You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
FIPS mode on RHEL takes an abnormally long time to start.
#16982
I have been trying to run a Keycloak 20.0.3 docker on a FIPS-enabled RHEL VM. Turning on FIPS slows down keycloak to an incredible level. Look at the timestamps in the log below:
2023-01-27 14:12:58,997 DEBUG [org.keycloak.crypto.fips.FIPS1402Provider] (main) Inserted security providers: [BCFIPS, BCJSSE]
2023-01-27 14:12:58,997 DEBUG [org.keycloak.common.crypto.CryptoIntegration] (main) Using the crypto provider: org.keycloak.crypto.fips.FIPS1402Provider
2023-01-27 14:17:19,001 WARN [org.keycloak.common.Profile] (main) Experimental feature enabled: map_storage
2023-01-27 14:17:19,050 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: , Hostname: , Strict HTTPS: true, Path: , Strict BackChannel: false, Admin URL: , Admin: , Port: -1, Proxied: false
2023-01-27 14:17:19,063 WARN [org.keycloak.models.DeploymentStateProviderFactory] (main) Version seed for deployment state set with a random number. Caution: This can lead to unstable operations when serving resources from the cluster without a sticky loadbalancer or when restarting nodes. Set the 'storage-deployment-state-version-seed' option with a secret seed to ensure stable operations.
2023-01-27 14:37:38,464 TRACE [org.keycloak.common.crypto.CryptoIntegration] (main) Java security providers: [
KC(BCFIPS version 1.000203) version 1.0 - class org.keycloak.crypto.fips.KeycloakFipsSecurityProvider,
BCFIPS version 1.000203 - class org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider,
BCJSSE version 1.001202 - class org.bouncycastle.jsse.provider.BouncyCastleJsseProvider,
SunPKCS11-NSS-FIPS version 11 - class sun.security.pkcs11.SunPKCS11,
SUN version 11 - class sun.security.provider.Sun,
SunEC version 11 - class sun.security.ec.SunEC,
SunJSSE version 11 - class com.sun.net.ssl.internal.ssl.Provider,
]
2023-01-27 14:37:38,465 TRACE [org.keycloak.common.crypto.CryptoIntegration] (main) Security properties: [
Java security properties file: null
Default keystore type: PKCS11
keystore.type.compat: true
javax.net.ssl.trustStoreType: pkcs12
javax.net.ssl.trustStore: null
javax.net.ssl.trustStoreProvider: null
javax.net.ssl.keyStoreType: null
javax.net.ssl.keyStore: NONE
javax.net.ssl.keyStoreProvider: null
]
2023-01-27 14:37:39,483 WARN [org.keycloak.services.DefaultComponentFactoryProviderFactory] (main) No system-wide ClusterProviderFactory found. Cannot send messages across cluster, thus disabling caching of components. Consider setting cachingForced option in single-node deployment.
2023-01-27 14:37:39,484 INFO [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener
2023-01-27 23:05:59,399 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Initializing database schema. Using changelog META-INF/jpa-realms-changelog.xml
2023-01-28 03:18:08,885 INFO [org.keycloak.services] (main) KC-SERVICES0050: Initializing master realm
2023-01-28 09:52:50,352 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Updating database. Using changelog META-INF/jpa-roles-changelog.xml
2023-01-28 19:24:01,303 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Updating database. Using changelog META-INF/jpa-clients-changelog.xml
2023-01-29 05:10:51,770 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Updating database. Using changelog META-INF/jpa-client-scopes-changelog.xml
2023-01-29 21:17:38,760 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Updating database. Using changelog META-INF/jpa-users-changelog.xml
2023-01-31 03:22:21,228 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Updating database. Using changelog META-INF/jpa-authz-changelog.xml
2023-02-02 05:48:02,743 INFO [org.keycloak.models.map.storage.jpa.liquibase.updater.MapJpaLiquibaseUpdaterProvider] (main) Updating database. Using changelog META-INF/jpa-groups-changelog.xml
2023-02-02 08:55:19,271 INFO [org.keycloak.services] (main) KC-SERVICES0004: Imported realm movia from file /opt/keycloak/bin/../data/import/realm.json.
2023-02-02 08:56:21,263 WARN [io.vertx.core.impl.BlockedThreadChecker] (vertx-blocked-thread-checker) Thread Thread[vert.x-internal-blocking-0,5,main] has been blocked for 61914 ms, time limit is 60000 ms: io.vertx.core.VertxException: Thread blocked
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
I have been trying to run a Keycloak 20.0.3 docker on a FIPS-enabled RHEL VM. Turning on FIPS slows down keycloak to an incredible level. Look at the timestamps in the log below:
And here is my Dockerfile:
I believe this is the same issue as reported in #16376 .
Currently the only solution is to disable fips. Is there a workaround for this issue?
All reactions