Summary
Keycloak-config-cli CI workflow is failing for keycloak server and client versions (26.0.5, 26.0.2) and (26.1.0, 26.0.4)
The builds are successful locally with matching versions which indicates a CI workflow specific issue.
Current Behaviour
- CI workflow fails with HTTP 403 Forbidden errors during realm operations
- Also fails for build-pom-version jobs with Java 17 and 21
- Tests pass locally with the same Keycloak versions
- Tests pass in CI with Keycloak versions < 26.0.0
Expected Behaviour
In the CI workflow keycloak-config-cli should successfully use realm operations without authentication errors
Error Details
target/classes/de/adorsys/keycloak/config/service/RealmImportService.java#L159
de.adorsys.keycloak.config.service.RealmImportService#updateRealmIfNecessary: Cannot update realm 'simple': HTTP 403 Forbidden{"error":"HTTP 403 Forbidden"}
Possible issue
There has been notable changes to JWT client authentication mentioned in Keycloak's release notes 26.0.
Keycloak versions 26.x now enforces a maximum expiration of 60 seconds for JWT tokens used in client authentication. The CI workflow may have timing delays that causes the token to be rejected.
Summary
Keycloak-config-cli CI workflow is failing for keycloak server and client versions (26.0.5, 26.0.2) and (26.1.0, 26.0.4)
The builds are successful locally with matching versions which indicates a CI workflow specific issue.
Current Behaviour
Expected Behaviour
In the CI workflow keycloak-config-cli should successfully use realm operations without authentication errors
Error Details
target/classes/de/adorsys/keycloak/config/service/RealmImportService.java#L159
de.adorsys.keycloak.config.service.RealmImportService#updateRealmIfNecessary: Cannot update realm 'simple': HTTP 403 Forbidden{"error":"HTTP 403 Forbidden"}
Possible issue
There has been notable changes to JWT client authentication mentioned in Keycloak's release notes 26.0.
Keycloak versions 26.x now enforces a maximum expiration of 60 seconds for JWT tokens used in client authentication. The CI workflow may have timing delays that causes the token to be rejected.