Attempt to build an optimized keycloak for MariaDB fails #19047

dfitzpat9 · 2023-03-15T20:06:55Z

dfitzpat9
Mar 15, 2023

Attempting to build an optimized Keycloak 21.0.1 image for MariaDB, it fails with an "NSS initialization failed" message. We originally encountered this via our GitLab pipeline doing the build. I have reproduced this in a stand-alone setup outside of that though, with the same results. My stand-alone reproduction was using the exact call provided in the Keycloak documentation for building an optimized image (located here: https://www.keycloak.org/server/containers). This exact same process worked for versions up to the Keycloak version 20.0.5 container image.

This reproduction was done with CentOS Stream 8 (fully patched), using podman version 4.3.1.

Dockerfile:

FROM quay.io/keycloak/keycloak:21.0.1
RUN /opt/keycloak/bin/kc.sh build --db=mariadb

The build call & output we observe:

[kcadmin@dashboard keycloak]$ podman build . -t mykeycloak
STEP 1/2: FROM quay.io/keycloak/keycloak:21.0.1
STEP 2/2: RUN /opt/keycloak/bin/kc.sh build --db=mariadb
The DelayedHandler was closed before any children handlers were configured. Messages will be written to stderr.
2023-03-15 19:57:44,673 DEBUG [org.jboss.logging] (main) Logging Provider: org.jboss.logging.JBossLogManagerProvider

Exception in thread "main" java.lang.reflect.InvocationTargetException
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:61)
	at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:32)
Caused by: java.lang.ExceptionInInitializerError
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at java.base/java.lang.Class.getEnumConstantsShared(Class.java:3837)
	at java.base/java.lang.Class.getEnumConstants(Class.java:3812)
	at org.keycloak.config.OptionBuilder$2.<init>(OptionBuilder.java:92)
	at org.keycloak.config.OptionBuilder.expectedValues(OptionBuilder.java:91)
	at org.keycloak.config.OptionBuilder.<init>(OptionBuilder.java:51)
	at org.keycloak.config.FeatureOptions.<clinit>(FeatureOptions.java:12)
	at org.keycloak.quarkus.runtime.configuration.mappers.FeaturePropertyMappers.getMappers(FeaturePropertyMappers.java:25)
	at org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers.<clinit>(PropertyMappers.java:37)
	at org.keycloak.quarkus.runtime.cli.Picocli.addOptionsToCli(Picocli.java:401)
	at org.keycloak.quarkus.runtime.cli.Picocli.addCommandOptions(Picocli.java:377)
	at org.keycloak.quarkus.runtime.cli.Picocli.createCommandLine(Picocli.java:346)
	at org.keycloak.quarkus.runtime.cli.Picocli.parseAndRun(Picocli.java:85)
	at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:88)
	... 6 more
Caused by: java.security.ProviderException: Could not initialize NSS
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:284)
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:179)
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:153)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:569)
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:153)
	at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:257)
	at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:248)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
	at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:248)
	at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:226)
	at java.base/sun.security.jca.ProviderList.loadAll(ProviderList.java:317)
	at java.base/sun.security.jca.ProviderList.removeInvalid(ProviderList.java:334)
	at java.base/sun.security.jca.Providers.getFullProviderList(Providers.java:186)
	at java.base/java.security.Security.getProviders(Security.java:537)
	at java.security.jgss/sun.security.jgss.ProviderList.<init>(ProviderList.java:128)
	at java.security.jgss/sun.security.jgss.GSSManagerImpl.<init>(GSSManagerImpl.java:56)
	at java.security.jgss/org.ietf.jgss.GSSManager.getInstance(GSSManager.java:152)
	at org.keycloak.common.util.KerberosJdkProvider.isKerberosAvailable(KerberosJdkProvider.java:68)
	at org.keycloak.common.Profile$Feature.<clinit>(Profile.java:84)
	... 23 more
Caused by: java.io.IOException: NSS initialization failed
	at jdk.crypto.cryptoki/sun.security.pkcs11.Secmod.initialize(Secmod.java:243)
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:279)
	... 41 more
Error: building at STEP "RUN /opt/keycloak/bin/kc.sh build --db=mariadb": while running runtime: exit status 1

Has anyone else observed this? Or is there something different we should be doing?

dfitzpat9 · 2023-03-22T16:46:42Z

dfitzpat9
Mar 22, 2023
Author

Additional investigation & testing on this has revealed that FIPS being enabled is likely causing things to explode here. On a brand new test machine with virtually no configuration or additional measures taken, the build succeeds. Implementing some basic security configs (including enabling FIPS) reproduces the error noted above. Upon disabling FIPS and rebooting, then re-testing the build, it succeeded again.

0 replies

dfitzpat9 · 2023-03-23T10:35:40Z

dfitzpat9
Mar 23, 2023
Author

Modifying the build file to include --features=fips --fips-mode=strict didn't succeed. However, adding ENV JAVA_OPTS=-Dcom.redhat.fips=false did. When the java option was added, we were able to build with the FIPS features being both enabled and disabled.

Current Dockerfile:

FROM quay.io/keycloak/keycloak:21.0.1
ENV JAVA_OPTS=-Dcom.redhat.fips=false
RUN /opt/keycloak/bin/kc.sh build --db=mariadb

Build output:

[kcadmin@dashboard keycloak]$ podman build . -t mykeycloak
STEP 1/3: FROM quay.io/keycloak/keycloak:21.0.1
STEP 2/3: ENV JAVA_OPTS=-Dcom.redhat.fips=false
--> Using cache 592723469d0bd81c4ed96ae9b2f37388cc306ebf0e5c38372cb20b9ac10d60d0
--> 592723469d0
STEP 3/3: RUN /opt/keycloak/bin/kc.sh build --db=mariadb
JAVA_OPTS already set in environment; overriding default settings with values: -Dcom.redhat.fips=false
Updating the configuration and installing your custom providers, if any. Please wait.
2023-03-23 10:33:34,465 INFO  [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 4896ms
Server configuration updated and persisted. Run the following command to review the configuration:

	kc.sh show-config

COMMIT mykeycloak
--> 43bc480f922
Successfully tagged localhost/mykeycloak:latest
43bc480f922467c969ac95c1569d43e3cf96a1888f115da1decc9f4f2084b920

In short: it seems that building a production ready optimized image on a FIPS enabled system is broken unless one disables FIPS.

0 replies

Navigation Menu

Repository navigation

Attempt to build an optimized keycloak for MariaDB fails #19047

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Attempt to build an optimized keycloak for MariaDB fails #19047

Uh oh!

Uh oh!

dfitzpat9 Mar 15, 2023

Replies: 2 comments

Uh oh!

dfitzpat9 Mar 22, 2023 Author

Uh oh!

Uh oh!

dfitzpat9 Mar 23, 2023 Author

dfitzpat9
Mar 15, 2023

dfitzpat9
Mar 22, 2023
Author

dfitzpat9
Mar 23, 2023
Author