Repository navigation
Allow well-known providers to set the response media type - #54895
Open
QuellcodeWanderer wants to merge 1 commit into
Open
QuellcodeWanderer wants to merge 1 commit into
QuellcodeWanderer wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the change enabling provider-defined well-known response media types.
No open issues 🎉
What changed in this PR
Allows Keycloak well-known providers to specify their response media type, addressing #54893 without provider-specific logic in the resource layer.
Changes:
- Adds a default
getMediaType()method, preserving existing JWT/JSON defaults when it returnsnull. - Uses the provider’s media type and removes restrictive
@Producesannotations from both endpoints. - Adds integration tests for custom media types on both endpoints and the existing JSON default.
| File | Description |
|---|---|
tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.wellknown.WellKnownProviderFactory |
Registers the test provider factory. |
tests/custom-providers/src/main/java/org/keycloak/tests/providers/wellknown/TestMediaTypeWellKnownProviderFactory.java |
Makes the test provider available through both endpoints. |
tests/custom-providers/src/main/java/org/keycloak/tests/providers/wellknown/TestMediaTypeWellKnownProvider.java |
Supplies a JWT document with a custom media type. |
tests/base/src/test/java/org/keycloak/tests/wellknown/WellKnownMediaTypeTest.java |
Tests custom media types, Accept headers, and the JSON default. |
services/src/main/java/org/keycloak/wellknown/WellKnownProvider.java |
Adds and documents the optional media-type override. |
services/src/main/java/org/keycloak/services/resources/ServerMetadataResource.java |
Removes the fixed list of accepted response media types. |
services/src/main/java/org/keycloak/services/resources/RealmsResource.java |
Applies provider media types with existing fallbacks and removes restrictive negotiation. |
Review effort: Balanced
Closes keycloak#54893 Signed-off-by: Maximilian Brodda <QuellcodeWanderer@users.noreply.github.com>
QuellcodeWanderer
force-pushed
the
wellknown-provider-media-type
branch
from
November 9, 2026 09:03
d177241 to
a425cb9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I added a default method getMediaType() to WellKnownProvider instead of special-casing provider classes in RealmsResource, as the closed OpenID Federation PR #41419 did. Returning null keeps the current behaviour (application/jwt for a String config, application/json otherwise), so existing providers are not affected. The method is called after getConfig(), so a provider can choose the media type based on the request, like the OID4VCI provider does today by setting the header itself.
I removed @produces from the GET methods of RealmsResource and ServerMetadataResource, because it limited content negotiation to application/json and application/jwt and caused the 406 before the provider was called. Every response sets its media type explicitly, so @produces did not influence the returned type. The consequence is that a request with an unrelated Accept type now gets the provider's document instead of a 406. I think that is acceptable for metadata endpoints, but I can add an explicit Accept check against the provider's media type if you prefer to keep the 406.
The new WellKnownMediaTypeTest uses a test provider with application/entity-statement+jwt and covers both endpoints with Accept: / and with the provider's media type, plus a check that openid-configuration still returns application/json. Without the change, four of the five tests fail with the two symptoms from the issue (application/jwt instead of the provider's type, and 406). The existing well-known tests in tests/base, including the OID4VCI ones, still pass.
Closes #54893