Repository navigation
"Use Truststore SPI" options - Always/Never produce same behavior #45393
Replies: 2 comments 2 replies
|
I test for EnableTLS and there I see :
Which is confusing. |
|
Relates to #24663 truststore-paths is not the same as the truststore spi. When you use truststore-paths, it creates an updated system truststore that includes the provided certs. That system truststore is used by default. If you have not specifically configured a truststore spi file truststore, it doesn't matter whether what you select for Use Truststore SPI |
|
@shawkins Thank you for reply. |
Yes, it is deprecated.
That's mentioned on #24663 |
Uh oh!
There was an error while loading. Please reload this page.
Before reporting an issue
Area
dist/quarkus
Describe the bug
Under Create LDAP Provider section (admin/master/console/#/master/user-federation/ldap/new), when performing an SSL/TLS-based Test Connection, the test succeeds for both Use Truststore SPI options: Always and Never, regardless of truststore configuration.
Note: The server certificate is added via the KC_TRUSTSTORE_PATHS option.
Case 1: When the certificate is present in the custom-mounted path specified by KC_TRUSTSTORE_PATHS, both Always and Never options succeed.
Case 2: When the certificate is removed from the custom-mounted path, both Always and Never options fail.
Version
26.4.7
Regression
Expected behavior
The test should succeed only when the option is set to Always, and fail when set to Never.
SSL/TLS test connection should respect the selected option:
Always: Should succeed if the certificate is trusted.
Never: Should fail regardless of truststore configuration.
Actual behavior
Both options behave identically:
Succeed when certificate is present.
Fail when certificate is absent.
How to Reproduce?
Configure truststore path:
KC_TRUSTSTORE_PATHS=/opt/keycloak/certs/.crt
Navigate to Create LDAP Provider section.
Perform SSL/TLS Test Connection with options Always and Never:
Observe that both options succeed when cert is present.
Observe that both options fail when cert is removed.
Anything else?
No response
All reactions