Repository navigation
Conversation
…ders The ecdsa-generated and ecdh-generated key providers only generated the self-signed X.509 certificate lazily inside loadKey(), mutating only the in-memory ComponentModel. The certificate was never persisted to the component config, so every restart (or every cluster node sharing the same database) produced a new certificate for the same key pair, with a different serial number and validity period, and the x5c claim served via the JWKS endpoint changed. Generate and persist the certificate together with the key pair in AbstractGeneratedEcKeyProviderFactory.validateConfiguration(), matching the behaviour of the RSA-generated provider, so the certificate stays stable across restarts and across cluster nodes. Signed-off-by: waterWang <waterWang@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Persists self-signed certificates for generated EC key providers to keep JWKS certificate data stable.
Changes:
- Generates and stores EC certificates alongside new key pairs.
- Verifies ECDSA certificate persistence.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
AbstractGeneratedEcKeyProviderFactory.java |
Generates and persists EC certificates. |
GeneratedEcdsaKeyProviderTest.java |
Asserts certificate persistence. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+116
to
+119
| String generateCertificate = model.get(Attributes.EC_GENERATE_CERTIFICATE_KEY); | ||
| if (generateCertificate != null && Boolean.parseBoolean(generateCertificate)) { | ||
| generateCertificate(realm, model, keyPair); | ||
| } |
Contributor
|
Closing as the PR may require tests as well and/or fix existing tests, which seems to fail. Based on previous interaction with the user, the tests are unlikely to be added so closing PR directly (@waterWang Feel free to re-open PR or open a new PR if I am wrong here and you would like to continue on the PR). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Persist the self-signed X.509 certificate for
ecdsa-generated(andecdh-generated) key providers at creation time instead of generating a fresh one on every instantiation.Why
Closes #52093
For a key provider with
ecGenerateCertificate=true,GeneratedEcdsaKeyProvider.loadKey()generates the self-signed certificate on demand and only ever writes it into the in-memoryComponentModel(model.getConfig().put(...)). The component is never persisted afterwards, so:x5cclaim served via the JWKS endpoint depends on which node answers;COMPONENT_CONFIGnever contains acertificateentry.The
rsa-generatedprovider does not have this problem: key pair and certificate are generated together invalidateConfiguration()and persisted in the same transaction.How
AbstractGeneratedEcKeyProviderFactory.generateKeys()now also generates and stores the self-signed certificate (certificateconfig attribute) whenecGenerateCertificate=true, mirroringAbstractGeneratedRsaKeyProviderFactory.generateKeys()/generateCertificate().loadKey()keeps its lazy fallback so existing components created before this fix (key pair present, certificate absent) keep working.GeneratedEcdsaKeyProviderTestnow asserts the certificate is persisted in the component config.Tests
GeneratedEcdsaKeyProviderTest(config size 3 -> 4 whenecGenerateCertificate=true, plusCERTIFICATE_KEYpersistence assertion).