[keycloak-user] Problems using keycloak admin client

Hi, I have some problems using keycloak admin client against Keycloak instance that is running on Openshift Online Pro. Basic functions work ok, I can get token and do login, but cannot do any admin stuff with Java client (keycloak-admin-client 3.4.2.Final). My keycloak (v 3.4.2) is running ok on Openshift Online Pro and I'm using custom SSL certificate. I have tried different approaches on routing layer. Using Edge termination with my own cert stuff and also Passthru SSL with proper cert configured on keycloak Wildfly. Even tried to us default hostname xxxx-namespace.e4ff.pro-eu-west-1.openshiftapps.com. When using default router hostname (e4ff ...) I get javax.ws.rs.ServiceUnavailableException: HTTP 503 Service Unavailable at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus( ClientInvocation.java:211) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult( ClientInvocation.java:174) at org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity( BodyEntityExtractor.java:59) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke( ClientInvoker.java:104) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke( ClientProxy.java:64) at com.sun.proxy.$Proxy19.grantToken(Unknown Source) at org.keycloak.admin.client.token.TokenManager.grantToken( TokenManager.java:89) at org.keycloak.admin.client.token.TokenManager.getAccessToken( TokenManager.java:69) at org.keycloak.admin.client.token.TokenManager.getAccessTokenString( TokenManager.java:64) at org.keycloak.admin.client.resource.BearerAuthFilter.filter( BearerAuthFilter.java:52) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke( ClientInvocation.java:413) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke( ClientInvoker.java:102) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke( ClientProxy.java:64) at com.sun.proxy.$Proxy27.list(Unknown Source) at KeycloakTestStage.main(KeycloakTestStage.java:43) There is nothing in keycloak logs that describes that 503. When using browser or curl that URL works fine. When using own certs I get own hostname I get javax.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke( ApacheHttpClient4Engine.java:287) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke( ClientInvocation.java:436) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke( ClientInvoker.java:102) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke( ClientProxy.java:64) at com.sun.proxy.$Proxy19.grantToken(Unknown Source) at org.keycloak.admin.client.token.TokenManager.grantToken( TokenManager.java:89) at org.keycloak.admin.client.token.TokenManager.getAccessToken( TokenManager.java:69) at org.keycloak.admin.client.token.TokenManager.getAccessTokenString( TokenManager.java:64) at org.keycloak.admin.client.resource.BearerAuthFilter.filter( BearerAuthFilter.java:52) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke( ClientInvocation.java:413) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke( ClientInvoker.java:102) at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke( ClientProxy.java:64) at com.sun.proxy.$Proxy27.list(Unknown Source) at KeycloakTestStage.main(KeycloakTestStage.java:43) Caused by: javax.net.ssl.SSLException: Certificate for < keycloak-XXX.mycustomhostname.com> doesn't match any of the subject alternative names: [*.e4ff.pro-eu-west-1.openshiftapps.com, e4ff.pro-eu-west-1.openshiftapps.com] at org.apache.http.conn.ssl.AbstractVerifier.verify( AbstractVerifier.java:164) at org.apache.http.conn.ssl.BrowserCompatHostnameVerifier.verify( BrowserCompatHostnameVerifier.java:61) at org.apache.http.conn.ssl.AbstractVerifier.verify( AbstractVerifier.java:140) at org.apache.http.conn.ssl.AbstractVerifier.verify( AbstractVerifier.java:114) at org.apache.http.conn.ssl.SSLSocketFactory.verifyHostname( SSLSocketFactory.java:569) at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket( SSLSocketFactory.java:544) at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket( SSLSocketFactory.java:409) at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection( DefaultClientConnectionOperator.java:177) at org.apache.http.impl.conn.ManagedClientConnectionImpl.open( ManagedClientConnectionImpl.java:304) at org.apache.http.impl.client.DefaultRequestDirector.tryConnect( DefaultRequestDirector.java:611) at org.apache.http.impl.client.DefaultRequestDirector.execute( DefaultRequestDirector.java:446) at org.apache.http.impl.client.AbstractHttpClient.doExecute( AbstractHttpClient.java:882) at org.apache.http.impl.client.CloseableHttpClient.execute( CloseableHttpClient.java:82) at org.apache.http.impl.client.CloseableHttpClient.execute( CloseableHttpClient.java:55) at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke( ApacheHttpClient4Engine.java:283) ... 13 more Custom route hostname is configured as CNAME in my domain name provider as instructed. CNAME points to e4ff.pro-eu-west-1.openshiftapps.com I'm creating Keycloak object like this Keycloak kc = Keycloak.getInstance(KC_AUTH_SERVER_URL, KC_ADMIN_REALM, KC_ADMIN_USER, KC_ADMIN_PWD, KC_ADMIN_CLIENT_ID); Even with constructor code like this SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() { public boolean isTrusted(X509Certificate[] arg0, String arg1) throws CertificateException { return true; } }).build(); Keycloak.getInstance(KC_AUTH_SERVER_URL, KC_ADMIN_REALM, KC_ADMIN_USER, KC_ADMIN_PWD, KC_ADMIN_CLIENT_ID, null, sslContext); I get same result. When checking from code (if this is correct code) https://github.com/keycloak/keycloak/blob/master/integration/admin-client... public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, String clientSecret, SSLContext sslContext, ResteasyJackson2Provider customJacksonProvider) { ResteasyClientBuilder clientBuilder = new ResteasyClientBuilder() .sslContext(sslContext) .hostnameVerification(ResteasyClientBuilder.HostnameVerificationPolicy.WILDCARD) .connectionPoolSize(10); if (customJacksonProvider != null) { clientBuilder.register(customJacksonProvider); } return new Keycloak(serverUrl, realm, username, password, clientId, clientSecret, PASSWORD, clientBuilder.build(), null); } Based on the code hostname verification cannot be overridden. Br, Tero