Implement automatic key rotation for realm keys#45091
Implement automatic key rotation for realm keys#45091volck wants to merge 2 commits intokeycloak:mainfrom
Conversation
Adds scheduled task that automatically rotates realm signing and encryption keys based on configurable rotation periods. This addresses the security concern of long-lived keys and reduces operational burden. Key features: - Configurable rotation period per key provider - Automatic expiration of passive keys after grace period - Optional automatic deletion of disabled keys - Prometheus metrics for monitoring rotation events - Admin events for audit trail - Support for RSA, ECDSA, HMAC, and AES key providers The rotation task runs as part of the existing scheduled tasks infrastructure and is cluster-aware to prevent race conditions. Closes keycloak#11693 Signed-off-by: Emil Volckmar Ry <emilvry@gmail.com>
|
@stianst I dont know who to tag, but is some one going to review this soon? |
|
@volck - thank you for this PR. I see some emoji, it would be great if someone of those people would help to assess this PR. Some things I notice:
|
|
@ahus1 thanks for getting back to me! Please see attached screenshots:
in console we get the following messages:
For the deletion/retention period: Ican try to derive the minimum passive key retention as max(ssoSessionMaxLifespan, ssoSessionMaxLifespanRememberMe, offlineSessionMaxLifespan, clientOfflineSessionMaxLifespan) plus a configurable safety margin, and validate user-configured values against this floor. Is this a good first stab? As for #46350, could we expire the cookie by default when a key is outside of both deletion periods? |
Passive keys must remain available at least as long as the longest-lived session type in the realm to ensure tokens signed with those keys can still be verified. This change: - Add computeMinimumPassiveKeyRetention() that computes max(all session timeouts) + safety margin (10%, min 1 hour) - Enforce session-derived minimum in expirePassiveKeys(), logging a warning when the configured expiration is overridden - Propagate deletion settings (autoDeleteDisabledKeys, deletionGracePeriod) to newly created providers during key rotation - Fix duplicate imports and indentation in rotateKey() - Add tests for session-aware retention guardrails - Fix test cleanup to catch rotated provider names - Fix testAutomaticKeyDeletion JPA L1 cache issue (use getComponentsStream) Closes keycloak#46350
|
Added b60f7ee which derives the minimum passive key retention period from the realm's session timeout settings (max of all session types + a safety margin of 10%, minimum 1 hour). This prevents keys from being expired before long-lived sessions (e.g. offline sessions) have a chance to verify tokens signed with them. Added tests for the guardrail. If someone could verify I'd appreciate it. |
Adds scheduled task that automatically rotates realm signing and encryption keys based on configurable rotation periods. This addresses the security concern of long-lived keys and reduces operational burden.
Key features:
The rotation task runs as part of the existing scheduled tasks infrastructure and is cluster-aware to prevent race conditions.
Closes #11693