quarkusio/quarkus · error · OidcClientRegistrationException

Unrecognized public key algorithm: <publicKey.getAlgorithm()

Error message

Unrecognized public key algorithm: <publicKey.getAlgorithm()>

What it means

ClientMetadata.getAlgorithm maps a public key's Java type to a JOSE signature algorithm: RSAPublicKey -> RS256, ECPublicKey -> ES256, EdECPublicKey -> EDDSA. If the key is none of these, it throws OidcClientRegistrationException because no JWS algorithm can be derived for it. This happens before any JWK is emitted from jwks().

Source

Thrown at extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/ClientMetadata.java:203

        }

        private static Map<String, Object> convertPublicKeyToJwk(PublicKey key) {
            try {
                return PublicJsonWebKey.Factory.newPublicJwk(key).toParams(OutputControlLevel.PUBLIC_ONLY);
            } catch (JoseException ex) {
                throw new OidcClientRegistrationException(ex);
            }
        }

        private static String getAlgorithm(PublicKey publicKey) {
            if (publicKey instanceof RSAPublicKey) {
                return SignatureAlgorithm.RS256.getAlgorithm();
            } else if (publicKey instanceof ECPublicKey) {
                return SignatureAlgorithm.ES256.getAlgorithm();
            } else if (publicKey instanceof EdECPublicKey) {
                return SignatureAlgorithm.EDDSA.getAlgorithm();
            } else {
                throw new OidcClientRegistrationException("Unrecognized public key algorithm: " + publicKey.getAlgorithm());
            }
        }

        public ClientMetadata build() {
            built = true;
            return new ClientMetadata(builder.build());
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Provide an RSA, EC, or EdEC public key so a signature algorithm (RS256/ES256/EDDSA) can be selected
2. Verify key type with key instanceof RSAPublicKey / ECPublicKey / EdECPublicKey before building metadata
3. If encryption keys are needed separately, do not pass them where a signing key is expected

Example fix

// before
PublicKey key = loadKey("dh-key.pem"); // not signable
builder.publicKey(key);
// after
PublicKey key = loadKey("rsa-key.pem");
if (!(key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey)) {
    throw new IllegalArgumentException("Need RSA/EC/EdEC public key");
}
builder.publicKey(key);

boolean signable = key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey;
if (!signable) throw new IllegalArgumentException("No JWS algorithm for key: " + key.getAlgorithm());

static String algorithmFor(PublicKey key) {
    if (key instanceof RSAPublicKey) return "RS256";
    if (key instanceof ECPublicKey) return "ES256";
    if (key instanceof EdECPublicKey) return "EDDSA";
    return null;
}

try {
    String alg = clientMetadata.getAlgorithm(key);
} catch (OidcClientRegistrationException e) {
    LOG.errorf("Unsupported signing key: %s", e.getMessage());
}

When it happens

Trigger: Calling jwks() on a ClientMetadata builder whose public key is not an RSAPublicKey, ECPublicKey, or EdECPublicKey instance — e.g. a DHPublicKey or a provider-specific PublicKey implementation.

Common situations: Using X25519/DH keys meant for encryption (not signing), keys loaded through a JCE provider producing non-standard key classes, or wiring the wrong key (private-context key) into client registration metadata.

Related errors

• <wraps JoseException>
• DPoP proof jwk header does not represent a valid JWK key
• DPoP proof JWK key is a private key but it must be a public
• Failed to generate key id
• Application 'web-app' type is only supported if access token

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/30ffcec7259774b8. Report an issue: GitHub.