shawkins · Aug 26, 2026 · Aug 7, 2026 · Pepo48 · Aug 6, 2026 · shawkins
@@ -45,6 +45,10 @@ If you enabled it explicitly in a previous release, the `--features=http-optimiz
 
 If needed, you can disable it with `--features-disabled=http-optimized-serializers`.
 
+=== `show-config` will mask all SPI option values
+
+The `show-config` command will mask all SPI option values. The command is not currently aware of provider factory configuration property metadata, so it cannot determine if a property is marked as `isSecret`.
+
 === Redesigned identity provider buttons on the login page
 
 The social identity provider section on the login page has been redesigned with updated icons and layout.

@@ -123,8 +123,15 @@ protected void runCommand() {
     private void printProperty(String property, PropertyMapper<?> mapper, ConfigValue configValue) {
         String sourceName = configValue.getConfigSourceName();
         String value = configValue.getValue();
-
-        value = maskValue(value, sourceName, mapper);
+
+        if (property.startsWith(MicroProfileConfigProvider.SPI_PREFIX)) {
+            // could be marked as ProviderConfigProperty.isSecret, so the simplest option for now
+            // is to just mask all direct usage of spi options.
+            // the most straight-forward alternative is to move show-config to be run after the quarkus start
-            // the most straight-forward alternative is to move show-config to be run after the quarkus start
+        if (property.startsWith(MicroProfileConfigProvider.SPI_PREFIX)
+                || property.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + "spi.")) {
-            // the most straight-forward alternative is to move show-config to be run after the quarkus start
+        if (property.startsWith(MicroProfileConfigProvider.SPI_PREFIX)
+                || property.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + "spi.")) {
+            value = PropertyMappers.VALUE_MASK; 
+        } else {
+            value = maskValue(value, sourceName, mapper);
+        }
 
         spec.commandLine().getOut().printf("\t%s =  %s (%s)%n", property, value, KeycloakConfigSourceProvider.getConfigSourceDisplayName(sourceName));
     }

@@ -27,7 +27,9 @@
 
 import io.quarkus.runtime.configuration.ConfigUtils;
 import io.smallrye.config.ConfigValue;
+import io.smallrye.config.DotEnvConfigSourceProvider;
 import io.smallrye.config.SmallRyeConfig;
+import io.smallrye.config.SysPropConfigSource;
 
 import static org.keycloak.quarkus.runtime.cli.Picocli.ARG_PREFIX;
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
@@ -101,7 +103,14 @@ public static boolean isInitialized() {
 
     public static synchronized SmallRyeConfig getConfig() {
         if (config == null) {
-            config = ConfigUtils.emptyConfigBuilder().addDiscoveredSources().withCustomizers(new ConfigBuilderCustomizer()).build();
+            // we're manually adding the default sources to have control over the EnvConfigSource
+            config = ConfigUtils.emptyConfigBuilder().setAddDefaultSources(false).setAddPropertiesSources(true)
+                    .addDiscoveredSources()
+                    .withCustomizers(new ConfigBuilderCustomizer())
+                    .withSources(new SysPropConfigSource())
+                    .withSources(new DotEnvConfigSourceProvider()
+                            .getConfigSources(Thread.currentThread().getContextClassLoader()))
+                    .build();
         }
         return config;
     }

@@ -19,6 +19,7 @@
 
 import java.util.Collection;
 import java.util.HashMap;
+import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 
@@ -32,16 +33,16 @@
 
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
 
-import static io.smallrye.config.common.utils.StringUtil.replaceNonAlphanumericByUnderscores;
-
 // Not extending EnvConfigSource as it's too smart for our own good. It does unnecessary mapping of provided keys
 // leading to e.g. duplicate entries (like kc.db-password and kc.db.password), or incorrectly handling getters due to
 // how equals() is implemented. We don't need that here as we do our own mapping.
+// Instead an EnvConfigSource will be created for just the entries this logic is not concerned with 
 public class KcEnvConfigSource extends PropertiesConfigSource {
 
     public static final String NAME = "KcEnvVarConfigSource";
     public static final String KCKEY_PREFIX = "KCKEY_";
     public static final String KCRAW_PREFIX = "KCRAW_";
+    public static final String KC_PREFIX = "KC_";
 
     static final Map<String, String> ENV_OVERRIDE = new HashMap<String, String>();
 
@@ -50,14 +51,13 @@ public KcEnvConfigSource(Map<String, String> env) {
     }
 
     private static Map<String, String> buildProperties(Map<String, String> env) {
-        Map<String, String> properties = new HashMap<>();
-        String kcPrefix = replaceNonAlphanumericByUnderscores(NS_KEYCLOAK_PREFIX.toUpperCase());
+        Map<String, String> properties = new HashMap<>(env);
 
         for (Map.Entry<String, String> entry : env.entrySet()) {
             String key = entry.getKey();
             String value = entry.getValue();
 
-            if (!(key.startsWith(kcPrefix) || key.startsWith(KCRAW_PREFIX))) {
+            if (!(key.startsWith(KC_PREFIX) || key.startsWith(KCRAW_PREFIX))) {
                 continue;
             }
 
@@ -68,13 +68,13 @@ private static Map<String, String> buildProperties(Map<String, String> env) {
                 baseKey = key.substring(KCRAW_PREFIX.length());
 
                 // Fail fast if both KC_ and KCRAW_ are set for the same base key
-                if (env.containsKey(kcPrefix + baseKey)) {
+                if (env.containsKey(KC_PREFIX + baseKey)) {
                     throw new IllegalArgumentException(
-                            "Both " + kcPrefix + baseKey + " and " + KCRAW_PREFIX + baseKey
+                            "Both " + KC_PREFIX + baseKey + " and " + KCRAW_PREFIX + baseKey
                                     + " are set. Use only one.");
                 }
             } else {
-                baseKey = key.substring(kcPrefix.length());
+                baseKey = key.substring(KC_PREFIX.length());
             }
 
             // Resolve the transformed key
@@ -108,14 +108,21 @@ private static Map<String, String> buildProperties(Map<String, String> env) {
 
     public static Collection<ConfigSource> getConfigSources() {
         Map<String, String> env = System.getenv();
-
-        if (ENV_OVERRIDE.isEmpty()) {
-            return List.of(new KcEnvConfigSource(env));
-        }
-
         env = new HashMap<String, String>(env);
         env.putAll(ENV_OVERRIDE);
+
+        // create the quarkus env from anything not applicable to the KcEnvConfigSource
+        Map<String, String> filteredEnv = new HashMap<>();
+        for (Iterator<Map.Entry<String, String>> iterator = env.entrySet().iterator(); iterator.hasNext();) {
+            var entry = iterator.next();
+            String key = entry.getKey();
+            if (!key.startsWith(KC_PREFIX) && !key.startsWith(KCRAW_PREFIX) && !key.startsWith(KCKEY_PREFIX)) {
+                iterator.remove();
+                filteredEnv.put(key, entry.getValue());
+            }
+        }
+        EnvConfigSource quarkusEnv = new EnvConfigSource(filteredEnv, EnvConfigSource.ORDINAL);
 
-        return List.of(new KcEnvConfigSource(env), new EnvConfigSource(ENV_OVERRIDE, EnvConfigSource.ORDINAL + 1));
+        return List.of(new KcEnvConfigSource(env), quarkusEnv);
     }
 }
@@ -413,6 +413,26 @@ public void testShowConfigHidesSystemProperties() {
             assertThat(nonRunningPicocli.getOutString(), not(containsString("kc.something")));
         });
     }
+
+    @Test
+    public void testShowConfigCommandHidesSecondaryMappedVaultPassword() {
+        putEnvVar("KC_SPI_VAULT__KEYSTORE__PASS", "mapped-vault-secret");
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("show-config");
+        assertThat(nonRunningPicocli.getOutString(), not(containsString("mapped-vault-secret")));
+    }
+
+    @Test
+    public void testUnknownSpiOptionMasked() {
+        putEnvVar("KC_SPI_CUSTOM__ID__SECRET", "custom-secret");
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("show-config");
+        assertThat(nonRunningPicocli.getOutString(), not(containsString("custom-secret")));
+    }
+
+    @Test
+    public void testShowConfigCommandHidesSecondaryMappedVaultPasswordLegacyFormat() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("show-config", "--spi-vault-keystore-pass=mapped-vault-secret");
+        assertThat(nonRunningPicocli.getOutString(), not(containsString("mapped-vault-secret")));
+    }
 
     @Test
     public void testShowConfigDisplaysPrimaryValue() {