How to create configuration keystore with fips mode enabled? #23518

da-development-id · 2023-09-25T19:58:37Z

da-development-id
Sep 25, 2023

Trying to create a keystore configuration file to be used with fips enabled. it doesn't seem to error out when access the keystore, but it also does not read the values. How do we create it in fips (strict or non-strict) mode?

created keystore using:
keytool -importpass -alias kc.db-password -keystore keystore.p12 -storepass keystorepass -storetype PKCS12 -v

and:

keytool -J-Djava.security.debug=properties,providers -J-Djava.security.properties=./java.security -importpass -v -keystore ./kcvault.p12 -storepass <password> -storetype PKCS12 -providerpath ./bc-fips-1.0.2.3.jar -alias kc.db-password

both seem to work with the fips feature disabled.

vmuzikar · 2023-09-26T10:14:13Z

vmuzikar
Sep 26, 2023
Collaborator

Do you use OpenJDK >=17?

CC @Pepo48

3 replies

Pepo48 Sep 26, 2023
Collaborator

@da-development-id can you increase the log-level and share the console output with us? The part where you try to read the values from the keystore should be enough to find some indications.

Meanwhile, I can try to set up a scenario in order to reproduce it.

da-development-id Sep 26, 2023
Author

@vmuzikar Yes, I'm using OpenJDK 17

da-development-id Sep 27, 2023
Author

@vmuzikar @Pepo48

I believe FIPS is enabled correctly on the system RHEL7, but I'm seeing this in the log below: FIPS-JVM: disabled. Would that be the issue?

2023-09-28 23:03:03,331 DEBUG [org.keycloak.crypto.fips.FIPS1402Provider] (main) Strong secure random available. Algorithm: NativePRNGBlocking, Provider: SUN version 17
2023-09-28 23:03:03,336 DEBUG [org.keycloak.crypto.fips.FIPS1402Provider] (main) Inserted security providers: [BCFIPS, BCJSSE]
2023-09-28 23:03:03,336 DEBUG [org.keycloak.common.crypto.CryptoIntegration] (main) Using the crypto provider: org.keycloak.crypto.fips.FIPS1402Provider
2023-09-28 23:03:03,542 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: , Hostname: xxx.xxx.xxx.xxx, Strict HTTPS: true, Path: , Strict BackChannel: false, Admin URL: , Admin: , Port: -1, Proxied: true
2023-09-28 23:03:05,222 INFO [org.bouncycastle.jsse.provider.PropertyUtils] (main) Found string security property [jdk.tls.disabledAlgorithms]: SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL
2023-09-28 23:03:05,223 INFO [org.bouncycastle.jsse.provider.PropertyUtils] (main) Found string security property [jdk.certpath.disabledAlgorithms]: MD2, MD5, SHA1 jdkCA & usage TLSServer, RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224, SHA1 usage SignedJAR & denyAfter 2019-01-01
2023-09-28 23:03:05,223 WARNING [org.bouncycastle.jsse.provider.DisabledAlgorithmConstraints] (main) Ignoring unsupported entry in 'jdk.certpath.disabledAlgorithms': SHA1 jdkCA & usage TLSServer
2023-09-28 23:03:05,223 WARNING [org.bouncycastle.jsse.provider.DisabledAlgorithmConstraints] (main) Ignoring unsupported entry in 'jdk.certpath.disabledAlgorithms': SHA1 usage SignedJAR & denyAfter 2019-01-01
2023-09-28 23:03:05,226 INFO [org.bouncycastle.jsse.provider.PropertyUtils] (main) Found boolean security property [keystore.type.compat]: true
2023-09-28 23:03:06,663 TRACE [org.keycloak.common.crypto.CryptoIntegration] (main) Java security providers: [
KC(BCFIPS version 1.000203, FIPS-JVM: disabled) version 1.0 - class org.keycloak.crypto.fips.KeycloakFipsSecurityProvider,
BCFIPS version 1.000203 - class org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider,
BCJSSE version 1.0017 - class org.bouncycastle.jsse.provider.BouncyCastleJsseProvider,
SUN version 17 - class sun.security.provider.Sun,
SunRsaSign version 17 - class sun.security.rsa.SunRsaSign,
SunEC version 17 - class sun.security.ec.SunEC,
SunJSSE version 17 - class sun.security.ssl.SunJSSE,
SunJCE version 17 - class com.sun.crypto.provider.SunJCE,
SunJGSS version 17 - class sun.security.jgss.SunProvider,
SunSASL version 17 - class com.sun.security.sasl.Provider,
XMLDSig version 17 - class org.jcp.xml.dsig.internal.dom.XMLDSigRI,
SunPCSC version 17 - class sun.security.smartcardio.SunPCSC,
JdkLDAP version 17 - class sun.security.provider.certpath.ldap.JdkLDAP,
JdkSASL version 17 - class com.sun.security.sasl.gsskerb.JdkSASL,
SunPKCS11 version 17 - class sun.security.pkcs11.SunPKCS11,
]
2023-09-28 23:03:06,664 TRACE [org.keycloak.common.crypto.CryptoIntegration] (main) Security properties: [
Java security properties file: null
Default keystore type: pkcs12
KeyManagerFactory.getDefaultAlgorithm(): X.509
TrustManagerFactory.getDefaultAlgorithm(): PKIX
keystore.type.compat: true
javax.net.ssl.trustStoreType: null
javax.net.ssl.trustStore: null
javax.net.ssl.trustStoreProvider: null
javax.net.ssl.keyStoreType: null
javax.net.ssl.keyStore: null
javax.net.ssl.keyStoreProvider: null
]
2023-09-28 23:03:07,109 INFO [org.bouncycastle.jcajce.provider.ProvPKCS12] (main) extra in data 1.2.840.113549.1.12.10.1.5
2023-09-28 23:03:07,110 INFO [org.bouncycastle.jcajce.provider.ProvPKCS12] (main) extra in data 1.2.840.113549.1.12.10.1.5
2023-09-28 23:03:07,110 INFO [org.bouncycastle.jcajce.provider.ProvPKCS12] (main) extra in data 1.2.840.113549.1.12.10.1.5
2023-09-28 23:03:08,088 INFO [org.bouncycastle.jsse.provider.PropertyUtils] (agroal-11) Found string system property [java.home]: /opt/jdks/java-17-openjdk-17.0.8.1.1-1.portable.jdk.el.x86_64
2023-09-28 23:03:08,208 WARN [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal
2023-09-28 23:03:08,272 INFO [org.bouncycastle.jsse.provider.ProvTlsClient] (agroal-11) [client #1 @5772d215] opening connection to xxx.xxx.xxx.xxx:1433
2023-09-28 23:03:08,342 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller'
2023-09-28 23:03:08,771 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel ISPN with stack tcpping
2023-09-28 23:03:08,772 INFO [org.jgroups.JChannel] (keycloak-cache-init) local_addr: 78605763-4566-4a37-a555-77c4b2a66224, name: keycloak03-51599
2023-09-28 23:03:08,784 INFO [org.bouncycastle.jsse.provider.ProvTlsClient] (agroal-11) [client #1 @5772d215] established connection with xxx.xxx.xxx.xxx:1433
2023-09-28 23:03:08,793 INFO [org.jgroups.protocols.FD_SOCK2] (keycloak-cache-init) server listening on *.57600
2023-09-28 23:03:08,974 INFO [org.bouncycastle.jsse.provider.ProvTlsClient] (agroal-11) [client #1 @5772d215] disconnected from xxx.xxx.xxx.xxx:1433
2023-09-28 23:03:08,975 WARN [io.agroal.pool] (agroal-11) Datasource '': Login failed for user 'dbadmin'. ClientConnectionId:fc8dfc85-8bb8-4d9c-b5e1-f628a567e52a
2023-09-28 23:03:08,976 WARN [org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator] (JPA Startup Thread) HHH000342: Could not obtain connection to query metadata: com.microsoft.sqlserver.jdbc.SQLServerException: Login failed for user 'dbadmin'. ClientConnectionId:fc8dfc85-8bb8-4d9c-b5e1-f628a567e52a
at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:265)
at com.microsoft.sqlserver.jdbc.TDSTokenHandler.onEOF(tdsparser.java:305)

j4real2208 · 2023-10-05T09:55:44Z

j4real2208
Oct 5, 2023

So are you suggesting that, keycloak doesn't function with java17 ? @vmuzikar

3 replies

Pepo48 Oct 5, 2023
Collaborator

@j4real2208 Keycloak definitely works with JDK17. At the same time, JDK17 is the prerequisite for running it with FIPS enabled[1].

[1] https://www.keycloak.org/server/fips

da-development-id Oct 5, 2023
Author

@j4real2208 @Pepo48
No, I'm just trying to understand what I'm doing wrong with the configuration.

sourabh-kalel Apr 24, 2025

Hi @da-development-id were you able to fix this config issue? I am also running into something similar due to which some of my algorithms used are not fips compliant.

How to create configuration keystore with fips mode enabled? #23518

Uh oh!

da-development-id Sep 25, 2023

Replies: 2 comments · 6 replies

Uh oh!

vmuzikar Sep 26, 2023 Collaborator

Uh oh!

Pepo48 Sep 26, 2023 Collaborator

Uh oh!

da-development-id Sep 26, 2023 Author

Uh oh!

Uh oh!

da-development-id Sep 27, 2023 Author

Uh oh!

j4real2208 Oct 5, 2023

Uh oh!

Uh oh!

Pepo48 Oct 5, 2023 Collaborator

Uh oh!

da-development-id Oct 5, 2023 Author

Uh oh!

sourabh-kalel Apr 24, 2025

da-development-id
Sep 25, 2023

Replies: 2 comments 6 replies

vmuzikar
Sep 26, 2023
Collaborator

Pepo48 Sep 26, 2023
Collaborator

da-development-id Sep 26, 2023
Author

da-development-id Sep 27, 2023
Author

j4real2208
Oct 5, 2023

Pepo48 Oct 5, 2023
Collaborator

da-development-id Oct 5, 2023
Author