Keycloak: missing public key

Question

when I access the keycloak admin console (! remotely) and create a client:

keycloak OIDC JSON does not have a public key

I would expect something like in JSON:

"realm-public-key": "MIIBIjANBg.... 

Answer 1

keycloak.json in the newest keycloak does not have any realm public key ... actually it seems that you are using keycloak version 2.3.x, there have been some changes in it. Basically, you can rotate multiple public keys for an area. The document says the following: -

In release 2.3.0, we added support for public key rotation. When the administrator rotates the area keys in the Keycloak admin console, the client adapter will be able to recognize it and automatically download the new public key from Keycloak. However, this automatic download of new keys is done simply if you do not have the realm-public-key option in your adapter with a hard-coded public key. For this reason, we do not recommend using realm-public-key in the adapter configuration. Note that this option is still supported, but it can only be useful if you really want to have a public key hardkey in your adapter’s configuration and never download the public key from Keycloak. Theoretically, one of the reasons this could be to avoid a man-in-the-middle attack if you do not trust the network between the adapter and Keycloak, however, in this case, the best option is to use HTTPS, which will ensure all requests between the adapter and Keycloak.

Answer 2

I still don’t know why there is no public key in keycloak OIDC JSON (probably for security reasons), but I found it under:

Area Settings> Keys> View Public Key