KEYCLOAK-5007 Used single-use cache for tracke OAuth code. OAuth code changed to be encrypted and signed JWT

common/src/main/java/org/keycloak/common/util/KeyUtils.java

@@ -40,8 +40,8 @@ public class KeyUtils {
     private KeyUtils() {
     }
 
-    public static SecretKey loadSecretKey(byte[] secret) {
-        return new SecretKeySpec(secret, "HmacSHA256");
+    public static SecretKey loadSecretKey(byte[] secret, String javaAlgorithmName) {
+        return new SecretKeySpec(secret, javaAlgorithmName);
     }
 
     public static KeyPair generateRsaKeyPair(int keysize) {

common/src/test/java/org/keycloak/common/util/KeyUtilsTest.java

@@ -16,7 +16,7 @@ public class KeyUtilsTest {
         byte[] secretBytes = new byte[32];
         ThreadLocalRandom.current().nextBytes(secretBytes);
         SecretKeySpec expected = new SecretKeySpec(secretBytes, "HmacSHA256");
-        SecretKey actual = KeyUtils.loadSecretKey(secretBytes);
+        SecretKey actual = KeyUtils.loadSecretKey(secretBytes, "HmacSHA256");
         assertEquals(expected.getAlgorithm(), actual.getAlgorithm());
         assertArrayEquals(expected.getEncoded(), actual.getEncoded());
     }