The situation:

• existing non-Keycloak IDP (let’s call it ‘old IDP’)
• no access to the private keys used by the old IDP to sign tokens
• but obviously I do have access to the public keys (listed in the openid-configuration)
• new Keycloak installation with a new keypair
• Keycloak uses the exact same issuer as the old idp
• all users from the old IDP are migrated including the same ID

So in theory, the complete authentication flow is backward compatible. However, tokens previously issued by the old IDP won’t validate once the migration is complete.

Would it be possible to import the public key from the old IDP and treat it as a ‘passive key’ in Keycloak (so not used for signing, as that would of course require the private key) but just used to verify signatures.
And as a result Keycloak would also list the old IDP’s public key it in its jwks_uri.

Basically this is the same as rotating the key, with the exception that we don’t have the private key of the previous key.

Does anyone have any experience with this?

I can generate a new keypair in Keycloak and mark it as passive. So I’m thinking it would sufficient to replace the public key of such a new keypair (again without having the private, assuming I don’t need it because it will be a passive key). But maybe there is a better way to do this?