There appears to be an unrelated CRDTest expectation change - which doesn't seem to occur for me locally. If needed that can be separated to a different pr.

EDIT: moved the other commit to its own pr.

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.passwordless.PasskeysKcOidcFirstBrokerLoginTest#testLinkAccountByReauthenticationWithDiscoverablePasskey

Keycloak CI - WebAuthn IT

java.lang.AssertionError: Expected LogoutConfirmPage but was localhost (https://localhost:8543/auth/realms/consumer/protocol/openid-connect/logout)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.keycloak.testsuite.pages.AbstractPage.assertCurrent(AbstractPage.java:39)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

We would probably need some docs to officially consider it supported.

That seemed optional as there appear to be quite a few non-internal spis not covered by https://www.keycloak.org/docs/latest/server_development/index.html

Or is there another place where this should be documented?

That seemed optional as there appear to be quite a few non-internal spis not covered by https://www.keycloak.org/docs/latest/server_development/index.html

AFAIU, those not mentioned in the docs are not officially supported.

Or is there another place where this should be documented?

No, this would be it.

I think we have some grey area though. We have public SPIs, yet we don't document them, and hence don't support them. I do not know then why we even mark SPIs as public.

Adding a new supported SPI is a bigger step and would require broader team involvement, IMHO. We could potentially just mark the cert lookup SPI as public and not mention it in the release notes not to give any implication it's supported. Not sure if that makes much difference though from a private SPI.

CC @stianst