External-Mirrors/keycloak
2
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-09 23:12:06 -03:30
Code Issues Packages Projects Releases Wiki Activity

Certificate reloading does not work for the management interface (#37052)

Browse Source 
Fixes #37039

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
This commit is contained in:
Martin Bartoš 2025-02-05 13:39:21 +00:00 committed by GitHub
parent 602df06191
commit 98f74026c6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
19 changed files with 169 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/documentation/release_notes/topics/26_2_0.adoc
View File

@ -9,6 +9,13 @@ A `direction` query parameter was also added, allowing controlling the order of
Finally, the returned event representations now also include the `id`, which provides a unique identifier for
an event.
= Option to reload trust and key material for the management interface
The `https-management-certificates-reload-period` option can be set to define the reloading period of key store, trust store, and certificate files referenced by `https-management-*` options for the management interface.
Use -1 to disable reloading. Defaults to `https-certificates-reload-period`, which defaults to 1h (one hour).
For more information, check the link:https://www.keycloak.org/server/management-interface#_tls_support[Configuring the Management Interface] guide.
= New cache for CRLs loaded for the X.509 authenticator
Now the Certificate Revocation Lists (CRL), that are used to validate certificates in the X.509 authenticator, are cached inside a new infinispan cache called `crl`. Caching improves the validation performance and decreases the memory consumption because just one CRL is maintained per source.

9
quarkus/config-api/src/main/java/org/keycloak/config/ManagementOptions.java
View File

@ -84,6 +84,15 @@ public class ManagementOptions {
.hidden()
.build();
public static final Option<String> HTTPS_MANAGEMENT_CERTIFICATES_RELOAD_PERIOD = new OptionBuilder<>("https-management-certificates-reload-period", String.class)
.category(OptionCategory.MANAGEMENT)
.description("Interval on which to reload key store, trust store, and certificate files referenced by https-management-* options for the management server. " +
"May be a java.time.Duration value, an integer number of seconds, or an integer followed by one of [ms, h, m, s, d]. " +
"Must be greater than 30 seconds. Use -1 to disable. " +
"If not given, the value is inherited from HTTP options. " + RELEVANT_MSG)
.defaultValue("1h")
.build();
public static final Option<File> HTTPS_MANAGEMENT_CERTIFICATE_FILE = new OptionBuilder<>("https-management-certificate-file", File.class)
.category(OptionCategory.MANAGEMENT)
.description("The file path to a server certificate or certificate chain in PEM format for the management server. If not given, the value is inherited from HTTP options. " + RELEVANT_MSG)

7
quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ManagementPropertyMappers.java
View File

@ -71,6 +71,13 @@ public class ManagementPropertyMappers {
.to("quarkus.management.ssl.protocols")
.paramLabel("protocols")
.build(),
fromOption(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATES_RELOAD_PERIOD)
.mapFrom(HttpOptions.HTTPS_CERTIFICATES_RELOAD_PERIOD)
.to("quarkus.management.ssl.certificate.reload-period")
// -1 means no reload
.transformer((value, context) -> "-1".equals(value) ? null : value)
.paramLabel("reload period")
.build(),
fromOption(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_FILE)
.mapFrom(HttpOptions.HTTPS_CERTIFICATE_FILE)
.to("quarkus.management.ssl.certificate.files")

17
quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/cli/PicocliTest.java
View File

@ -125,6 +125,23 @@ public class PicocliTest extends AbstractConfigurationTest {
assertNull(nonRunningPicocli.config.getConfigValue("quarkus.http.ssl.certificate.reload-period").getValue());
}
@Test
public void testNegativeArgumentMgmtInterfaceCertReload() {
NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev");
assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
assertEquals("1h",
nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
nonRunningPicocli = pseudoLaunch("start-dev", "--https-management-certificates-reload-period=-1");
assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
assertNull(nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
nonRunningPicocli = pseudoLaunch("start-dev", "--https-certificates-reload-period=5m");
assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
assertEquals("5m",
nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
}
@Test
public void testInvalidArgumentType() {
NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--http-port=a");

12
quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ManagementConfigurationTest.java
View File

@ -230,6 +230,18 @@ public class ManagementConfigurationTest extends AbstractConfigurationTest {
assertManagementHttpsEnabled(false);
}
@Test
public void managementDefaultHttpsCertificatesReload() {
makeInterfaceOccupied();
putEnvVar("KC_HTTPS_CERTIFICATES_RELOAD_PERIOD", "2d");
initConfig();
assertConfig("https-management-certificates-reload-period", "2d");
assertManagementEnabled(true);
assertManagementHttpsEnabled(false);
}
@Test
public void managementEnabledDefaultHttpsKeystore(){
makeInterfaceOccupied();

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt vendored
View File

@ -89,6 +89,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt vendored
View File

@ -89,6 +89,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt vendored
View File

@ -89,6 +89,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt vendored
View File

@ -89,6 +89,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

10
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt vendored
View File

@ -234,6 +234,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when
@ -363,4 +371,4 @@ Bootstrap Admin:
Do NOT start the server using this command when deploying to production.
Use 'kc.sh start-dev --help-all' to list all available options, including build
options.
options.

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt vendored
View File

@ -269,6 +269,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

10
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt vendored
View File

@ -241,6 +241,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when
@ -374,4 +382,4 @@ By default, this command tries to update the server configuration by running a
$ kc.sh start '--optimized'
By doing that, the server should start faster based on any previous
configuration you have set when manually running the 'build' command.
configuration you have set when manually running the 'build' command.

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt vendored
View File

@ -270,6 +270,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

10
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt vendored
View File

@ -206,6 +206,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-key-store-file <file>
The key store which holds the certificate information instead of specifying
separate files for the management server. If not given, the value is
@ -308,4 +316,4 @@ By default, this command tries to update the server configuration by running a
$ kc.sh start '--optimized'
By doing that, the server should start faster based on any previous
configuration you have set when manually running the 'build' command.
configuration you have set when manually running the 'build' command.

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt vendored
View File

@ -235,6 +235,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-key-store-file <file>
The key store which holds the certificate information instead of specifying
separate files for the management server. If not given, the value is

10
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelp.approved.txt vendored
View File

@ -240,6 +240,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when
@ -364,4 +372,4 @@ Bootstrap Admin:
--bootstrap-admin-username <username>
Temporary bootstrap admin username. Used only when the master realm is
created. Available only when bootstrap admin password is set. Default:
temp-admin.
temp-admin.

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt vendored
View File

@ -269,6 +269,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when

10
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelp.approved.txt vendored
View File

@ -238,6 +238,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when
@ -362,4 +370,4 @@ Bootstrap Admin:
--bootstrap-admin-username <username>
Temporary bootstrap admin username. Used only when the master realm is
created. Available only when bootstrap admin password is set. Default:
temp-admin.
temp-admin.

8
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt vendored
View File

@ -267,6 +267,14 @@ Management:
The file path to a private key in PEM format for the management server. If not
given, the value is inherited from HTTP options. Relevant only when
something is exposed on the management interface - see the guide for details.
--https-management-certificates-reload-period <reload period>
Interval on which to reload key store, trust store, and certificate files
referenced by https-management-* options for the management server. May be a
java.time.Duration value, an integer number of seconds, or an integer
followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
to disable. If not given, the value is inherited from HTTP options. Relevant
only when something is exposed on the management interface - see the guide
for details. Default: 1h.
--https-management-client-auth <auth>
Configures the management interface to require/request client authentication.
If not given, the value is inherited from HTTP options. Relevant only when