Keycloak 17.0 container LDAPS configuration #11143

boomcubist · 2022-04-06T10:57:57Z

boomcubist
Apr 6, 2022

Hi,

I'm following this guide to setup LDAPS to a MSAD service within a Keycloak 17.0 container but I'm getting this error when I snyc users:

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I have added these lines to my Dockerfile:
COPY ldap-ca.cer /tmp
RUN keytool -import -alias alias.domain.com -keystore truststore.jks -file /tmp/ldap-ca.cer -storepass mypassword -noprompt

I can't find standalone.xml, standalone-ha.xml, or domain.xml in the container, so I created conf/standalone.xml and put the following in:

<spi name="truststore">
    <provider name="file" enabled="true">
        <properties>
            <property name="file" value="truststore.jks"/>
            <property name="password" value="mypassword"/>
            <property name="hostname-verification-policy" value="WILDCARD"/>
        </properties>
    </provider>
</spi>

That still didn't work so I added these lines to my .env file:
KC_HTTPS_TRUST_STORE_FILE=truststore.jks
KC_HTTPS_TRUST_STORE_PASSWORD=mypassword

But that didn't work either.

Can someone help me understand what I have done wrong.

Thanks,
Lee

Hollerweger · 2022-07-07T15:32:18Z

Hollerweger
Jul 7, 2022

I coudn't get it working too.
Not sure if the truststore was really imported by keycloak or if it is actually used within the ldaps connection.
Tried different file path for the environment variables: truststore.jks, /truststore.jks, /opt/keycloak/truststore.jks
I'm using Keycloak 18.0.0

COPY truststore.jks /opt/keycloak/truststore.jks
WORKDIR /opt/keycloak
ENV KC_HTTPS_TRUST_STORE_FILE=truststore.jks
ENV KC_HTTPS_TRUST_STORE_PASSWORD=truststore
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start"]

0 replies

Navigation Menu

Repository navigation

Keycloak 17.0 container LDAPS configuration #11143

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak 17.0 container LDAPS configuration #11143

Uh oh!

boomcubist Apr 6, 2022

Replies: 1 comment

Uh oh!

Hollerweger Jul 7, 2022

boomcubist
Apr 6, 2022

Hollerweger
Jul 7, 2022