Automated Realm Key Rotation #42260

eicki · 2025-08-31T23:40:16Z

eicki
Aug 31, 2025

I like to start a discussion about how to implement an automatic realm key rotation used for signing and encryption.
There is already an out-dated issue #11693 and another related discussion #37983, but they both are either out-dated or haven't received any attention.

I have actually implemented this in my own extension (a custom key provider), but that is probably not suited for Keycloak in general at least not as it is. But here is the breakdown of things that I have implemented and to which I think would make sense in Keycloak:

Make the number of days a generated RSA realm key used for signing or encryption is valid configurable. This is as simple as adding a configuration option to the generated key provider factories that defines that. If not set it defaults to 10 years as it is currently the case. This is easy to implement, shouldn't harm anyone, but of course still reqeuires manual key rotation, but at least it may make auditors more happy because they immediately see that the key is not valid for 10 years.
Add further config options: Pre-activation period, Rotation period and Retirement period. If a key is generated it at first stays passive for the pre-activitation period, then it is rotated which means becomes active pre-activation period is over and at the same time the currently active key gets passive. A new passive key is automatically generated x number of days before the rotation period of the currently active key ends whereby x is the pre-activation period. A key that has been rotated from active to passive remains passive for the given retirement period. Afterwards it is deleted.
To implement 2. you could use the TimerSpi running once a day but the downside is that the exact rotation time cannot be determined or set. Just as an idea we could introduce a Quartz scheduler SPI to Keycloak (might also be usefull in other scenarios) such that we could also make the exact timing of the rotation configurable.
Last thing is a notification because clients or identity providers may need to take action if the realm key is going to be rotated. I implemented that as simple as just notifying all realm-admins but that ist probably not generally a good solution. But we could also just a Send Notification To field to the key provider in which case the email addresses given in this option would be used for notifying people about an upcoming or just happened key rotation. Alternatively (but way more complex) would be to add some kind of system admin events and event listeners.

What do you think?

Navigation Menu

Repository navigation

Automated Realm Key Rotation #42260

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Automated Realm Key Rotation #42260

Uh oh!

eicki Aug 31, 2025

Replies: 0 comments

eicki
Aug 31, 2025