in the client configuration (ClientRepresentation). The configuration remains incomplete, and the key is not present in the exported JSON configuration. The UI incorrectly shows "Changes saved."
Steps to Reproduce
Start Keycloak in production mode (start, not start-dev).
Create a new SAML client.
In the client settings:
Navigate to Keys tab.
Check Client Signature Required.
Upload a certificate (PEM) via the import dialog.
Click "Save" (Admin Console shows "Changes saved").
Export the client configuration via:
Admin Console → Client → Export JSON,
or
Use REST API / kcadm.sh to get the client representation.
Expected Behavior
The exported JSON should include the following attributes:
"attributes": {
"saml.client.signature": "true",
"saml.signing.certificate": "MIIC......"
}
Uploaded key material should be stored in the client profile and used for verifying incoming signed SAML requests.
Actual Behavior
The "saml.signing.certificate" attribute is missing.
No signing key is stored in the client configuration.
The SAML client fails to verify signed AuthnRequests due to missing public key.
Environment
Keycloak Version: 26.1.3
Startup Mode: start (production mode)
Database: PostgreSQL 14
Deployment: Docker 28.1.1
Additional Context
The issue does not occur when setting the certificate manually via REST API or kcadm.sh.
This problem seems limited to the Admin Console UI (new design).
Behavior can be reproduced reliably on fresh Keycloak installations.
Workaround
Use kcadm.sh to manually set:
kcadm.sh update clients/
-s 'attributes.saml.client.signature=true'
-s 'attributes.saml.signing.certificate=MIIC...'
Request
Please confirm whether this is a UI bug or a known limitation. If confirmed, would be great if this is tracked and fixed.
All reactions