UNCLASSIFIED - NO CUI

Skip to content
Snippets Groups Projects
New look: Off

Keycloak: Spike/Research Quarkus Distro

    • Closed Issue created by Micah Nagel @micah.nagel

    Based on Keycloak's upstream release plan the Wildfly distribution will be EOL/removed in September or October. We should migrate off of the legacy images to the new Quarkus distribution before this point.

    Considerations:

    • Likely refactor of P1 plugin code required to work with the new version
    • Ensure persistence of users, clients, etc across the upgrade
    • Communicating with customers any breaking changes/required updates on their end

    Keycloak upstream has provided a short guide on the migration here although the considerations on our end will likely be more involved (P1 plugin specifically).

    Edited

    Designs

    Child items ...

    • Activity

    • Micah Nagel added keycloak teamXForce labels

      added keycloak teamXForce labels

    • Micah Nagel changed the description

      changed the description

    • Ryan Garcia added kindmaintenance label

      added kindmaintenance label

    • Ryan Garcia set weight to 5

      set weight to 5

    • Ryan Garcia added priority6 label

      added priority6 label

    • Ryan Garcia changed iteration to Big Bang Iterations Aug 9, 2022 - Aug 22, 2022

      changed iteration to Big Bang Iterations Aug 9, 2022 - Aug 22, 2022

    • Gabe Scarberry
      Gabe Scarberry @gabescarberry ·

      Just providing a data point to raise with cyber peeps.

      Quarkus doesn't currently support FIPS 140-2. Issue is open upstream / flagged for the next milestone v20.0.0 (my estimate is mid-Oct).

      v19.0.0 just came out (27 Jul 22) and major versions appear to be released every 2-3 months.

      Edited by Gabe Scarberry
    • kevin.wilder assigned to @kevin.wilder

      assigned to @kevin.wilder

    • kevin.wilder mentioned in issue #71 (closed)

      mentioned in issue #71 (closed)

    • kevin.wilder changed title from Keycloak: Update to Quarkus Distro to Keycloak: Spike/Research Quarkus Distro

      changed title from Keycloak: Update to Quarkus Distro to Keycloak: Spike/Research Quarkus Distro

    • kevin.wilder added statusdoing label

      added statusdoing label

    • kevin.wilder added Demo Candidate label

      added Demo Candidate label

    • kevin.wilder
      kevin.wilder @kevin.wilder ·
      Contributor

      keycloak/quarkus is integrated and working with BigBang (without plugin).

    • Ryan Garcia changed iteration to Big Bang Iterations Aug 23, 2022 - Sep 5, 2022

      changed iteration to Big Bang Iterations Aug 23, 2022 - Sep 5, 2022

    • Ryan Garcia changed milestone to %1.42.0

      changed milestone to %1.42.0

    • Lynn Still removed Demo Candidate label

      removed Demo Candidate label

      • kevin.wilder
        kevin.wilder @kevin.wilder ·
        Contributor

        Hitting x509 authentication flow bugs with 19.0.1. Target fix milestone 20.0.0.
        https://github.com/keycloak/keycloak/issues/13503
        https://github.com/keycloak/keycloak-ui/issues/3022

        2022-08-25 03:36:28,437 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-0) Uncaught server error: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize value of type `java.lang.String` from Object value (token `JsonToken.START_OBJECT`)
 at [Source: (io.quarkus.vertx.http.runtime.VertxInputStream); line: 1, column: 47] (through reference chain: org.keycloak.representations.idm.AuthenticatorConfigRepresentation["config"]->java.util.LinkedHashMap["x509-cert-auth"])
	at com.fasterxml.jackson.databind.exc.MismatchedInputException.from(MismatchedInputException.java:59)
	at com.fasterxml.jackson.databind.DeserializationContext.reportInputMismatch(DeserializationContext.java:1741)
	at com.fasterxml.jackson.databind.DeserializationContext.handleUnexpectedToken(DeserializationContext.java:1515)
	at com.fasterxml.jackson.databind.DeserializationContext.handleUnexpectedToken(DeserializationContext.java:1420)
	at com.fasterxml.jackson.databind.DeserializationContext.extractScalarFromObject(DeserializationContext.java:932)
	at com.fasterxml.jackson.databind.deser.std.StringDeserializer.deserialize(StringDeserializer.java:62)
	at com.fasterxml.jackson.databind.deser.std.StringDeserializer.deserialize(StringDeserializer.java:11)
	at com.fasterxml.jackson.databind.deser.std.MapDeserializer._readAndBindStringKeyMap(MapDeserializer.java:609)
	at com.fasterxml.jackson.databind.deser.std.MapDeserializer.deserialize(MapDeserializer.java:437)
	at com.fasterxml.jackson.databind.deser.std.MapDeserializer.deserialize(MapDeserializer.java:32)
	at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeAndSet(MethodProperty.java:129)
	at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:313)
	at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:176)
	at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:323)
	at com.fasterxml.jackson.databind.ObjectReader._bind(ObjectReader.java:2025)
	at com.fasterxml.jackson.databind.ObjectReader.readValue(ObjectReader.java:1175)
	at org.jboss.resteasy.plugins.providers.jackson.ResteasyJackson2Provider.readFrom(ResteasyJackson2Provider.java:193)
	at org.jboss.resteasy.core.interception.jaxrs.AbstractReaderInterceptorContext.readFrom(AbstractReaderInterceptorContext.java:101)
	at org.jboss.resteasy.core.interception.jaxrs.ServerReaderInterceptorContext.readFrom(ServerReaderInterceptorContext.java:63)
	at org.jboss.resteasy.core.interception.jaxrs.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:80)
	at org.jboss.resteasy.core.MessageBodyParameterInjector.inject(MessageBodyParameterInjector.java:213)
	at org.jboss.resteasy.core.MethodInjectorImpl.injectArguments(MethodInjectorImpl.java:95)
	at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:128)
	at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:660)
	at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:524)
	at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:474)
	at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
	at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:476)
	at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:434)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:192)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:152)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:183)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:152)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:183)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:141)
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:32)
	at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:492)
	at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:261)
	at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:161)
	at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
	at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
	at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
	at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
	at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:151)
	at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:82)
	at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:42)
	at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
	at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
	at io.vertx.ext.web.impl.RoutingContextWrapper.next(RoutingContextWrapper.java:201)
	at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:67)
	at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:55)
	at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
	at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
	at io.vertx.ext.web.impl.RoutingContextWrapper.next(RoutingContextWrapper.java:201)
	at io.quarkus.vertx.http.runtime.VertxHttpRecorder$5.handle(VertxHttpRecorder.java:380)
	at io.quarkus.vertx.http.runtime.VertxHttpRecorder$5.handle(VertxHttpRecorder.java:358)
	at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
	at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
	at io.vertx.ext.web.impl.RoutingContextWrapper.next(RoutingContextWrapper.java:201)
	at org.keycloak.quarkus.runtime.integration.web.QuarkusRequestFilter.lambda$createBlockingHandler$1(QuarkusRequestFilter.java:90)
	at io.vertx.core.impl.ContextImpl.lambda$null$0(ContextImpl.java:159)
	at io.vertx.core.impl.AbstractContext.dispatch(AbstractContext.java:100)
	at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$1(ContextImpl.java:157)
	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$13.runWith(VertxCoreRecorder.java:545)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:829
        Edited by kevin.wilder
      • kevin.wilder
        kevin.wilder @kevin.wilder ·
        Contributor

        x509 authentication might also be broken in Keycloak 18
        https://github.com/keycloak/keycloak/issues/12463

      • kevin.wilder
        kevin.wilder @kevin.wilder ·
        Contributor

        Found a way forward. Unblocking issue.

      • Please register or sign in to reply
    • kevin.wilder added statusblocked label and removed statusdoing label

      added statusblocked label and removed statusdoing label

    • kevin.wilder added statusdoing label and removed statusblocked label

      added statusdoing label and removed statusblocked label

    • kevin.wilder changed milestone to %1.43.0

      changed milestone to %1.43.0

    • kevin.wilder changed iteration to Big Bang Iterations Sep 6, 2022 - Sep 19, 2022

      changed iteration to Big Bang Iterations Sep 6, 2022 - Sep 19, 2022

    • kevin.wilder added Demo Candidate label

      added Demo Candidate label

    • kevin.wilder set weight to 6

      set weight to 6

    • kevin.wilder
      kevin.wilder @kevin.wilder ·
      Contributor

      Considering this research spike to be completed. Attached is the BigBang values proof-of-concept.
      keycloak-quarkus-plugin-4-x509-values.yaml

      The only item left to resolve is the P1 custom redirects. That will be a large level of effort. Might require developing a custom quarkus extension. Because there are no custom redirects one has to use the direct realm URIs
      https://keycloak.bigbang.dev/auth/realms/baby-yoda/account
      https://keycloak.bigbang.dev/auth/realms/baby-yoda/protocol/openid-connect/registrations?client_id=account&response_type=code
      https://keycloak.bigbang.dev/auth/realms/baby-yoda/protocol/openid-connect/auth?client_id=account&response_type=code

      Edited by kevin.wilder
    • kevin.wilder closed

      closed

    • Lynn Still removed Demo Candidate label

      removed Demo Candidate label

    Please register or sign in to reply

    UNCLASSIFIED - NO CUI