Repository navigation
Replies: 1 comment 3 replies
|
Yes. In 26.8.1 the I checked it on a fresh 26.8.1 ( With kcadm: kcadm.sh create components -r myrealm \
-s name=rsa-3072 -s providerId=rsa-generated \
-s providerType=org.keycloak.keys.KeyProvider \
-s 'config.priority=["200"]' -s 'config.keySize=["3072"]' -s 'config.algorithm=["RS256"]'or in the console: Realm settings > Keys > Providers > Add provider > rsa-generated. One caveat for an existing realm: don't change the key size on the provider that is currently signing. Keycloak regenerates that key pair in place when the size changes (AbstractGeneratedRsaKeyProviderFactory.java#L106-L111). In my test the old If you need a size outside that list, the imported |
|
what about 26.7.2 supported ? or we need to upgrade to 26.8.1 ? |
|
No need to upgrade. 26.7.2 has the same list (1024, 2048, 3072, 4096; CryptoProvider.java at 26.7.2), so the same kcadm command works there. 3072 was added in 26.4.0 (#41551). On 26.3.x and earlier the generated providers only offer 1024, 2048 and 4096, so 4096 is the only option of at least 3072 bits there. |
|
@dima-sap did 3072 work for you on 26.7.2? If it did, could you mark the answer so others with the same question find it quickly? |
Uh oh!
There was an error while loading. Please reload this page.
Keycloak 26.8.1 can be configured with RSA keys ≥3072 bits ?
All reactions