provider types beyond event listeners: the SPI relocation, and which SPIs are "internal"
- Database
- PostgreSQL 16, fresh empty DB
- Host
- Hetzner CCX33 (fsn1) — 8 vCPU, 30 GB RAM
- Condition
- Custom SPI vs old internals — untested row: *provider types other than event listeners — authenticators, user storage, mappers*
Why this run existed
S7 (2026-08-25-s7-custom-spi) established that an event listener built
for 21.1.2 loads and registers on 26.7.1, and that a brittle one fails lazily —
at first use, silently. It left unchecked whether other provider types
(authenticators, user storage, mappers) behave the same way. This run adds an
authenticator and a user-storage provider, and the attempt to write them
surfaced a finding S7 never could have: the user-storage SPI is not in
keycloak-server-spi at all, and its Maven artifact changed between majors.
Environment
| Field | Value |
|---|---|
| Keycloak | built against 25.0.6, loaded on 26.7.1 (crosses the 26.0.0 API-removal boundary) |
| Fixture | fixtures/spi-types/ — lab-authenticator (Authenticator + Factory), lab-user-storage (UserStorageProvider + Factory), stable SPI only |
| Build | bin/build-spi.sh 25.0.6 --module spi-types (Maven in Docker) |
| Database | PostgreSQL 16, fresh empty DB |
| Host | Hetzner CCX33 (fsn1) — 8 vCPU, 30 GB RAM |
| JVM heap | -Xms1g -Xmx4g |
Verification
| Claim | Primary source | Checked |
|---|---|---|
UserStorageProvider absent from keycloak-server-spi 25.0.6 | jar contents listed; compile failure | ☑ |
It lives in keycloak-model-legacy (23) then keycloak-model-storage (24+) | Keycloak git tree at 23.0.7 / 24.0.5 / 25.0.6 | ☑ |
keycloak-model-legacy gone by 25.0.6 | Maven Central 404 at 25.0.6, 200 at 23/24 | ☑ |
spi-api-diff.sh misses it (does not diff model artifacts) | script source diffs only core/server-spi/server-spi-private | ☑ |
| Tame authenticator loads + registers on 26.7.1 | factory init line; lab-authenticator in serverinfo | ☑ |
| Tame user-storage loads + registers on 26.7.1 | factory init line; lab-user-storage in serverinfo | ☑ |
authenticator SPI is internal, user-storage is not | KC-SERVICES0047 fired for authenticator only | ☑ |
| Protocol mappers (third S7 type) | done — 2026-08-26-provider-types-protocol-mapper-brittle: registers, SPI is internal | ☑ |
| Brittle (removed-API) versions of these types, and when they fail | authenticator + user-storage done — both lazy + loud (HTTP 500), 2026-08-26-provider-types-protocol-mapper-brittle. Protocol-mapper brittle variant still open | ◐ |
| The exact 24.x release that split model/storage from model/legacy | narrowed — 24.0.0; keycloak-model-legacy dropped at 25.0.0 with a 25.0.3 anomaly. See 2026-08-26-userstorage-artifact-split-narrowed | ☑ |