@vmuzikar are you ok with this being a breaking change from the perspective of users who are relying on auto-builds with -provider, -provider-default, -enabled? If so I can add a note for that.

And / or do you want a warning for now for the possibly ambiguous cases?

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#checkAuthenticatorTimeLocale

Keycloak CI - WebAuthn IT (chrome)

java.text.ParseException: Unparseable date: "May 28, 2025, 11:26 AM"
	at java.base/java.text.DateFormat.parse(DateFormat.java:399)
	at org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest.checkAuthenticatorTimeLocale(WebAuthnSigningInTest.java:320)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
...

Report flaky test

Updated with a warning when changed the docs to use the new format.

There's still a reference to spi-authentication-sessions-map-auth-sessions-limit (now spi-authentication-sessions--map--auth-sessions-limit) that should be removed correct?

Also updated to internally map to the new spi form - this also highlighted that the PropertyMapper logic needs to maintain an additional mapping to the legacy form.

@shawkins Nice work! Using -- separator makes these SPI separations more visible and I like it more than before.

Just added some small comments that might improve things a little bit more IMO.

Thank you for the review. Applied the suggestions.

@mabartos had to correct the generated options output as well, along with a few more places where -- was missing or being rendered incorrectly.

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithFailover

Keycloak CI - Store IT (postgres)

java.lang.RuntimeException: java.lang.IllegalStateException: Keycloak unexpectedly died :(
	at org.keycloak.testsuite.arquillian.containers.KeycloakQuarkusServerDeployableContainer.start(KeycloakQuarkusServerDeployableContainer.java:71)
	at org.jboss.arquillian.container.impl.ContainerImpl.start(ContainerImpl.java:185)
	at org.jboss.arquillian.container.impl.client.container.ContainerLifecycleController$8.perform(ContainerLifecycleController.java:137)
	at org.jboss.arquillian.container.impl.client.container.ContainerLifecycleController$8.perform(ContainerLifecycleController.java:133)
...

Report flaky test

I plan to give this a quick look later today.

Can you also please rebase?

Overall LGTM but might be good to add some tests for checking the selected SPI options are correctly treated as buildtime.

We already had a test or two along those lines (see StartCommandDistTest.errorSpiBuildtimeAtRuntime for example), and the arquilian logic relies on implicit rebuilds due to provider option changes.

Additionally, I wonder if we should have a test for the env var form, if __ works as expected.

I can certainly add something. The replacement logic in KcEnvConfigSource is now quite straight-forward all _ in a non-wildcard key will become -, so there's nothing special about this case.

We already had a test or two along those lines (see StartCommandDistTest.errorSpiBuildtimeAtRuntime for example), and the arquilian logic relies on implicit rebuilds due to provider option changes.

But we don't cover all the SPI build time options (i.e. --provider, --enabled and --provider-default), do we?

I can certainly add something. The replacement logic in KcEnvConfigSource is now quite straight-forward all _ in a non-wildcard key will become -, so there's nothing special about this case.

Yeah, it'd be good to have something to make sure that e.g. Quarkus doesn't messes that up somewhere.

But we don't cover all the SPI build time options (i.e. --provider, --enabled and --provider-default), do we?

I'll add something after lunch.

Yeah, it'd be good to have something to make sure that e.g. Quarkus doesn't messes that up somewhere.

Quarkus? These entries are only handled by Keycloak logic.

Quarkus? These entries are only handled by Keycloak logic.

Yeah, but I meant some too smart interceptors maybe. Still I'd feel safer with some tests. :)

Yeah, but I meant some too smart interceptors maybe. Still I'd feel safer with some tests. :)

See if the the additional changes are sufficient.

@mabartos @vmuzikar the rebase was trivial, just wanted to check if either of you want to review again.