Unable to use vault, credential store, or elytron expression resolver in RH-SSO truststore spi
Issue
- Replacing the truststore password in
<spi name="truststore">with encrypted value usingpassword vaultorcredential storeresults in following error:
FATAL [org.keycloak.services] (ServerService Thread Pool -- 65) Error during startup: java.lang.RuntimeException: Failed to initialize TruststoreProviderFactory: /java-11-openjdk-11.0.6.10-0.static.jdk.openjdkportable.x86_64/lib/security/cacerts
at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.truststore.FileTruststoreProviderFactory.init(FileTruststoreProviderFactory.java:84)
at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:297)
at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:106)
...
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:792)
at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243)
at java.base/java.security.KeyStore.load(KeyStore.java:1479)
at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.truststore.FileTruststoreProviderFactory.loadStore(FileTruststoreProviderFactory.java:107)
at org.keycloak.keycloak-services@15.0.6.redhat-00001//org.keycloak.truststore.FileTruststoreProviderFactory.init(FileTruststoreProviderFactory.java:82)
... 42 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:790)
... 46 more
- If the password is entered in plain text in the standalone.xml, then the truststore can be opened and the server instance starts.
Environment
- Red Hat Single Sign-On (RH-SSO)
- 7.4
- 7.5.1
- 7.5.2
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.