{"record":{"id":"a7582fb7f756be78","repo":"quarkusio/quarkus","slug":"wraps-joseexception","errorCode":null,"errorMessage":"<wraps JoseException>","messagePattern":"<wraps JoseException>","errorType":"exception","errorClass":"OidcClientRegistrationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/ClientMetadata.java","lineNumber":191,"sourceCode":"            JsonObjectBuilder jwksBuilder = jsonProvider().createObjectBuilder();\n            jwksBuilder.add(\"keys\", keysBuilder);\n            builder.add(OidcConstants.CLIENT_METADATA_JWKS, jwksBuilder);\n            return this;\n        }\n\n        public Builder extraProps(Map<String, String> extraProps) {\n            if (built) {\n                throw new IllegalStateException();\n            }\n            builder.addAll(jsonProvider().createObjectBuilder(extraProps));\n            return this;\n        }\n\n        private static Map<String, Object> convertPublicKeyToJwk(PublicKey key) {\n            try {\n                return PublicJsonWebKey.Factory.newPublicJwk(key).toParams(OutputControlLevel.PUBLIC_ONLY);\n            } catch (JoseException ex) {\n                throw new OidcClientRegistrationException(ex);\n            }\n        }\n\n        private static String getAlgorithm(PublicKey publicKey) {\n            if (publicKey instanceof RSAPublicKey) {\n                return SignatureAlgorithm.RS256.getAlgorithm();\n            } else if (publicKey instanceof ECPublicKey) {\n                return SignatureAlgorithm.ES256.getAlgorithm();\n            } else if (publicKey instanceof EdECPublicKey) {\n                return SignatureAlgorithm.EDDSA.getAlgorithm();\n            } else {\n                throw new OidcClientRegistrationException(\"Unrecognized public key algorithm: \" + publicKey.getAlgorithm());\n            }\n        }\n\n        public ClientMetadata build() {\n            built = true;\n            return new ClientMetadata(builder.build());","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/ClientMetadata.java#L173-L209","documentation":"When building client metadata for registration, ClientMetadata converts the application's public key to a JWK via jose4j's PublicJsonWebKey.Factory.newPublicJwk(key). If jose4j cannot represent the key as a JWK it throws JoseException, which is wrapped in an OidcClientRegistrationException with the cause attached. This means the key material supplied for the client's signing/encryption configuration is not a supported public key format.","triggerScenarios":"Calling ClientMetadata builder code (via jwks()) with a public key of a type jose4j cannot convert, e.g. a DHPublicKey (Diffie-Hellman) or a custom/unknown PublicKey implementation passed into the metadata used for client registration.","commonSituations":"Passing a key loaded from an unsupported PEM/PKCS blob, using a DH or other exotic key type instead of RSA/EC/EdEC, or a misconfigured key factory producing the wrong key type at startup of OIDC client registration.","solutions":["Check the wrapped cause (ex.getCause()) to identify why jose4j rejected the key","Use an RSAPublicKey, ECPublicKey, or EdECPublicKey instead of unsupported key types (e.g. DH keys)","Regenerate or re-load the key pair with KeyPairGenerator for RSA/EC/Ed25519 and verify the public key instance type before passing it in"],"exampleFix":"// before\nPublicKey key = keyFactory.generatePublic(spec); // DH key\nmetadata.setJwks(...convertPublicKeyToJwk(key)...);\n// after\nKeyPairGenerator kpg = KeyPairGenerator.getInstance(\"RSA\");\nkpg.initialize(2048);\nPublicKey key = kpg.generateKeyPair().getPublic(); // RSAPublicKey, supported","handlingStrategy":"validation","validationCode":"if (!(key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey)) {\n    throw new IllegalArgumentException(\"Key type not convertible to JWK: \" + key.getAlgorithm());\n}","typeGuard":"static boolean isJwkConvertible(PublicKey key) {\n    return key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey;\n}","tryCatchPattern":"try {\n    Map<String, Object> jwk = metadata.toParams();\n} catch (OidcClientRegistrationException e) {\n    Throwable cause = e.getCause(); // JoseException\n    LOG.errorf(\"JWK conversion failed: %s\", cause.getMessage());\n}","preventionTips":["Only use RSA/EC/EdEC signing keys in registration metadata","Log the key algorithm at startup","Inspect e.getCause() when wrapping exceptions"],"tags":["oidc","jwk","key-format"],"backgroundTag":"unsupported-public-key-format","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}