What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A newly provisioned Keycloak client does not automatically get a PKCE S256 requirement just because a global client profile exists. Check the saved client’s PKCE method and, if you expect Client Policies to enforce it, verify that an enabled policy actually applies to that client. Keycloak’s 26.7.0 guide describes PKCE as a client-level setting; a blank method does not itself require PKCE.
Why a provisioned client has no PKCE S256 setting
Keycloak exposes the PKCE code challenge method as a client setting. In the Keycloak Server Administration Guide 26.7.0, the setting can be blank or explicitly set to S256 or plain. A blank value means PKCE is not required by that setting, though a client can still send PKCE parameters in an authorization request.
That is different from inheriting a default. The existence of a global client profile does not by itself assign S256 to each newly created client. Keycloak’s Client Policies documentation says global profiles are available in each realm, but no client policies are configured by default.
How Client Policies can enforce PKCE
Keycloak provides a PKCE enforcement executor through Client Policies. A policy uses a profile and conditions; it applies to clients that satisfy the configured conditions. For a policy to affect a provisioned client, it must be configured and enabled, reference a profile containing the PKCE enforcement executor, and match the client and relevant operation.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Therefore, a profile or executor visible in the realm is not enough to establish enforcement. Check the policy itself, its enabled state, its profile, and its conditions. If any condition does not match the provisioning event, the policy may not act on that client.
Diagnose the provisioning path in order
- Confirm the context. Record the Keycloak version, confirm the client is OIDC, and identify how it is created or changed: Admin Console, Admin REST API, dynamic client registration, or another provisioning tool.
- Inspect the persisted client. After provisioning, read the saved client configuration and check its PKCE code challenge method. Do not infer the effective value from a profile name or a provisioning template.
- Check policy configuration. In the realm’s Client Policies, verify that an enabled policy references a profile with the PKCE enforcement executor and that the policy’s conditions match this client and operation.
- Compare the event route with the version. If the policy appears correct but the setting remains unset, investigate whether the relevant policy conditions and executor are supported on that version and provisioning route.
- Make the requirement explicit when needed. If the provisioning path cannot reliably apply the policy, configure the provisioner to write the client’s S256 method directly, then read the persisted client again to verify it.
Choose the enforcement point that fits your setup
| Approach | Scope | Where enforcement occurs | What to verify |
|---|---|---|---|
| Write S256 during provisioning | The client being created or updated | The provisioner writes the client setting | The saved client configuration contains S256 after provisioning |
| Use a Client Policy | Clients matching the policy’s conditions in the realm | The policy and its PKCE enforcement executor act on a matching client operation | The policy is enabled, its profile includes the executor, and its conditions match the provisioning route and client |
The direct write makes the requirement explicit in the client configuration. A policy can cover matching clients centrally, but its effect depends on configuration, conditions, and support for the operation and version in use.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What the historical Admin API report does—and does not—show
Keycloak issue #12295, opened in 2022, reported that on Keycloak 18.0.0 a pkce-enforcer executor combined with a client-access-type condition did not behave as expected when a client was created or updated through the Admin API. The issue links to closure through #12347 and lists milestone 19.0.0. This is historical, version-specific context; it does not establish a defect in current releases or explain a different provisioning route.
Realm-level defaults are not established by the proposal
Keycloak issue #26432, opened on 2024-01-23, proposes default client policies for PKCE enforcement. It notes potential OIDC/FAPI interoperability concerns if PKCE is enforced for clients that may not use it. The issue page does not establish that such a feature is implemented or available in a particular release. Treat a realm-wide default as a configured behavior to verify, not an assumption.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
