Repository navigation
Validate .conf extension for --config-file option - #47696
Merged
shawkins merged 2 commits intoApr 7, 2026
Merged
Conversation
griffonbyte
requested review from
a team
as code owners
April 1, 2026 15:23
griffonbyte
force-pushed
the
fix/config-file-extension-validation
branch
from
April 1, 2026 15:32
682672c to
b507500
Compare
Contributor
|
@griffonbyte the changes make sense, can you also include a test? |
griffonbyte
force-pushed
the
fix/config-file-extension-validation
branch
from
April 1, 2026 16:38
b507500 to
b9c5225
Compare
Contributor
Author
|
Good call, added a test. It follows the same pattern as the existing testInvalidConfigFileOption test in StartCommandDistTest -- uses a keycloak.properties file to verify the extension check triggers the expected error message. |
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabledKeycloak CI - Java Distribution IT (windows-latest - temurin - 17) |
shawkins
force-pushed
the
fix/config-file-extension-validation
branch
from
April 3, 2026 19:26
428d936 to
deb6ab4
Compare
The --config-file option and KC_CONFIG_FILE environment variable silently ignored configuration files that did not use the .conf extension. This happened because the underlying SmallRye config source loader filters by file extension, returning an empty list for non-.conf files without any indication to the user. Added explicit validation in both the CLI option setter and the config source file resolution to reject files that do not end with .conf, giving the user a clear error message instead of silently ignoring their configuration. Closes keycloak#46978 Signed-off-by: Tanner Smith <griffonbyte@proton.me>
Move the .conf extension check before the file existence check in setConfigFile(). When a file with a wrong extension does not exist relative to the working directory, the existence check would fire first, masking the more specific extension validation error. Closes keycloak#47696 Signed-off-by: Tanner Smith <griffonbyte@proton.me>
shawkins
force-pushed
the
fix/config-file-extension-validation
branch
from
April 7, 2026 14:59
deb6ab4 to
68252be
Compare
shawkins
approved these changes
Apr 7, 2026
Contributor
There was a problem hiding this comment.
LGTM, thanks @griffonbyte
shawkins
enabled auto-merge (squash)
April 7, 2026 15:00
Closed
sashyo
pushed a commit
to tide-foundation/keycloak-IGA
that referenced
this pull request
Jul 20, 2026
* Validate .conf extension for --config-file option The --config-file option and KC_CONFIG_FILE environment variable silently ignored configuration files that did not use the .conf extension. This happened because the underlying SmallRye config source loader filters by file extension, returning an empty list for non-.conf files without any indication to the user. Added explicit validation in both the CLI option setter and the config source file resolution to reject files that do not end with .conf, giving the user a clear error message instead of silently ignoring their configuration. Closes keycloak#46978 Signed-off-by: Tanner Smith <griffonbyte@proton.me> * fix: validate config file extension before checking existence Move the .conf extension check before the file existence check in setConfigFile(). When a file with a wrong extension does not exist relative to the working directory, the existence check would fire first, masking the more specific extension validation error. Closes keycloak#47696 Signed-off-by: Tanner Smith <griffonbyte@proton.me> --------- Signed-off-by: Tanner Smith <griffonbyte@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds explicit validation to reject configuration files that do not end with the
.confextension.Previously, using
--config-fileorKC_CONFIG_FILEwith a non-.conffile would silently ignore the file contents because the underlying SmallRye config source loader filters by extension and returns an empty list for unrecognized extensions. There was no indication to the user that their configuration was not being applied.The validation is added in two places:
Main.setConfigFile(), which catches the case at parse timeKeycloakPropertiesConfigSource.InFileSystem.getConfigurationFile(), which catches the case when the path is set via theKC_CONFIG_FILEenvironment variableCloses #46978