Repository navigation
Backwards incompatible changes to 26.3.0 cause NullPointerException when requesting /certificates/jwt.credential/generate-and-download #41906
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
authentication
Describe the bug
Overview
After upgrade of Keycloak server from 26.1.2 to 26.3.2, our services started receiving 500 when requesting keypair and certificate generation (POST /auth/admin/realms/{realm}/clients/{client}/certificates/jwt.credential/generate-and-download).
Our server stack trace indicates a NullPointerException in ClientAttributeCertificateResource:
"exception": {
"refId":1,
"exceptionType":"java.lang.NullPointerException",
"message":"Cannot invoke \"java.lang.Integer.intValue()\" because the return value of \"org.keycloak.representations.KeyStoreConfig.getKeySize()\" is null",
"frames":[{"class":"org.keycloak.services.resources.admin.ClientAttributeCertificateResource","method":"generateAndGetKeystore","line":346}...
This issue happens because of backwards incompatible changes that were introduced in scope of this PR to solve #38620. The problem is that new fields keySize and validity are not nullable, but they do not have fallback values.
This change was reflected in keycloak-admin-client / keycloak-client-common-synced since 26.0.6, but previous versions do not support these fields.
So, our services that use keycloak-admin-client / keycloak-client-common-synced of older versions (26.0.4 / 26.0.5) now receive 500s.
Version
26.3.2
Regression
- The issue is a regression
Expected behavior
Contract of /auth/admin/realms/{realm}/clients/{client}/certificates/jwt.credential/generate-and-download endpoint is updated in a backwards compatible way to allow users to update server first and then client libraries with no downtime.
Actual behavior
Contract of /auth/admin/realms/{realm}/clients/{client}/certificates/jwt.credential/generate-and-download fail with 500 when new fields keySize and validity are not populated. This does not allow us to update server first and then client libraries with no downtime
How to Reproduce?
Request keypair and certificate generation using keycloak-admin-client / keycloak-client-common-synced on the version prior to 26.0.6 against Keycloak 26.3.2.
var config = new KeyStoreConfig();
config.setFormat("PKCS12");
config.setKeyAlias(clientId);
config.setKeyPassword(keyPassword);
config.setStorePassword(keyPassword);
var keystore = clientResource.getCertficateResource("jwt.credential").generateAndGetKeystore(config);
Anything else?
No response
Activity
Check null for new keySize and validity parameters when generating ce…
Check null for new keySize and validity parameters when generating ce…
Check null for new keySize and validity parameters when generating ce…
Check null for new keySize and validity parameters when generating ce…
Jayter commentedon Aug 20, 2025
Hi @stianst @rmartinc
Thanks for fixing the issue! Can you also tell me when we can expect 26.3.3 release that with a fix?
rmartinc commentedon Aug 20, 2025
@Jayter It's expected soon, probably this week.
[-]Backwards incompatible changes to 26.3.0 cause NullPoointerException when requesting /certificates/jwt.credential/generate-and-download[/-][+]Backwards incompatible changes to 26.3.0 cause NullPointerException when requesting /certificates/jwt.credential/generate-and-download[/+]