Skip to content

Fix Keycloak devservice base URL #49843

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+14 −6
Open

Fix Keycloak devservice base URL #49843

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions .../keycloak/src/main/java/io/quarkus/devservices/keycloak/KeycloakDevServicesProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -550,14 +550,25 @@ protected void configure() {
}

if (fixedExposedPort.isPresent()) {
addFixedExposedPort(fixedExposedPort.getAsInt(), KEYCLOAK_PORT);
if (isHttps()) {
addFixedExposedPort(fixedExposedPort.getAsInt(), KEYCLOAK_HTTPS_PORT);
addExposedPort(KEYCLOAK_PORT);
} else {
addFixedExposedPort(fixedExposedPort.getAsInt(), KEYCLOAK_PORT);
}
if (useSharedNetwork) {
// expose random port for which we are able to ask Testcontainers for the actual mapped port at runtime
// as from the host's perspective Testcontainers actually expose container ports on random host port
addExposedPort(KEYCLOAK_PORT);
if (isHttps()) {
addExposedPort(KEYCLOAK_HTTPS_PORT);
}
}
} else {
addExposedPort(KEYCLOAK_PORT);
if (isHttps()) {
addExposedPort(KEYCLOAK_HTTPS_PORT);
}
}

if (sharedContainer && LaunchMode.current() == LaunchMode.DEVELOPMENT) {
Expand All @@ -578,9 +589,6 @@ protected void configure() {
}
withCommand(finalStartCommand);
addUpConfigResource();
if (isHttps()) {
addExposedPort(KEYCLOAK_HTTPS_PORT);
}
} else {
addEnv(KEYCLOAK_WILDFLY_USER_PROP, KEYCLOAK_ADMIN_USER);
addEnv(KEYCLOAK_WILDFLY_PASSWORD_PROP, KEYCLOAK_ADMIN_PASSWORD);
Expand Down
2 changes: 1 addition & 1 deletion ...sions/keycloak-admin-rest-client/deployment/src/test/resources/app-mtls-config.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Configure Dev Services for Keycloak
quarkus.keycloak.devservices.create-realm=false
quarkus.keycloak.devservices.port=8083
quarkus.keycloak.devservices.start-command=start --https-client-auth=required --hostname-strict=false --https-key-store-file=/etc/server-keystore.p12 --https-key-store-password=secret --truststore-paths=/etc/server-ca.crt --https-port=8080
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are fixing legit issue, thanks for that and yes, this test worked around that (and it wasn't hard to do 😀 ), but did you mention that Keycloak only exposes one port - HTTPS port? So why should be an issue to have --https-port=8080? Does it fail with it? If yes, it is a problem because it is unnecessary (KC only listens to one port).

So my question is, how often is it that users want to combine HTTPS port and HTTP port? I have vague memory that Keycloak team mentioned that they want to support that in the future, but I don't know if they already do and if so, let's wait for a feature request from someone that needs it.

My solution would be to determine port once and use it everywhere in the KeycloakDevServicesProcessor, it will be either HTTPS port or HTTP port. I think current state is too complicated, I spend last 20 minutes running this test and I can't tell you what is expected behavior....

Copy link
Contributor Author

@Eng-Fouad Eng-Fouad Sep 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am OK with using HTTPS only. If I remember correctly, when I used --https-port=8080, I faced a problem in integration testing as Keycloak devservice was starting with wrong KEYCLOAK_URL, something like http://keycloak-xxxxx:8080. I had to disable discovery of the OIDC endpoints (because all URLs were wrongly starting with http://) and I had to specify quarkus.oidc.jwks-path and quarkus.oidc.token-path manually.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[OPTIONAL] It would also be interesting to drop quarkus.keycloak.admin-client.server-url=https://localhost:${quarkus.keycloak.devservices.port} as it should be inferred automatically, so that we know it works.

quarkus.keycloak.devservices.start-command=start --https-client-auth=required --hostname-strict=false --https-key-store-file=/etc/server-keystore.p12 --https-key-store-password=secret --truststore-paths=/etc/server-ca.crt
# using PEM CA cert because generated PKCS12 server trust-store is encrypted, but KC requires no password for trust-store
quarkus.keycloak.devservices.resource-aliases.trust-store=server-ca.crt
quarkus.keycloak.devservices.resource-mappings.trust-store=/etc/server-ca.crt
Expand Down
2 changes: 1 addition & 1 deletion ...s/keycloak-admin-resteasy-client/deployment/src/test/resources/app-mtls-config.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Configure Dev Services for Keycloak
quarkus.keycloak.devservices.create-realm=false
quarkus.keycloak.devservices.port=8083
quarkus.keycloak.devservices.start-command=start --https-client-auth=required --hostname-strict=false --https-key-store-file=/etc/server-keystore.p12 --https-key-store-password=secret --truststore-paths=/etc/server-ca.crt --https-port=8080
quarkus.keycloak.devservices.start-command=start --https-client-auth=required --hostname-strict=false --https-key-store-file=/etc/server-keystore.p12 --https-key-store-password=secret --truststore-paths=/etc/server-ca.crt
# using PEM CA cert because generated PKCS12 server trust-store is encrypted, but KC requires no password for trust-store
quarkus.keycloak.devservices.resource-aliases.trust-store=server-ca.crt
quarkus.keycloak.devservices.resource-mappings.trust-store=/etc/server-ca.crt
Expand Down
Loading