quarkusio/quarkus · error · OidcClientRegistrationException

<wraps JoseException>

Error message

<wraps JoseException>

What it means

When building client metadata for registration, ClientMetadata converts the application's public key to a JWK via jose4j's PublicJsonWebKey.Factory.newPublicJwk(key). If jose4j cannot represent the key as a JWK it throws JoseException, which is wrapped in an OidcClientRegistrationException with the cause attached. This means the key material supplied for the client's signing/encryption configuration is not a supported public key format.

Source

Thrown at extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/ClientMetadata.java:191

            JsonObjectBuilder jwksBuilder = jsonProvider().createObjectBuilder();
            jwksBuilder.add("keys", keysBuilder);
            builder.add(OidcConstants.CLIENT_METADATA_JWKS, jwksBuilder);
            return this;
        }

        public Builder extraProps(Map<String, String> extraProps) {
            if (built) {
                throw new IllegalStateException();
            }
            builder.addAll(jsonProvider().createObjectBuilder(extraProps));
            return this;
        }

        private static Map<String, Object> convertPublicKeyToJwk(PublicKey key) {
            try {
                return PublicJsonWebKey.Factory.newPublicJwk(key).toParams(OutputControlLevel.PUBLIC_ONLY);
            } catch (JoseException ex) {
                throw new OidcClientRegistrationException(ex);
            }
        }

        private static String getAlgorithm(PublicKey publicKey) {
            if (publicKey instanceof RSAPublicKey) {
                return SignatureAlgorithm.RS256.getAlgorithm();
            } else if (publicKey instanceof ECPublicKey) {
                return SignatureAlgorithm.ES256.getAlgorithm();
            } else if (publicKey instanceof EdECPublicKey) {
                return SignatureAlgorithm.EDDSA.getAlgorithm();
            } else {
                throw new OidcClientRegistrationException("Unrecognized public key algorithm: " + publicKey.getAlgorithm());
            }
        }

        public ClientMetadata build() {
            built = true;
            return new ClientMetadata(builder.build());

View on GitHub (pinned to e1c734241f)

Solutions

1. Check the wrapped cause (ex.getCause()) to identify why jose4j rejected the key
2. Use an RSAPublicKey, ECPublicKey, or EdECPublicKey instead of unsupported key types (e.g. DH keys)
3. Regenerate or re-load the key pair with KeyPairGenerator for RSA/EC/Ed25519 and verify the public key instance type before passing it in

Example fix

// before
PublicKey key = keyFactory.generatePublic(spec); // DH key
metadata.setJwks(...convertPublicKeyToJwk(key)...);
// after
KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
kpg.initialize(2048);
PublicKey key = kpg.generateKeyPair().getPublic(); // RSAPublicKey, supported

if (!(key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey)) {
    throw new IllegalArgumentException("Key type not convertible to JWK: " + key.getAlgorithm());
}

static boolean isJwkConvertible(PublicKey key) {
    return key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof EdECPublicKey;
}

try {
    Map<String, Object> jwk = metadata.toParams();
} catch (OidcClientRegistrationException e) {
    Throwable cause = e.getCause(); // JoseException
    LOG.errorf("JWK conversion failed: %s", cause.getMessage());
}

When it happens

Trigger: Calling ClientMetadata builder code (via jwks()) with a public key of a type jose4j cannot convert, e.g. a DHPublicKey (Diffie-Hellman) or a custom/unknown PublicKey implementation passed into the metadata used for client registration.

Common situations: Passing a key loaded from an unsupported PEM/PKCS blob, using a DH or other exotic key type instead of RSA/EC/EdEC, or a misconfigured key factory producing the wrong key type at startup of OIDC client registration.

Related errors

• Unrecognized public key algorithm: <publicKey.getAlgorithm()
• DPoP proof jwk header does not represent a valid JWK key
• DPoP proof JWK key is a private key but it must be a public
• Failed to generate key id
• Application 'web-app' type is only supported if access token

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/a7582fb7f756be78. Report an issue: GitHub.