Support for vault and AES and HMAC algorithms to JavaKeystoreKeyProvider #30957
+299
−87
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Closes keycloak#30880 Closes keycloak#29755 Signed-off-by: rmartinc <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #30880
Closes #29755
Adding all the algorithms to the
java-keystorekey provider. Besides the passwords (store and key) can also be configured through thevault. This way all the realm keys can be externalized to an external keystore file. There are some discrepancies between what keys can be stored in the different store types and in the different security providers:JKSstore type cannot store secret keys (AES or HMAC) in any provider.PKCS12allows to store all key types in non-fips mode butBCFIPSdoes not allow to store secret keys either (so in both fips modes this store cannot contain secret keys).BCFKSis weird in theBCprovider (non-fips) and, for example, HMAC keys do not work (bug?) although they work onBCFIPS(fips modes).I have discovered that
EdDSAkeys do not work in fips modes at all becauseBCFIPSdoes not implement for them the standard JDK 15+ interfaces that keycloak uses to manage them (EdEC, EdECPrivateKey and EdECPublicKey). This is a different story. Probably we need an issue even if we just document this fact.So in general the standard
PKCS12format seems to be the best for non-fips andBCFKSfor fips modes.Little changes in how the
JavaKeystoreKeyProviderloads the keys. The public key for asymmetric keys is loaded using the certificate as it should always be there.Tests added with the limitations in the store/providers commented above.