[BUG] Impossible de créer le fournisseur d'identités : The 'Validating public key' is required when 'Validate signatures' enabled and 'Use JWKS URL' disabled

[remigauthierdocaposte]

Describe the bug
Unable to create a new identity provider using France Connect integration in Keycloak V26.5.4.

To Reproduce
Steps to reproduce the behavior:

1. Deploy latest module (7.6)
2. Try to create a new Identity provider with France Connect integration
3. Error : The 'Validating public key' is required when 'Validate signatures' enabled and 'Use JWKS URL' disabled

Expected behavior
Be able to create a new identity provider.

Screenshots

Additional context

• Keycloak Version : 26.5.4
• Browser : any

[clement-dufaure]

ok, validation was enforced in this commit : keycloak/keycloak@3876881

we should explicit in provider creation that setUseJwksUrl(true)

[remigauthierdocaposte]

As a quick fix, waiting for a clean and complete fix, changing the default value of DEFAULT_AC_ENVIRONMENT for INTEGRATION_V2 in the code does the trick.
The loading of the configuration is not broken anymore doing this and it is possible to select back INTEGRATION_V1 without any problem.

[clement-dufaure]

i'm working on it, the problem comes from the declaration of the environment is no longer read at the creation of the identity provider, so when V2 is selected, the default (V1 in the current release) is computed and V1 is not compliant with the new "validate" method of the idp (no jwks uri and validate token)

So, I dont known if the choice of environment is accepted when modified, probably it stales on the defaut environement hardcoded.

By the way, in a future release, we should remove the V1 configuration.

[remigauthierdocaposte]

We are still testing, but all seem ok doing it this way for now. We need to test if it is still functionnal with V1 production... Hoping you will be able to fix it before that...

[clement-dufaure]

V1 was planned to be stopped on late 2025, are you still using it ? i ask because i really plan to remove it, and i think the solution is more difficult to solve whith this V1 configuration whitch is not valid by design with the new validation rules because the validation of signature work without public key (symetric crypto in V1)

[remigauthierdocaposte]

I just checked with the team, everyone has been transferred to V2 even in production so removing V1 is fine for us :)

[clement-dufaure]

Ok, i finally found why just changing the default FC environment is helpful.
This method is called at creation https://github.com/keycloak/keycloak/blob/main/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java#L928
and the validation fails because of the instanciation https://github.com/keycloak/keycloak/blob/main/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java#L928 use the createconfig whithout model, so the "initialize" method is called without config and so lauch the default configuration.
It works at runtime because at each call a new instance is created by https://github.com/InseeFr/Keycloak-FranceConnect/blob/master/src/main/java/fr/insee/keycloak/providers/franceconnect/FranceConnectIdentityProviderFactory.java#L56 whitch call the correct initialize.

So :

• First, i will release a new version with the FC v2 standard integration by default, witch is not a clean resolution but really coorect the issue
• We should review how the urls are setup by probably override getters instead of using "initialize" in constructor.
• By the way we should remove support of FC v1.

[clement-dufaure]

#155

[clement-dufaure]

https://github.com/InseeFr/Keycloak-FranceConnect/releases/tag/7.6.1