keycloak/keycloak · error · RuntimeException

Fail to retrieve ECPublicJWK.CRV, ECPublicJWK.X or ECPublicJ

Error message

Fail to retrieve ECPublicJWK.CRV, ECPublicJWK.X or ECPublicJWK.Y field.

What it means

Error "Fail to retrieve ECPublicJWK.CRV, ECPublicJWK.X or ECPublicJWK.Y field." thrown in keycloak/keycloak.

Source

Thrown at core/src/main/java/org/keycloak/jose/jwk/JWKParser.java:101

            return JWKBuilder.EdEC_UTILS.createOKPPublicKey(jwk);
        } else if (KeyType.AKP.equals(keyType)) {
            return createAPKPublicKey(normalizedJwk);
        } else {
            throw new RuntimeException("Unsupported keyType " + keyType);
        }
    }

    private static PublicKey createECPublicKey(RawJsonValue jwk) {


        /* Try retrieving the necessary fields */
        String crv = jwk.path(ECPublicJWK.CRV).asText(null);
        String xStr = jwk.get(ECPublicJWK.X).asText(null);
        String yStr = jwk.get(ECPublicJWK.Y).asText(null);

        /* Check if the retrieving of necessary fields success */
        if (crv == null || xStr == null || yStr == null) {
            throw new RuntimeException("Fail to retrieve ECPublicJWK.CRV, ECPublicJWK.X or ECPublicJWK.Y field.");
        }

        BigInteger x = new BigInteger(1, Base64Url.decode(xStr));
        BigInteger y = new BigInteger(1, Base64Url.decode(yStr));

        String name;
        switch (crv) {
            case "P-256" :
                name = "secp256r1";
                break;
            case "P-384" :
                name = "secp384r1";
                break;
            case "P-521" :
                name = "secp521r1";
                break;
            default :
                throw new RuntimeException("Unsupported curve");

View on GitHub (pinned to 66c7e15a37)

Solutions

1. Ensure the EC JWK contains all three required fields: 'crv', 'x', and 'y'.
2. Verify the JWK JSON is complete and not truncated; 'x' and 'y' must be Base64URL-encoded coordinates.
3. Re-export the EC public key as a proper JWK using a library such as Nimbus JOSE JWT or Keycloak's JWKBuilder.

When it happens

Trigger: Parsing an EC JWK that is missing the crv, x, or y fields required to reconstruct the public key.

Common situations: Occurs with hand-crafted or truncated EC JWK documents, or JWKS responses that omit coordinate fields.

AI-assisted analysis of keycloak/keycloak@66c7e15a37 (2026-08-14). Data as JSON: /api/errors/69ea8ddba5b15f69. Report an issue: GitHub.