Generate BCFKS truststore in strict FIPS by slaskawi · Pull Request #50149 · keycloak/keycloak

slaskawi · 2026-06-19T08:02:15Z

Summary

This Pull Request changes the way the automatic Trust Store is generated in FIPS (strict) mode.

Highlights:

Generate BCFKS system truststores in strict FIPS mode
Keep PKCS12 generation for default mode
Add PKCS12 and FIPS BCFKS coverage

Related tickets

Fixes #50110

Functional tests

Verified against the UDS Core: defenseunicorns/uds-identity-config#882

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Pull request overview

Copilot reviewed 13 out of 15 changed files in this pull request and generated 2 comments.

shawkins

Thanks @slaskawi, just a couple of initial thoughts.

Copilot

Pull request overview

Copilot reviewed 14 out of 16 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 16 changed files in this pull request and generated no new comments.

slaskawi · 2026-07-13T08:36:27Z

@shawkins Feedback addressed. We're ready for the next round of reviews.

shawkins

Thank you for the updates and follow-up issue @slaskawi

Just a couple of new questions / comments.

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 16 changed files in this pull request and generated 1 comment.

slaskawi

Thanks for the comments @shawkins ! All of them should be addressed now and I also got rid of the enum ordering (which felt a bit weird).

Please let me know if we need any more changes.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

shawkins

LGTM, thanks @slaskawi

Let's see if we can get another review - cc @vmuzikar @rmartinc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

shawkins

LGTM with the cleanup of the notes.

Copilot

Pull request overview

Copilot reviewed 14 out of 16 changed files in this pull request and generated 1 comment.

rmartinc

Thanks @slaskawi and @shawkins! LGTM!

slaskawi · 2026-07-24T18:27:43Z

You’re absolute rock stars, @rmartinc @shawkins !

Thank you for reviewing this Pull Request and fixing this small bit that somehow got it! I highly appreciate you!

slaskawi changed the title ~~Generate BCFKS truststore in strict FIPS~~ [WIP] Generate BCFKS truststore in strict FIPS Jun 19, 2026

slaskawi force-pushed the 50110/fips_trust_store branch from 2a20e10 to e82f7b4 Compare June 19, 2026 08:17

keycloak-github-bot Bot added the flaky-test label Jun 19, 2026

This was referenced Jun 19, 2026

Flaky test: org.keycloak.testsuite.saml.SamlClientTest#testLoginWithOIDCClient #49985

Closed

Flaky test: org.keycloak.testsuite.forms.RPInitiatedFrontChannelLogoutTest#testFrontChannelLogoutWithoutSessionRequired #48647

Closed

slaskawi commented Jun 20, 2026

View reviewed changes

Comment thread docs/documentation/upgrading/topics/changes/changes-26_7_0.adoc Outdated

slaskawi mentioned this pull request Jun 20, 2026

test: use Keycloak PR image defenseunicorns/uds-identity-config#882

Closed

slaskawi commented Jun 20, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/truststore/TruststoreBuilder.java Outdated

Generate BCFKS truststore in strict FIPS

639fe7d

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

slaskawi force-pushed the 50110/fips_trust_store branch from 37d5e6b to 639fe7d Compare June 20, 2026 08:44

slaskawi changed the title ~~[WIP] Generate BCFKS truststore in strict FIPS~~ Generate BCFKS truststore in strict FIPS Jun 22, 2026

slaskawi marked this pull request as ready for review June 22, 2026 05:58

slaskawi requested a review from a team as a code owner June 22, 2026 05:58

Copilot AI review requested due to automatic review settings June 22, 2026 05:58

slaskawi requested a review from a team as a code owner June 22, 2026 05:58

Copilot AI reviewed Jun 22, 2026

slaskawi mentioned this pull request Jun 22, 2026

Keycloak doesn't honor --https-trust-store-type when automatically creating the Trust Store #50110

Closed

2 tasks

michalvavrik added the team/cloud-native label Jun 22, 2026

shawkins requested review from Copilot and shawkins June 22, 2026 13:21

Copilot started reviewing on behalf of shawkins June 22, 2026 13:21 View session

Copilot AI reviewed Jun 22, 2026

View reviewed changes

Comment thread docs/guides/server/keycloak-truststore.adoc Outdated

Comment thread docs/documentation/upgrading/topics/changes/changes-26_7_0.adoc Outdated

shawkins reviewed Jun 22, 2026

View reviewed changes

slaskawi requested review from a team as code owners June 26, 2026 06:12

slaskawi force-pushed the 50110/fips_trust_store branch from b244141 to 53cd261 Compare June 26, 2026 06:40

Merge remote-tracking branch 'upstream/main' into 50110/fips_trust_store

f4451d5

slaskawi force-pushed the 50110/fips_trust_store branch from 53cd261 to af06e3a Compare June 26, 2026 07:29

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 08:17

Copilot started reviewing on behalf of slaskawi July 13, 2026 08:17 View session

slaskawi mentioned this pull request Jul 13, 2026

Always use BCFKS for the generated system truststore when FIPS is enabled #50821

Open

Copilot AI reviewed Jul 13, 2026

View reviewed changes

shawkins reviewed Jul 13, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/truststore/TruststoreBuilder.java Outdated

Comment thread quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakRecorder.java Outdated

Comment thread common/src/main/java/org/keycloak/common/crypto/CryptoProvider.java

Merge remote-tracking branch 'upstream/main' into 50110/fips_trust_store

8d803f7

Copilot AI review requested due to automatic review settings July 14, 2026 09:00

comments addressed

a7f1461

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

slaskawi force-pushed the 50110/fips_trust_store branch from 4cc8746 to a7f1461 Compare July 14, 2026 09:02

Copilot started reviewing on behalf of slaskawi July 14, 2026 09:05 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread docs/guides/server/keycloak-truststore.adoc Outdated

slaskawi commented Jul 14, 2026

View reviewed changes

Potential fix for pull request finding

dd687fb

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

Copilot AI review requested due to automatic review settings July 14, 2026 09:17

Copilot AI reviewed Jul 14, 2026

shawkins previously approved these changes Jul 14, 2026

View reviewed changes

rmartinc reviewed Jul 24, 2026

View reviewed changes

Comment thread docs/documentation/release_notes/topics/26_7_0.adoc Outdated

Apply suggestion from @shawkins

249c399

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

shawkins dismissed their stale review via 249c399 July 24, 2026 14:50

shawkins requested review from Copilot and shawkins July 24, 2026 14:50

Copilot started reviewing on behalf of shawkins July 24, 2026 14:50 View session

shawkins approved these changes Jul 24, 2026

View reviewed changes

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread common/src/main/java/org/keycloak/common/crypto/CryptoProvider.java

keycloak-github-bot Bot mentioned this pull request Jul 24, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest #51076

Open

rmartinc approved these changes Jul 24, 2026

View reviewed changes

rmartinc merged commit 1c8445f into keycloak:main Jul 24, 2026
94 checks passed

Uh oh!

Conversation

slaskawi commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related tickets

Functional tests

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

shawkins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

slaskawi commented Jul 13, 2026

Uh oh!

shawkins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

slaskawi left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

shawkins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shawkins left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

rmartinc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

slaskawi commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

slaskawi commented Jun 19, 2026 •

edited

Loading