[keycloak-user] Adapter trustore: use default java trustore possible ?

[Jeremy Simon]

Hey there,

I had asked about this a while ago too.  Far as I know, the current
implementation uses the jks for the HTTPS communication only.  All
realms generate their own key pair.

Now to get around that, maybe you could export a realm to JSON, put in
what you want for the key information and import it as a new realm or
server configuration.  That might be a little crazy.  The more I
thought about it, since the realm key pairs are for signing and
encrypting the JWTs (or saml), that it's kinda nice you can hit a key
and generate new ones in case of a compromise...or to keep stuff
revolving.

Hope that helps!

jeremy
jeremy at jeremysimon.com
www.JeremySimon.com


On Fri, Feb 19, 2016 at 8:41 AM, Jérôme Revillard <jrevillard at gnubila.fr> wrote:
> Any advise for this please ?
>
> Best,
> Jerome
>
>
> Le 17/02/2016 11:19, Jérôme Revillard a écrit :
>
> Yes, it seems to be the case for the server, but not for the clients. See
> the trustore config description here:
> https://keycloak.github.io/docs/userguide/keycloak-server/html/ch08.html#adapter-config
>
> Best,
> Jerome
>
> Le 17/02/2016 11:09, Bruno Oliveira a écrit :
>
> I'm not sure if I got your question in the right way. But from my
> understanding Java truststore is the standard fall back.
>
> See item 3.2.5
> https://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html
>
> On Wed, Feb 17, 2016 at 6:07 AM Jérôme Revillard <jrevillard at gnubila.fr>
> wrote:
>>
>> Dear all,
>>
>> I'm testing now a Keycloak server properly configured with https
>> configuration.
>> The server certificate is one which is already known by the default java
>> trustore.
>> Would it be possible to setup the keycloak.json adapter config to use
>> this default java trustore ?
>>
>> Best,
>> Jerome
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user