search

quarkusio / quarkus

Quarkus: Supersonic Subatomic Java.
https://quarkus.io
Apache License 2.0
13.34k stars 2.55k forks source link

Enhance keycloak-admin-client extension to support TLS trust and key stores #37243

Open barreiro opened 7 months ago

barreiro commented 7 months ago

Description

When connecting to a keycloak instance that has TLS encryption enabled, for example when running in Openshift with a certificate provided by the Service CA, the certificate cannot be provided to the extension and the only option is to set it system-wide which requires elevated privileges to do.

After #37206 is possible to disable TLS verification altogether, but that may not be desired for other extensions.

In addition to that mutual TLS is not possible at all because we cannot set client certificate.

Implementation ideas

Should be something similar to what has been done for oidc client extension in #18012 .

michalvavrik commented 3 weeks ago

I think this should wait for https://github.com/quarkusio/quarkus/issues/38811 considering major changes in REST client TLS registry.