8000 fix: mapping mtls enabled to a runtime option by shawkins · Pull Request #47751 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

fix: mapping mtls enabled to a runtime option #47751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vmuzikar merged 1 commit into from
Apr 7, 2026
Merged

fix: mapping mtls enabled to a runtime option #47751

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion ...ispan/src/main/java/org/keycloak/compatibility/AbstractCompatibilityMetadataProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,15 @@ public Map<String, String> metadata() {
configKeys().forEach(key -> {
String value = config.get(key);
if (value != null)
metadata.put(key, value);
metadata.put(remapConfigKey(key), value);
});
return metadata;
}

protected String remapConfigKey(String key) {
return key;
}

@Override
public String getId() {
return spi;
Expand Down
61 changes: 5 additions & 56 deletions ...main/java/org/keycloak/jgroups/certificates/DefaultJGroupsCertificateProviderFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@

import java.io.File;
import java.time.Duration;
import java.util.List;
import java.util.Set;

import org.keycloak.Config;
Expand All @@ -28,8 +27,6 @@
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.provider.Provider;
import org.keycloak.provider.ProviderConfigProperty;
import org.keycloak.provider.ProviderConfigurationBuilder;
import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
import org.keycloak.spi.infinispan.JGroupsCertificateProviderFactory;
import org.keycloak.storage.configuration.ServerConfigStorageProvider;
Expand All @@ -46,8 +43,11 @@ public class DefaultJGroupsCertificateProviderFactory implements JGroupsCertific

public static final String PROVIDER_ID = "default";

// config
// for metadata compatibility
public static final String ENABLED = "enabled";

// config
public static final String ACTIVATED = "activated";
Comment thread
vmuzikar marked this conversation as resolved.
Resolved
private static final String ROTATION = "rotation";
private static final String KEYSTORE_PATH = "keystoreFile";
private static final String KEYSTORE_PASSWORD = "keystorePassword";
Expand Down Expand Up @@ -94,20 +94,8 @@ public Set<Class<? extends Provider>> dependsOn() {
return Set.of(ServerConfigStorageProvider.class);
}

@Override
public List<ProviderConfigProperty> getConfigMetadata() {
var builder = ProviderConfigurationBuilder.create();
addEnabledOption(builder);
addRotationOption(builder);
addPropertyForFile(builder, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE, KEYSTORE_PATH);
addPropertyForFile(builder, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE, TRUSTSTORE_PATH);
addPropertyForPassword(builder, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD, KEYSTORE_PASSWORD);
addPropertyForPassword(builder, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD, TRUSTSTORE_PASSWORD);
return builder.build();
}

private JGroupsCertificateProvider createProvider(KeycloakSessionFactory factory) {
if (!configuration.getBoolean(ENABLED, Boolean.FALSE)) {
if (!configuration.getBoolean(ACTIVATED, Boolean.FALSE)) {
return JGroupsCertificateProvider.DISABLED;
}
if (isKeystoreOrTruststoreConfigured()) {
Expand Down Expand Up @@ -149,43 +137,4 @@ private String requireConfiguration(String key, Option<?> option) {
return value;
}

private static void addEnabledOption(ProviderConfigurationBuilder builder) {
propertyForOption(builder, CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED)
.name(ENABLED)
.type(ProviderConfigProperty.BOOLEAN_TYPE)
.label("enabled")
.add();
}

private static void addRotationOption(ProviderConfigurationBuilder builder) {
propertyForOption(builder, CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION)
.name(ROTATION)
.type(ProviderConfigProperty.INTEGER_TYPE)
.label("days")
.add();
}

private static void addPropertyForFile(ProviderConfigurationBuilder builder, Option<?> option, String name) {
propertyForOption(builder, option)
.name(name)
.type(ProviderConfigProperty.STRING_TYPE)
.label("file")
.add();
}

private static void addPropertyForPassword(ProviderConfigurationBuilder builder, Option<?> option, String name) {
propertyForOption(builder, option)
.name(name)
.type(ProviderConfigProperty.PASSWORD)
.label("password")
.secret(true)
.add();
}

private static ProviderConfigurationBuilder.ProviderConfigPropertyBuilder propertyForOption(ProviderConfigurationBuilder builder, Option<?> option) {
var property = builder.property();
option.getDefaultValue().ifPresent(property::defaultValue);
property.helpText(option.getDescription());
return property;
}
}
10 changes: 9 additions & 1 deletion .../src/main/java/org/keycloak/jgroups/certificates/JGroupsCertificatesMetadataProvider.java
10BC8
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,14 @@ protected boolean isEnabled(Config.Scope scope) {

@Override
public Stream<String> configKeys() {
return Stream.of(DefaultJGroupsCertificateProviderFactory.ENABLED);
return Stream.of(DefaultJGroupsCertificateProviderFactory.ACTIVATED);
}

@Override
protected String remapConfigKey(String key) {
if (DefaultJGroupsCertificateProviderFactory.ACTIVATED.equals(key)) {
return DefaultJGroupsCertificateProviderFactory.ENABLED;
}
return key;
}
}
2 changes: 1 addition & 1 deletion .../main/java/org/keycloak/quarkus/runtime/configuration/mappers/CachingPropertyMappers.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ public List<PropertyMapper<?>> getPropertyMappers() {
.to("kc.spi-cache-embedded--default--config-mutate")
.build(),
fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED)
.to("kc.spi-jgroups-mtls--default--enabled")
.to("kc.spi-jgroups-mtls--default--activated")
.isEnabled(CachingPropertyMappers::getDefaultMtlsEnabled, "a TCP based cache-stack is used")
.build(),
fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE.withRuntimeSpecificDefault(getConfPathValue("cache-mtls-keystore.p12")))
Expand Down
3 changes: 3 additions & 0 deletions ...time/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,6 +590,9 @@ public PropertyMapper<T> build() {
if (wildcardKeysTransformer != null || wildcardMapFrom != null) {
throw new AssertionError("Wildcard operations not expected with non-wildcard mapper");
}
if (!option.isBuildTime() && to != null && PropertyMappers.isSpiBuildTimeProperty(to, true)) {
throw new AssertionError("A runtime option should not map to a build time spi option");
}
return new PropertyMapper<>(option, to, enabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, isMasked, validator, description, isRequired, requiredWhen, null, null);
}
}
Expand Down
8 changes: 7 additions & 1 deletion ...ime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappers.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,13 @@ public static ConfigValue getValue(ConfigSourceInterceptorContext context, Strin

public static boolean isSpiBuildTimeProperty(String name) {
// we can't require the new property formant until we're ok with a breaking change
//return name.startsWith(KC_SPI_PREFIX) && (name.endsWith("--provider") || name.endsWith("--enabled") || name.endsWith("--provider-default"));
return isSpiBuildTimeProperty(name, false);
}

public static boolean isSpiBuildTimeProperty(String name, boolean strict) {
if (strict) {
return name.startsWith(KC_SPI_PREFIX) && (name.endsWith("--provider") || name.endsWith("--enabled") || name.endsWith("--provider-default"));
}
return name.startsWith(KC_SPI_PREFIX) && (name.endsWith("-provider") || name.endsWith("-enabled") || name.endsWith("-provider-default"));
}

Expand Down
7 changes: 7 additions & 0 deletions ...s/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ConfigurationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1080,4 +1080,11 @@ public void testRawEnvVarPreservesTrailingBackslash() {
SmallRyeConfig config = createConfig();
assertEquals("trail\\", config.getConfigValue("kc.db-password").getValue());
}

@Test
public void testMtlsEnabledMapsToRuntimeProperty() {
var config = createConfigFromCliArguments("--cache-embedded-mtls-enabled=false");
assertEquals("false", config.getConfigValue("kc.spi-jgroups-mtls--default--activated").getValue());
assertNull(config.getConfigValue("kc.spi-jgroups-mtls--default--enabled").getValue());
}
}
Loading