Repository navigation
Realm creation mechanism question #51475
Unanswered
turosretes
asked this question in
Q&A
Replies: 2 comments
|
Rather than deleting keys after they are written, you can override Keycloak's default key provider factories by providing custom KeyProviderFactory implementations registered under the exact IDs Keycloak uses during initial setup (rsa-generated, rsa-enc-generated, hmac-generated, aes-generated). During realm initialization, Keycloak invokes your factory instead. Your factory can:
|
0 replies
|
Thank you i will take a look at it. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi,
When a realm is created, Keycloak auto-generates key providers (rsa-generated, rsa-enc-generated, hmac-generated, aes-generated) with private keys stored in the database. Our use case requires storing realm keys in HashiCorp Vault (or OpenBao) instead - we want to replace the default key providers entirely, not add custom ones alongside them.
The auto-generated keys should not exist in the database at all.
We've prototyped an approach using an Event Listener SPI that fires on realm creation, registers a custom KeyProvider backed by Vault, and removes the auto-generated providers. It works, but has drawbacks:
We've looked at the java-keystore provider as a reference for external key sources, but even with that configured, the auto-generated providers are still created alongside it.
Questions:
Any guidance would be appreciated. Happy to contribute if there's a direction the maintainers would support.
All reactions