+
Skip to content

Unable to configure TLS reloading in Keycloak version 26.2.0 or later #40790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 30, 2025

Conversation

mabartos
Copy link
Contributor

@mabartos mabartos commented Jun 30, 2025

Closes #40713

The -1 was propagated to the quarkus.management.ssl.certificate.reload-period property, which was not correct. The reload period for HTTP was not set, which is the correct way. This PR manages both properties behave the same.

@shawkins Could you please check it? Thanks!

@shawkins
Copy link
Contributor

For additional context, this was due to #32724 - for most mapFrom operations we were using a distinct input value, such that the general transformer did not apply. So the change created a separate mapFrom transformer. It also seemed more complicated to chain the transformations - apply mapFrom first, then the general one, so they were left separate.

An alternative to this change is to automatically use the parent transformer when it is present as the mapFrom transformer when it is not specified.

@shawkins
Copy link
Contributor

@mabartos there are two options to prevent the redundency in this situation - it will come up again if we have any other base property with a tranformation.

  1. Change

    var theMapper = parentValue ? this.parentMapper : this.mapper;
    to var theMapper = parentValue && this.parentMapper != null ? this.parentMapper : this.mapper; - that is if we don't specify a parentMapper, then fall through to the tranformer.

  2. Do cascading application of transforms - apply the parentMapper first, then apply the regular transform. While this is more logical, it wasn't desirable for specifying the cache config file - but ultimately won't currently make a difference.

Closes keycloak#40713

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
@mabartos
Copy link
Contributor Author

mabartos commented Jun 30, 2025

An alternative to this change is to automatically use the parent transformer when it is present as the mapFrom transformer when it is not specified.

@shawkins Thanks. Make sense to me to use the parent mapper if the mapFrom mapper is not specified. It seems to me it's not so invasive change, and we can backport it without risking the mapping will break apart.

Btw. we would need to have a diagram on how the transformation works for prop mappers soon 😄

@shawkins
Copy link
Contributor

Btw. we would need to have a diagram on how the transformation works for prop mappers soon 😄

Right, it's not always clear how the map from, transformer, and default play together.

Copy link
Contributor

@shawkins shawkins left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks @mabartos

Copy link
Contributor

@vmuzikar vmuzikar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The gist of the changes LGTM but relying on @shawkins' deeper review.

@vmuzikar vmuzikar merged commit 664827d into keycloak:main Jun 30, 2025
80 checks passed
shawkins added a commit to shawkins/keycloak that referenced this pull request Jul 1, 2025
…keycloak#40790)

Closes keycloak#40713

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
mabartos added a commit to mabartos/keycloak that referenced this pull request Jul 3, 2025
…keycloak#40790)

Closes keycloak#40713

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
(cherry picked from commit 664827d)
mabartos added a commit to mabartos/keycloak that referenced this pull request Jul 3, 2025
…keycloak#40790)

Closes keycloak#40713

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
(cherry picked from commit 664827d)
vmuzikar pushed a commit that referenced this pull request Jul 3, 2025
…#40790) (#40881)

Closes #40713



(cherry picked from commit 664827d)

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unable to configure TLS reloading in Keycloak version 26.2.0 or later
3 participants
点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载