Unable to find tls configuration of name

[GregJohnStewart]

Hey guys, I'm sure this is on my end, but I am stumped.

Trying to get my OIDC client to trust a keycloak server running with a self-signed cert (more specifically the ingress cert on OCP, which is essentially self-signed for this exercise).

I set the quarkus.tls.ocpIngress.trust-store.pem.certs.0 to /path/to/cert.pem, and the oidc config: quarkus.oidc.tls.tls-configuration-name to ocpIngress

However, I'm getting an error simply stating "Unable to find tls configuration of name ocpIngress". I'll note that this is the only error that appears, no other configuration warnings. Thoughts?

That is the only tls configuration I am setting, and the only other oidc config I'm setting:

• quarkus.oidc.client-id
• quarkus.oidc.credentials.secret
• quarkus.oidc.authentication.cookie-path and cookie-suffix

[quarkus-bot[bot]]

/cc @radcortez (config)

[GregJohnStewart]

3.28.5, and set these via environment var

[sberyozkin]

@GregJohnStewart Have a look at https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-mtls/src/main/resources/application.properties, there the test depends on the matching TLS registry entry.

Perhaps there is no match between quarkus.tls.ocpIngress.trust-store.pem.certs.0 and the env var that you use. Can you provide more details ? What happens if you hardcode quarkus.tls.ocpIngress.trust-store.pem.certs.0=/path/to/cert.pem in application.properties ?

[GregJohnStewart]

I'm giving the hardcoding a shot, but I'm fairly certain I have the cert config right, I'm not getting messages stating config was ignored (as I was when I was figuring out the correct config)...

Interesting, the hardcoded config takes and the service passes that check on startup. I will note that I'm using yaml config, so it's easier to plainly see that my config is as it should be. I wonder if there is an issue with how I am specifying the index of my entry in the array of certs?

[GregJohnStewart]

Yep that was it, properties / env var lists want just a csv, not the direct index.

Bad:

quarkus.tls.ocpIngress.trust-store.pem.certs.0=/my/cert.pem

Good:

quarkus.tls.ocpIngress.trust-store.pem.certs=/my/cert.pem[,/my/othercert.pem]

[sberyozkin]

@GregJohnStewart Great that you have figured it out