Uploaded image for project: 'Kogito'
  1. Kogito
  2. KOGITO-2274

Configure Kogito Components to disable SSL verifications using Keycloak Operator

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Major Major
    • 0.13.0
    • 0.10.1
    • Examples, Image
    • None
    • Hide

      Given Kogito Operator with Keycloak installed via KogitoInfra
      When I try to configure the Kogito example using the HTTPS route of Keycloak
      Then the example is failing because is unable to find a valid certificate

      Show
      Given Kogito Operator with Keycloak installed via KogitoInfra When I try to configure the Kogito example using the HTTPS route of Keycloak Then the example is failing because is unable to find a valid certificate
    • 2020 Week 25-27 (from Jun 15), 2020 Week 28-30 (from Jul 6)

      When I deploy the Kogito and Keycloak operators and then the KogitoInfra to create/configure the Keycloak instance:

      apiVersion: app.kiegroup.org/v1alpha1
kind: KogitoInfra
metadata:
  name: kogito-infra
  namespace: cucumber-nero
spec:
  installKeycloak: true

      Then, when I run the tests using process-usertasks-with-security-oidc-springboot and the deployed Keycloak instance, it fails because:

      2020-05-22 09:17:39.230  WARN 1 --- [0.0-8080-exec-4] o.keycloak.adapters.KeycloakDeployment   : Failed to load URLs from https://keycloak-cucumber-nero.apps.playground.rhba.openshift-aws.rhocf-dev.com/auth/realms/kogito/.well-known/openid-configuration

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[na:na]

      Note that this is an environmental issue where the SSL certification is not valid. However, I think we should provide the ability to workaround this: in order to make this worked, we need to disable the trust manager by adding these properties:

      • In Spring:
      keycloak.disable-trust-manager=true
      • In Quarkus:
      quarkus.oidc.tls.verification=none

            rhn-support-zanini Ricardo Zanini Fernandes
            jcarvaja@redhat.com Jose Carvajal Hilario
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: