Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

core

Describe the bug

When Keycloak automatically generates the Trust Store (using the TruststoreBuilder), it hardcodes the PKCS12. In a Strict FIPS environment this may either lead to a non-FIPS compliant configuration (as PKCS12 are not FIPS compliant) or a failure (dependning on the java.security configuration).

The TruststoreBuilder should repect the selected Trust Store type passed through the settings.

Version

nightly

Regression

• The issue is a regression

Expected behavior

When --https-trust-store-type=bcfks is used, Keycloak should generate a BCFKS Trust Store.

Actual behavior

When --https-trust-store-type=bcfks is used, Keycloak generates a PKCS12 Trust Store.

How to Reproduce?

Use Keycloak container image and put a properly formed PEM file into the /opt/keycloak/conf/truststores. Configure the FIPS settings properly and pass the --https-trust-store-type=bcfks option in.

Observe the results.

Anything else?

There's a workaround for this issue. Create a BCFKS beforehand and then boot Keycloak up.

Here's the workaround for the UDS Platform:

• feat(CORE-604): force BCFKS keystore type for FIPS deployments defenseunicorns/uds-core#2745
• feat(CORE-604): generate BCFKS truststore for FIPS-compliant Keycloak deployment defenseunicorns/uds-identity-config#878