Unable to use vault, credential store, or elytron expression resolver in RH-SSO truststore spi

Solution Verified - Updated -

Issue

  • Replacing the truststore password in <spi name="truststore"> with encrypted value using password vault or credential store results in following error:
FATAL [org.keycloak.services] (ServerService Thread Pool -- 65) Error during startup: java.lang.RuntimeException: Failed to initialize TruststoreProviderFactory: /java-11-openjdk-11.0.6.10-0.static.jdk.openjdkportable.x86_64/lib/security/cacerts
    at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.truststore.FileTruststoreProviderFactory.init(FileTruststoreProviderFactory.java:84)
    at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:297)
    at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:106)
    ...
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
    at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:792)
    at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243)
    at java.base/java.security.KeyStore.load(KeyStore.java:1479)
    at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.truststore.FileTruststoreProviderFactory.loadStore(FileTruststoreProviderFactory.java:107)
    at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.truststore.FileTruststoreProviderFactory.init(FileTruststoreProviderFactory.java:82)
    ... 42 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
    at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:790)
    ... 46 more
  • If the password is entered in plain text in the standalone.xml, then the truststore can be opened and the server instance starts.

Environment

  • Red Hat Single Sign-On (RH-SSO)
    • 7.4
    • 7.5.1
    • 7.5.2

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content