My task is to set up keycloak as an authentication endpoint for an external app in Salesforce (SF is being managed by another company). Salesforce is responsible for generating a signed JWT (with a given certificate), which it then sends to keycloak to obtain a valid access token.
To implement this, I received a certificate and a JKS with a PrivateKeyEntry. The current issue is the “kid” parameter in the header of the generated token, which specifies the correct key id . This key id however cannot be found by Keycloak.
Error Message:
[org.keycloak.keys.infinispan.InfinispanPublicKeyStorageProvider] (executor-thread-93) PublicKey wasn't found in the storage. Requested kid: 'KEY_ID' . Available kids: '[9ABAWiSDn7yWJ1XwsXse7yUeEYx0abMVBXlq-0SvKAs]'

This is how I set up the client:

• In the “Credentials” tab the client authenticator is set to “Signed JWT”
• The Signature algorith is set to “RS256” which is correct

Than I went into the “Keys” Tab, clicked on “Import” and imported the JKS file which was successfull.

I suspect that in “Realm Settings” -> “Keys” -> “Keys list” there should be a key with the missing “kid”? I tried adding a provider using the JKS, which resulted in this error: Error saving provider: Failed to load keys. Invalid certificate chain. Check the order of certificates.

What am I missing here?