search

dasniko / testcontainers-keycloak

A Testcontainer implementation for Keycloak IAM & SSO.
Apache License 2.0
328 stars 51 forks source link

Admin client cannot connect when TLS is enabled #75

Closed hasalex closed 2 years ago

hasalex commented 2 years ago

Describe the bug

When the container is started with the useTls() option, the admin client is not able to connect.

Version

2.2.1

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

    @Test
    public void shouldAdminClientBeAbleToConnect() {
        try (KeycloakContainer keycloak = new KeycloakContainer().useTls()) {
            keycloak.start();

            Keycloak admin = keycloak.getKeycloakAdminClient();
            ServerInfoResource serverInfoResource = admin.serverInfo();
            assertNotNull(serverInfoResource.getInfo());
        }
    }

Relevant log output

javax.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:328)
    at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:443)
    at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:149)
    at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:112)
    at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:76)
    at jdk.proxy2/jdk.proxy2.$Proxy36.grantToken(Unknown Source)
    at org.keycloak.admin.client.token.TokenManager.grantToken(TokenManager.java:98)
    at org.keycloak.admin.client.token.TokenManager.getAccessToken(TokenManager.java:74)
    at org.keycloak.admin.client.token.TokenManager.getAccessTokenString(TokenManager.java:69)
    at org.keycloak.admin.client.resource.BearerAuthFilter.filter(BearerAuthFilter.java:52)
    at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.filterRequest(ClientInvocation.java:579)
    at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:440)
    at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:149)
    at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:112)
    at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:76)
    at jdk.proxy2/jdk.proxy2.$Proxy38.getInfo(Unknown Source)
    at dasniko.testcontainers.keycloak.KeycloakContainerHttpsTest.shouldAdminClientBeAbleToConnect(KeycloakContainerHttpsTest.java:83)
    at ...
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
    ... 103 more

Anything else?

Can be solved with a SSLContext.