A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inert
Keycloak 26.7.1, in a realm where every hand-authored client carries "pkce.code.challenge.method": "S256" and refuses plain . Enable the OAuth Client ID Metadata Document feature, point an authorization request at a published metadata document as its client_id , and Keycloak fetches that document and provisions a client from it. The client it provisioned accepted plain . It also accepted a…
Keycloak 26.7.1 provisions a client without PKCE pin when using the OAuth Client ID Metadata Document feature. This occurs because the client policy gating the feature correctly gates the provisioned client. The pin is a client attribute and is missing from the provisioned client, causing the absence of PKCE. The provisioned client also inherits no basic scope, sub claim, audience mapper, or realm capability scopes since it does not declare any.
Keycloak documents this behavior in its Model Context Protocol guide, warning about the mechanism. Adding a second condition to the policy does not resolve the issue as the condition abstains as there is no resolved client to check the access type. The PKCEEnforcerExecutor, responsible for enforcing PKCE, only acts on REGISTER and UPDATE events, abstaining on PKCEEnforcerExecutor. Thus, the feature remains inert, with no visible error or log entry.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
