Repository navigation
Duplicate and different classes in keycloak-core/keycloak-common vs keycloak-client-synced #198
Description
Describe the bug
keycloak-client-common-synced 26.0.8 contains classes with same FQCN as in keycloak-core/keycloak-common 26.5.3 but with different content.
This libraries coincide in the runtime classpath because we have to use keycloak-crypto-default (needed for CryptoIntegration.init to succeed) and keycloak-admin-cli and the libraries mentioned above are fetched transitively.
[INFO] --- duplicate-finder-maven-plugin:1.5.0:check (default) @ <sanitized module name> ---
[INFO] Checking compile classpath
[INFO] Checking runtime classpath
[WARNING] Found duplicate and different classes in [org.keycloak:keycloak-client-common-synced:26.0.8, org.keycloak:keycloak-core:26.5.3]:
[WARNING] org.keycloak.representations.IDToken
[WARNING] org.keycloak.util.BasicAuthHelper
[WARNING] Found duplicate and different classes in [org.keycloak:keycloak-client-common-synced:26.0.8, org.keycloak:keycloak-common:26.5.3]:
[WARNING] org.keycloak.common.crypto.PemUtilsProvider
[WARNING] org.keycloak.common.util.KerberosSerializationUtils
[WARNING] Found duplicate classes/resources in runtime classpath.
Version
26.5.3
Expected behavior
No different versions of Keycloak classes in different libraries that have to be used together.
Actual behavior
When we have both of the libraries in the classpath the behavior of the software will be not predictable - which class the classloader should choose?
How to Reproduce?
Add keycloak-admin-client:26.0.8, keycloak-crypto-default:26.5.3 as dependencies to a module.
Check the classpath for duplicate classes (e.g. by using duplicate-finder-maven-plugin)
Anything else?
Keycloak 26.2.5 + keycloak-client 26.0.5 didn't have this issue.
Activity
lrozenblyum commentedon Feb 24, 2026
Keycloak 26.5.4 brings +1 different class:
org.keycloak.representations.info.SystemInfoRepresentationlrozenblyum commentedon Sep 10, 2026
Keycloak 26.7.3 + keycloak-client 26.0.12: the previously reported classes (
IDToken,SystemInfoRepresentation,BasicAuthHelper,PemUtilsProvider,KerberosSerializationUtils) are back in sync, but 5 different ones now diverge:What actually differs, for anyone triaging:
AccessToken: cosmetic only — server extracts therealm_access/resource_access/rolesJSON property names into constants; wire format unchanged.OrganizationInvitationRepresentation: server adds@DeprecatedoninviteLink(+ its getter/setter); the client's copy still presents it as non-deprecated.TokenUtil: server adds new methods (convertTokenRolesFromOtherClaims+ helpers) to mergerealm_access/resource_accessclaims found underotherClaimsinto the token's first-class fields; entirely missing from the client's copy.CollectionUtil: server adds a newpartition(Collection, int)helper; missing from the client's copy.KeycloakUriBuilder: server addsremoveQueryParamByDecodedName/removeFragmentParamByDecodedName, explicitly to catch percent-encoded param names (e.g.st%61tematchingstate) that plainreplaceQueryParammisses, plus a refactor of the underlying removal logic. The client's copy still has the older, narrower implementation. This one looks more than cosmetic.Same root cause as before —
keycloak-client-common-syncedisn't staying in sync withkeycloak-core/keycloak-commonrelease to release.