Mask vault password in show-config by AkashKumar7902 · Pull Request #51013 · keycloak/keycloak

AkashKumar7902 · 2026-07-18T21:00:46Z

Summary

mark the vault password mapper as sensitive so show-config masks both the public option and its mapped SPI property
suppress unmapped SmallRye-normalized duplicates of KC_* variables because KcEnvConfigSource already provides their canonical keys
add regression coverage for kc.vault-pass and kc.spi-vault--keystore--pass, including checks that plaintext secrets never appear

Testing

./mvnw -pl quarkus/server,quarkus/dist -am -DskipTests -DskipTestsuite -DskipExamples install
./mvnw test -pl quarkus/tests/integration -Dtest=ShowConfigCommandDistTest (9 tests passed)
./mvnw -pl quarkus/runtime,quarkus/tests/integration -DskipTests spotless:check

AI assistance

This contribution was developed with assistance from OpenAI Codex agents. I reviewed and understand every change and am responsible for the implementation and for responding to review feedback.

Mark the vault password mapper as sensitive and ignore duplicate SmallRye environment aliases so the password is never shown in show-config output. Closes keycloak#50844 Signed-off-by: Akash Kumar <meakash7902@gmail.com>

Copilot

Pull request overview

Masks vault passwords in show-config and removes plaintext duplicates produced by environment-variable normalization.

Changes:

Marks the vault password mapper as sensitive.
Suppresses noncanonical KC_* environment entries.
Adds regression tests for public and mapped vault password properties.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
`ShowConfigCommandDistTest.java`	Tests vault password masking and plaintext exclusion.
`VaultPropertyMappers.java`	Marks vault passwords for masking.
`ShowConfig.java`	Filters normalized environment-variable duplicates.

shawkins · 2026-07-20T14:50:08Z

            PropertyMapper<?> mapper = PropertyMappers.getMapper(property);

+            // Ignore SmallRye-normalized duplicates of KC_* variables; KcEnvConfigSource provides the canonical keys.
+            if (mapper == null && property.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX)


This should be split off as a different issue. We don't generally expect the spi keys to be directly used when there is a first class option. This would also happen with more than just the env config source if the legacy key format is used - e.g. kc.spi-vault-keystore-pass

This should be split off as a different issue. We don't generally expect the spi keys to be directly used when there is a first class option. This would also happen with more than just the env config source if the legacy key format is used - e.g. kc.spi-vault-keystore-pass

That test looks legit (I checked and it is failing without this), as long as users can set it, we should plan to fix it. In another issue is fine.

In SmallRye Config terms, we could just be using io.smallrye.config.FallbackConfigSourceInterceptor for the legacy key format and then, we could rely on "masked". But I know that Keycloak works differently, I'll not try to understand it more as this part will be handled in another issue.

as long as users can set it

It's documented that you shouldn't use that and you should see a warning about using a "second-class" option, so it's much less of a concern that masking the proper configuration option for the vault password.

In SmallRye Config terms, we could just be using io.smallrye.config.FallbackConfigSourceInterceptor

There's two related cases:

Our KC_SPI_FOO__BAR__KEY is turned into kc.spi-foo--bar--key by the KcEnvConfigSource, but the EnvConfigSource assumes that it's kc.spi.foo."bar".key - which is effectively what the proposed change is trying to filter here.

What I'm highlighting, which is applicable to any config source, is that we support also kc.spi-foo-bar-key as an legacy alternative to the double dash version.

I don't think we looked at using the FallbackConfigSourceInterceptor for the second case - it's just being handled in the MicroProfileConfigProvider.

Thanks.

Our KC_SPI_FOO__BAR__KEY is turned into kc.spi-foo--bar--key by the KcEnvConfigSource, but the EnvConfigSource assumes that it's kc.spi.foo."bar".key - which is effectively what the proposed change is trying to filter here.

IIRC SR Config assumes this when it doesn't know there is such a property as kc.spi-foo--bar--key, which is why when you are mapping env vars to such properties you are supposed to also declare them in some dotted config source with lower priority.

I do not say it is a solution, I'll not work on this as we agreed it is a separate issue. I appreciate the context, thanks again.

which is why when you are mapping env vars to such properties you are supposed to also declare them in some dotted config source with lower priority

Does it need to be lower priority - wouldn't that have to be a .env or in the application.properties?

I thought it was aware of kc.spi-foo--bar--key in the KcEnvConfigSource but does not consider it a match for KC_SPI_FOO__BAR__KEY because of the conversion rule to double quotes being superseding.

In any case, let's remove this change from the PR and move this discussion over to #51113

Does it need to be lower priority - wouldn't that have to be a .env or in the application.properties?

I don't know, I don't keep up to date knowledge of SR Config internals because it keeps changing like crazy. https://smallrye.io/smallrye-config/Main/config/environment-variables/ doesn't mention priority, it just says a dotted config source. There is "It can be set in a low ordinal source, even without value." but that doesn't mean it can't work with the higher one.

I said lower priority because that is what I did in the past when using K8 extension to specify env vars, env vars to dotted prop names is ambiguous, so when we created it in a dotted format with stale values, it started working as they were overridden by the env vars.

I thought it was aware of kc.spi-foo--bar--key in the KcEnvConfigSource but does not consider it a match for KC_SPI_FOO__BAR__KEY because of the conversion rule to double quotes being superseding.

Sorry for being slow, but I don't understand why kc.spi-foo--bar--key shouldn't be resolved to KC_SPI_FOO__BAR__KEY if the former is specified somewhere. I may just don't know about that rule and it is my bad!

In any case, let's remove this change from the PR and move this discussion over to #51113

Absolutely. I assume it will be clear when I sit down on it, I still didn't debug it, maybe I shouldn't say anything until then.

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

shawkins

LGTM - removed the additional logic and test, so that it can be addressed under the other issue.

Copilot

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-24T15:49:04Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

Mask vault password in show-config

c902a2d

Mark the vault password mapper as sensitive and ignore duplicate SmallRye environment aliases so the password is never shown in show-config output. Closes keycloak#50844 Signed-off-by: Akash Kumar <meakash7902@gmail.com>

keycloak-github-bot Bot added the team/cloud-native label Jul 18, 2026

AkashKumar7902 marked this pull request as ready for review July 18, 2026 21:02

AkashKumar7902 requested review from a team as code owners July 18, 2026 21:02

Copilot AI review requested due to automatic review settings July 18, 2026 21:02

Copilot started reviewing on behalf of AkashKumar7902 July 18, 2026 21:03 View session

Copilot AI reviewed Jul 18, 2026

View reviewed changes

shawkins reviewed Jul 20, 2026

View reviewed changes

shawkins mentioned this pull request Jul 23, 2026

Usage of second class configuration may not be masked in show-config #51113

Open

removing the second class config logic / test

dd6f011

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

Copilot AI review requested due to automatic review settings July 24, 2026 14:44

Copilot started reviewing on behalf of shawkins July 24, 2026 14:44 View session

shawkins approved these changes Jul 24, 2026

View reviewed changes

shawkins enabled auto-merge (squash) July 24, 2026 14:45

Copilot AI reviewed Jul 24, 2026

View reviewed changes

michalvavrik approved these changes Jul 24, 2026

View reviewed changes

vmuzikar approved these changes Jul 24, 2026

View reviewed changes

shawkins merged commit 39c424e into keycloak:main Jul 24, 2026
94 checks passed

keycloak-github-bot Bot added the flaky-test label Jul 24, 2026

keycloak-github-bot Bot reviewed Jul 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Mask vault password in show-config#51013

Mask vault password in show-config#51013
shawkins merged 2 commits into
keycloak:mainfrom
AkashKumar7902:agent/mask-vault-password-show-config

AkashKumar7902 commented Jul 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

shawkins Jul 20, 2026

Uh oh!

michalvavrik Jul 21, 2026 •

edited

Loading

Uh oh!

shawkins Jul 21, 2026 •

edited

Loading

Uh oh!

michalvavrik Jul 22, 2026

Uh oh!

shawkins Jul 23, 2026

Uh oh!

michalvavrik Jul 23, 2026

Uh oh!

shawkins left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

AkashKumar7902 commented Jul 18, 2026

Summary

Testing

AI assistance

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

shawkins Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

michalvavrik Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shawkins Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michalvavrik Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

shawkins Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

michalvavrik Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

shawkins left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 24, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

michalvavrik Jul 21, 2026 •

edited

Loading

shawkins Jul 21, 2026 •

edited

Loading