Spring OAuth2 error with Keycloak15+

[ampabsa]

Hello, I'm integrating Hawkbit with Keycloak but I encounter the following issue:

2022-05-18 12:46:43 Caused by: com.nimbusds.oauth2.sdk.ParseException: Unexpected type of JSON object member with key "mtls_endpoint_aliases" (at com.nimbusds.oauth2.sdk.util.JSONObjectUtils.getGeneric(JSONObjectUtils.java:133)) ...

This seems to be a known issue related to Spring Security and/or Nimbus, I believe "recently" fixed. Cf.

• https://github.com/spring-projects/spring-security/issues/6463 (last year edits)
• https://github.com/spring-projects/spring-security/issues/10666
• https://github.com/jhipster/jhipster-control-center/issues/174
• https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/issues/373/exception-thrown-when-calling

The problem seems to happen since Keycloak 15 (tbc). I encounter the problem myself with Keycloak 16.1.1. I'm using the latest Docker image https://hub.docker.com/r/hawkbit/hawkbit-update-server on AWS ECS. For the moment my only custom settings are those related to oauth2 integration set with this environment variable:

SPRING_APPLICATION_JSON: '{ 
"spring.security.oauth2.client.registration.oidc.client-id": "my_kc_client",
"spring.security.oauth2.client.registration.oidc.client-secret": "xxxx",
"spring.security.oauth2.client.registration.oidc.scope": "openid,profile,email",
"spring.security.oauth2.client.provider.oidc.issuer-uri": "https://my.server.com/auth/realms/apcm-realm",
"spring.security.oauth2.client.provider.oidc.authorization-uri": "https://my.server.com/auth/realms/apcm-realm/protocol/openid-connect/auth",
"spring.security.oauth2.client.provider.oidc.token-uri": "https://my.server.com/auth/realms/apcm-realm/protocol/openid-connect/token",
"spring.security.oauth2.client.provider.oidc.user-info-uri": "https://my.server.com/auth/realms/apcm-realm/protocol/openid-connect/userinfo",
"spring.security.oauth2.client.provider.oidc.jwk-set-uri": "https://my.server.com/auth/realms/apcm-realm/protocol/openid-connect/certs"
}'

Are you aware of this issue and/or any workaround?

Many thanks Bruno

[superkartoffel]

I can confirm this issue happens in my setup as well. I don't have a workaround yet.

[ampabsa]

Thanks, good to know that you can reproduce. Please keep me posted about any positive outcome.

[dprokic]

I have the same issue when trying to configure Spring Boot with Keycloak and this helped me to solve it: https://forum.camunda.io/t/camunda-keycloak-configuration-error/29418/8

The dependencyManagement part which Jonathan posted

[ampabsa]

Hi, right I did quite the same and this addresses the problem. I would like though an "official" solution preferably taking care of all side-effects. Upgrading more components around would also be a nice outcome. I used oauth2-oidc-sdk-9.22.2 but I didn't dare to go farther. Is an update planned?