Skip to content

Conversation

@Thendo20
Copy link
Collaborator

@Thendo20 Thendo20 commented Oct 10, 2025

What this PR does / why we need it:

This PR adds support for X.509 certificate-based client authentication to keycloak-config-cli. Users can now authenticate to Keycloak using mutual TLS (mTLS) with client certificates instead of only username/password or client credentials (client_id/client_secret).

Key Features:

  • New RestClientX509TokenManager for managing token acquisition via certificate authentication
  • Configuration support for keystore and truststore with certificate credentials
  • Automatic SSL context configuration for client certificate authentication

Use Cases:

  • Enhanced security in production environments requiring certificate-based authentication
  • Compliance with security policies mandating mTLS
  • Integration with PKI infrastructure
  • Zero-trust security models

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #959

Special notes for your reviewer:

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

  • the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR

@Thendo20 Thendo20 added enhancement java Pull requests that update Java code labels Oct 10, 2025
@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support for x509 authentication

2 participants