{"record":{"id":"30ffcec7259774b8","repo":"quarkusio/quarkus","slug":"unrecognized-public-key-algorithm-publickey-geta","errorCode":null,"errorMessage":"Unrecognized public key algorithm: <publicKey.getAlgorithm()>","messagePattern":"Unrecognized public key algorithm: <publicKey\\.getAlgorithm\\(\\)>","errorType":"exception","errorClass":"OidcClientRegistrationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/ClientMetadata.java","lineNumber":203,"sourceCode":"        }\n\n        private static Map<String, Object> convertPublicKeyToJwk(PublicKey key) {\n            try {\n                return PublicJsonWebKey.Factory.newPublicJwk(key).toParams(OutputControlLevel.PUBLIC_ONLY);\n            } catch (JoseException ex) {\n                throw new OidcClientRegistrationException(ex);\n            }\n        }\n\n        private static String getAlgorithm(PublicKey publicKey) {\n            if (publicKey instanceof RSAPublicKey) {\n                return SignatureAlgorithm.RS256.getAlgorithm();\n            } else if (publicKey instanceof ECPublicKey) {\n                return SignatureAlgorithm.ES256.getAlgorithm();\n            } else if (publicKey instanceof EdECPublicKey) {\n                return SignatureAlgorithm.EDDSA.getAlgorithm();\n            } else {\n                throw new OidcClientRegistrationException(\"Unrecognized public key algorithm: \" + publicKey.getAlgorithm());\n            }\n        }\n\n        public ClientMetadata build() {\n            built = true;\n            return new ClientMetadata(builder.build());\n        }\n    }\n}\n","sourceCodeStart":185,"sourceCodeEnd":213,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/ClientMetadata.java#L185-L213","documentation":"ClientMetadata.getAlgorithm maps a public key's Java type to a JOSE signature algorithm: RSAPublicKey -> RS256, ECPublicKey -> ES256, EdECPublicKey -> EDDSA. If the key is none of these, it throws OidcClientRegistrationException because no JWS algorithm can be derived for it. This happens before any JWK is emitted from jwks().","triggerScenarios":"Calling jwks() on a ClientMetadata builder whose public key is not an RSAPublicKey, ECPublicKey, or EdECPublicKey instance — e.g. a DHPublicKey or a provider-specific PublicKey implementation.","commonSituations":"Using X25519/DH keys meant for encryption (not signing), keys loaded through a JCE provider producing non-standard key classes, or wiring the wrong key (private-context key) into client registration metadata.","solutions":["Provide an RSA, EC, or EdEC public key so a signature algorithm (RS256/ES256/EDDSA) can be selected","Verify key type with key instanceof RSAPublicKey / ECPublicKey / EdECPublicKey before building metadata","If encryption keys are needed separately, do not pass them where a signing key is expected"],"exampleFix":"// before\nPublicKey key = loadKey(\"dh-key.pem\"); // not signable\nbuilder.publicKey(key);\n// after\nPublicKey key = loadKey(\"rsa-key.pem\");\nif (!(key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey)) {\n    throw new IllegalArgumentException(\"Need RSA/EC/EdEC public key\");\n}\nbuilder.publicKey(key);","handlingStrategy":"validation","validationCode":"boolean signable = key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey;\nif (!signable) throw new IllegalArgumentException(\"No JWS algorithm for key: \" + key.getAlgorithm());","typeGuard":"static String algorithmFor(PublicKey key) {\n    if (key instanceof RSAPublicKey) return \"RS256\";\n    if (key instanceof ECPublicKey) return \"ES256\";\n    if (key instanceof EdECPublicKey) return \"EDDSA\";\n    return null;\n}","tryCatchPattern":"try {\n    String alg = clientMetadata.getAlgorithm(key);\n} catch (OidcClientRegistrationException e) {\n    LOG.errorf(\"Unsupported signing key: %s\", e.getMessage());\n}","preventionTips":["Map key type to algorithm before calling library code","Avoid DH/X25519 encryption keys where signing keys are required","Test key loading in dev config early"],"tags":["oidc","jwk","key-format","signature-algorithm"],"backgroundTag":"unsupported-public-key-format","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}