keycloak/keycloak · error · UnsupportedOperationException

EdDSA algorithms not supported in this JDK version

Error message

EdDSA algorithms not supported in this JDK version

What it means

Thrown by EdECUtilsUnsupportedImpl.okp when an attempt is made to build an OKP (EdDSA) JWK on a JDK older than 15. JWKBuilder statically loads EdECUtilsImpl (which uses java.security.spec.EdECPublicKeySpec, a Java 15+ API) and falls back to EdECUtilsUnsupportedImpl if that class cannot be loaded. The unsupported impl throws UnsupportedOperationException for any OKP operation. okp() is the key-to-JWK conversion path.

Source

Thrown at core/src/main/java/org/keycloak/jose/jwk/EdECUtilsUnsupportedImpl.java:38

import java.security.PublicKey;

import org.keycloak.crypto.KeyUse;

/**
 * <p>Unsupported implementation for old jdk versions.</p>
 *
 * @author rmartinc
 */
class EdECUtilsUnsupportedImpl implements EdECUtils {

    @Override
    public boolean isEdECSupported() {
        return false;
    }

    @Override
    public JWK okp(String kid, String algorithm, Key key, KeyUse keyUse) {
        throw new UnsupportedOperationException("EdDSA algorithms not supported in this JDK version");
    }

    @Override
    public PublicKey createOKPPublicKey(JWK jwk) {
        throw new UnsupportedOperationException("EdDSA algorithms not supported in this JDK version");
    }
}

View on GitHub (pinned to 66c7e15a37)

Solutions

1. Upgrade the runtime to JDK 15+ (Keycloak itself requires Java 17+ in recent versions) so EdECUtilsImpl loads.
2. Guard with JWKBuilder.EdEC_UTILS.isEdECSupported() before attempting OKP serialization and skip/fallback otherwise.
3. Use RSA or EC keys instead of EdDSA if the JDK cannot be upgraded.

Example fix

// before
JWK jwk = JWKBuilder.create().kid(kid).algorithm(Algorithm.Ed25519).key(edKey);

// after
if (!JWKBuilder.EdEC_UTILS.isEdECSupported()) {
    throw new IllegalStateException("EdDSA requires JDK 15+; current runtime cannot serialize OKP keys");
}
JWK jwk = JWKBuilder.create().kid(kid).algorithm(Algorithm.Ed25519).key(edKey);

public static boolean isEdEcAvailable() {
    return JWKBuilder.EdEC_UTILS.isEdECSupported();
}

public static boolean canSerializeOkp(Key key) {
    return key instanceof java.security.interfaces.EdECPublicKey
        && JWKBuilder.EdEC_UTILS.isEdECSupported();
}

try {
    JWK jwk = JWKBuilder.create().kid(kid).algorithm(Algorithm.Ed25519).key(edKey);
} catch (UnsupportedOperationException e) {
    if (e.getMessage().contains("EdDSA")) {
        throw new EnvironmentException("EdDSA serialization requires JDK 15+", e);
    }
    throw e;
}

When it happens

Trigger: Calling JWKBuilder.okp(...) (or JWKBuilder.algorithm(EdDSA).key(eddsaKey)) to serialize an EdDSA public key into a JWK while running on JDK 11 or earlier, where EdECUtilsImpl fails to load and the unsupported stub is active.

Common situations: Running a Keycloak-based app or an embedded jose/jwk utility on Java 11 (still common in legacy deployments) and attempting to register or expose an Ed25519/Ed448 key. The runtime simply lacks the JDK EdEC APIs.

Related errors

• Invalid JWK representation of OKP type algorithm
• Invalid JWK representation of OKP type public key
• Unknown curve for EdDSA {curve}
• Could not infer header from JWT
• Failed to parse JWT header

AI-assisted analysis of keycloak/keycloak@66c7e15a37 (2026-08-14). Data as JSON: /api/errors/46b696ec0433568f. Report an issue: GitHub.