Repository navigation
Record existing AES key sizes to prevent key regeneration - #54910
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues block approval of the migration intended to preserve existing AES keys.
No open issues 🎉
What changed in this PR
Addresses #54016 by recording existing AES key sizes during the 26.8.0 migration, preventing an unchanged Admin Console save from unintentionally rotating legacy keys.
Changes:
- Derives missing
secretSizevalues from stored AES secrets, preserving explicit sizes and skipping providers without secrets. - Adds integration coverage for key preservation, excluded providers, repeat migrations, and intentional rotation.
- Documents the migration behavior in the upgrade guide.
| File | Description |
|---|---|
tests/base/src/test/java/org/keycloak/tests/migration/GeneratedAesKeySizeMigrationTest.java |
Tests migration and subsequent provider saves through the Admin REST API. |
model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_8_0.java |
Persists missing AES key sizes through the realm model. |
docs/documentation/upgrading/topics/changes/changes-26_8_0.adoc |
Explains how migration preserves existing AES keys. |
Review effort: Balanced
973e206 to
0ef9d3c
Compare
0ef9d3c to
01b6685
Compare
01b6685 to
94dd7f5
Compare
|
|
||
| @Override | ||
| public void migrateRealm(KeycloakSession session, RealmModel realm) { | ||
| migrateGeneratedAesKeySizes(realm); |
There was a problem hiding this comment.
I second this comment. The 26.8.0 was already released, so people who already migrated to 26.8.0 will not migrate.
This migration logic should be rather added to the file for the upcoming release, which is MigrateTo26_8_3.java .
|
|
||
| @Override | ||
| public void migrateRealm(KeycloakSession session, RealmModel realm) { | ||
| migrateGeneratedAesKeySizes(realm); |
There was a problem hiding this comment.
I second this comment. The 26.8.0 was already released, so people who already migrated to 26.8.0 will not migrate.
This migration logic should be rather added to the file for the upcoming release, which is MigrateTo26_8_3.java .
| testMigrationTo25_0_0(); | ||
| testMigrationTo26_0_0(true); | ||
| testMigrationTo26_3_0(); | ||
| testMigrationTo26_8_0(migrationRunOnServer); |
There was a problem hiding this comment.
Should be different method. Either testMigrationTo26_8_3 or as part of the existing method testMigrationTo27_0_0 .
| // ------------------------ Notable changes ------------------------ // | ||
| == Notable changes | ||
|
|
||
| === Existing AES key sizes are recorded during migration |
There was a problem hiding this comment.
This is upgrading guide of already released version, so it does not work to add it here. In keycloak main, it should be rather added to changes-27_0_0.adoc .
Hint for the backport: once backporting this to the branch release/26.8, it would need to be changes-26_8_3.adoc inside that branch.
There was a problem hiding this comment.
@lhanusov One additional thing: If the file MigrateTo26_8_3 does not exists yet, it might be probably added to the rolling-upgrades-unsupported or rolling-upgrades-supported file (according to whether the change is safe for rolling upgrades or not...
@lhanusov Sorry for false alarm :-) The files |
94dd7f5 to
c4e7cb5
Compare
Closes keycloak#54016 Signed-off-by: choksi2212 <choksi2212@users.noreply.github.com> Signed-off-by: Lukas Hanusovsky <lhanusov@redhat.com>
c4e7cb5 to
44968ce
Compare
Closes #54016
Co-authored by: Codex noreply@openai.com