Realm import skips protocol mappers for static client scopes containing `:`

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

oidc

Describe the bug

When importing a realm JSON that defines a client scope with : in the name, protocol mappers under that client scope can be silently missing or not applied after import.

This looks related to the dynamic-scope issues fixed in #42142 and #42877. Those fixes appear to cover authorization/token request evaluation, but this report is specifically about realm import behavior.

In my case, I defined a client scope named mcp:tools with an oidc-audience-mapper under it. The realm imported without a clear error, and the scope itself existed, but the audience mapper was not applied, so access tokens requested with that scope did not include the expected aud claim.

Renaming the scope from mcp:tools to mcp.tools made the same mapper import and apply correctly.

Note: mcp:tools is intended to be a static OAuth scope name, not a dynamic/parameterized scope.

Version

26.6.1

Regression

• The issue is a regression

Expected behavior

Static client scopes containing : should be imported and evaluated as normal static scopes when the dynamic-scopes feature is not enabled/configured.

A client scope named mcp:tools should import all protocol mappers defined under it, the same as a scope named mcp.tools. After import, a token requested with scope=mcp:tools should include claims produced by the imported mapper.

Actual behavior

The realm import completes, and the client scope exists, but the protocol mapper under the mcp:tools scope is missing or not applied.

As a result, the issued access token does not include the expected audience claim.

How to Reproduce?

1. Create a realm import JSON with a client scope named mcp:tools.
2. Add that scope to a client as an optional client scope: "optionalClientScopes": ["mcp:tools"]
3. Add am audience mapper under the mcp:tools client scope:

{
  "name": "mcp-audience",
  "protocol": "openid-connect",
  "protocolMapper": "oidc-audience-mapper",
  "config": {
    "included.custom.audience": "rocketlawyer.com/mcp",
    "access.token.claim": "true",
    "id.token.claim": "false",
    "introspection.token.claim": "true"
  }
}

4. Start keycloak with -import-realm
5. Request access token with scope=openid mcp:tools email

Anything else?

Related: #42142 #42877 #42930 #42966