Support self signed certificates from keycloak in vertx
MODIFY
distro/vertx/src/main/resources/overlay/configs/conf-es.json
distro/vertx/src/main/resources/overlay/configs/conf-es.json
"realm-public-key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxyG61ohrfJQKNmDA/ePZtqZVpPXjwn3k3T+iWiTvMsxW2+WlnqIEmL5qZ09DMhBH9r50WZRO2gVoCb657Er9x0vfD6GNf/47XU2y33TX8axhP+hSwkv/VViaDlu4jQrfgPWz/FXMjWIZxg1xQS+nOBF2ScCRYWNQ/ZnUNnvrq8dGC2/AlyeYcgDUOdwlJuvgkGlF0QoVPQiRPurR3RwlG+BjL8JB3hbaAZhdJqwqApmGQbcpgLj2tODnlrZnEAp5cPPU/lgqCE1OOp78BAEiE91ZLPl/+D8qDHk+Maz0Io3bkeRZMXPpvtbL3qN+3GlF8Yz264HDSsTNrH+nd19tFQIDAQAB",
"auth-server-url": "http://localhost:8080/auth",
"ssl-required": "none",
+ "disable-trust-manager": false,
+ "allow-any-hostname" : false,
"resource": "apiman-gateway-api",
// A limitation in the current OAuth2 implementation means a credentials section is required
// even if your client is not set to "confidential". Leave this dummy section if you're using non-confidential.
"credentials": {
"secret": "217b725d-7790-47a7-a3fc-5cf31f92a8db"
- }
+ },
+ "truststore": "/usr/src/apiman/apiman-distro-vertx/apiman.jks",
+ "truststore-password": "secret"
+ // "client-keystore": "/usr/src/apiman/apiman-distro-vertx/apiman.jks",
+ // "client-keystore-password": "secret"
// End paste here
}
},

MODIFY
gateway/platforms/vertx3/vertx3/src/main/java/io/apiman/gateway/platforms/vertx3/api/auth/KeycloakOAuthFactory.java
gateway/platforms/vertx3/vertx3/src/main/java/io/apiman/gateway/platforms/vertx3/api/auth/KeycloakOAuthFactory.java
@@ -20,9 +20,11 @@ import io.apiman.common.util.Basic;
import io.apiman.gateway.platforms.vertx3.common.config.VertxEngineConfig;
import io.apiman.gateway.platforms.vertx3.verticles.ApiVerticle;
import io.vertx.core.Vertx;
+import io.vertx.core.http.HttpClientOptions;
import io.vertx.core.json.JsonObject;
import io.vertx.core.logging.Logger;
import io.vertx.core.logging.LoggerFactory;
+import io.vertx.core.net.JksOptions;
import io.vertx.ext.auth.oauth2.AccessToken;
import io.vertx.ext.auth.oauth2.OAuth2Auth;
import io.vertx.ext.auth.oauth2.OAuth2FlowType;
@@ -38,6 +40,7 @@ import java.util.Objects;
import java.util.Optional;
import java.util.Set;
+import org.apache.commons.lang3.BooleanUtils;
import org.apache.commons.lang3.EnumUtils;
/**
@@ -92,7 +95,9 @@ public class KeycloakOAuthFactory {
.put("username", username)
.put("password", password);
- OAuth2Auth oauth2 = KeycloakAuth.create(vertx, flowType, authConfig);
+ HttpClientOptions sslOptions = getHttpClientOptionsForKeycloak(authConfig);
+
+ OAuth2Auth oauth2 = KeycloakAuth.create(vertx, flowType, authConfig, sslOptions);
oauth2.getToken(params, tokenResult -> {
if (tokenResult.succeeded()) {
log.debug("OAuth2 Keycloak exchange succeeded.");
@@ -143,8 +148,42 @@ public class KeycloakOAuthFactory {
};
}
+ private static HttpClientOptions getHttpClientOptionsForKeycloak(JsonObject config) {
+ HttpClientOptions options = new HttpClientOptions();
+
+ if (config.containsKey("ssl-required")) {
+ if (!config.getString("ssl-required").toLowerCase().equals("none")) {
+ options.setSsl(true);
+ }
+ }
+
+ if (config.containsKey("allow-any-hostname")) {
+ Object value = config.getValue("allow-any-hostname");
+ if (value.equals(true) || value.equals("true")) {
+ options.setVerifyHost(false);
+ }
+ }
+
+ if (config.containsKey("disable-trust-manager")) {
+ Object value = config.getValue("disable-trust-manager");
+ if (value.equals(true) || value.equals("true")) {
+ options.setTrustAll(true);
+ }
+ }
+
+ if (config.containsKey("truststore") && config.containsKey("truststore-password")) {
+ options.setTrustStoreOptions(new JksOptions().setPath(config.getString("truststore")).setPassword(
+ config.getString("truststore-password")));
+ }
+
+ if (config.containsKey("client-keystore") && config.containsKey("client-keystore-password")) {
+ options.setTrustStoreOptions(new JksOptions().setPath(config.getString("client-keystore")).setPassword(
+ config.getString("client-keystore-password")));
+ }
+ return options;
+ }
+
private static OAuth2FlowType toEnum(String flowType) {
return EnumUtils.getEnum(OAuth2FlowType.class, flowType.toUpperCase());
}
-
}

APIMAN-1339: Support self signed certificates from keycloak in vertx (#706)