From 32ec4c4672d9a022690485be46207711b21b066d Mon Sep 17 00:00:00 2001 From: Akash Kumar <91385321+AkashKumar7902@users.noreply.github.com> Date: Fri, 24 Jul 2026 21:18:57 +0530 Subject: [PATCH] Mask vault password in show-config (#51013) * Mask vault password in show-config Mark the vault password mapper as sensitive and ignore duplicate SmallRye environment aliases so the password is never shown in show-config output. Closes #50844 Signed-off-by: Akash Kumar * removing the second class config logic / test Signed-off-by: Steve Hawkins --------- Signed-off-by: Akash Kumar Signed-off-by: Steve Hawkins Co-authored-by: Steve Hawkins (cherry picked from commit 39c424e92542439cecf2abfc9377ff7125b72ce6) --- .../configuration/mappers/VaultPropertyMappers.java | 1 + .../keycloak/it/cli/dist/ShowConfigCommandDistTest.java | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java index 58a6fe6e0231..7dfa6af25923 100644 --- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java +++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java @@ -25,6 +25,7 @@ public List> getPropertyMappers() { fromOption(VaultOptions.VAULT_PASS) .to("kc.spi-vault--keystore--pass") .paramLabel("pass") + .isMasked(true) .build(), fromOption(VaultOptions.VAULT_TYPE) .to("kc.spi-vault--keystore--type") diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java index c46211a6fc3f..81a8df04e43d 100644 --- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java +++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java @@ -99,6 +99,15 @@ void testNoDuplicitEnvVarEntries(LaunchResult result) { assertThat(output, not(containsString("secret-pass"))); } + @Test + @Launch({ ShowConfig.NAME }) + @WithEnvVars({"KC_VAULT_PASS", "vault-secret"}) + void testShowConfigCommandHidesVaultPassword(LaunchResult result) { + String output = result.getOutput(); + assertThat(output, containsString("kc.vault-pass = " + PropertyMappers.VALUE_MASK)); + assertThat(output, not(containsString("vault-secret"))); + } + @Test @RawDistOnly(reason = "Containers are immutable") void testConfigSourceNames(KeycloakDistribution distribution) {