Issue integrating Kafka UI with Keycloak using self-signed certificates

[gble6141]

Issue submitter TODO list

• I've looked up my issue in FAQ
• I've searched for an already existing issues here
• I've tried running main-labeled docker image and the issue still persists there
• I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

I am trying to integrate Kafka UI with Keycloak. In Keycloak, I am using self-signed certificates, and I'm encountering issues when running Kafka UI.

Problem:
When I run Kafka UI without configuring the certificates properly, I get the following error:

2024-09-12 13:44:03,658 INFO [main] i.k.u.KafkaUiApplication: Starting KafkaUiApplication using Java 17.0.11 with PID 1 (/api.jar started by kafkaui in /)
...
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://keycloak-kafka-ui-test.com/auth/realms/infra/.well-known/openid-configuration": PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

It appears that the self-signed certificates from Keycloak are not recognized, causing the SSL handshake to fail.

Question:
How can I configure Kafka UI to properly trust and use the self-signed certificates from Keycloak to resolve this issue?

Any help would be greatly appreciated!

Expected behavior

No response

Your installation details

Chart Version: v0.7.6

Steps to reproduce

yamlApplicationConfig:
kafka:
clusters:
- name: kafka-test
bootstrapServers: kafka-test-kafka-bootstrap:9092
properties:
sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="kafka-test-super-user" password="";
sasl.mechanism: SCRAM-SHA-256
security.protocol: SASL_PLAINTEXT
auth:
type: OAUTH2
oauth2:
client:
keycloak:
client-name: keycloak
clientId: kafka-ui
clientSecret:
custom-params:
type: keycloak
issuer-uri: https://keycloak-kafka-ui-test.com/auth/realms/infra
provider: keycloak
scope: openid
user-name-attribute: preferred_username
management:
health:
ldap:
enabled: false
rbac:
enabled: true
roles:
- name: "admins"
clusters:
- kafka-test
subjects:
- provider: oauth
type: role
value: "Admin"
permissions:
- resource: applicationconfig
actions: ["view", "edit", "create", "delete"]

    - resource: clusterconfig
      actions: ["view", "edit", "create", "delete"]

    - resource: topic
      value: ".*"
      actions: ["view", "edit", "create", "delete"]

    - resource: consumer
      value: ".*"
      actions: ["view", "edit", "create", "delete"]

    - resource: schema
      value: ".*"
      actions: ["view", "edit", "create", "delete"]

    - resource: connect
      value: ".*"
      actions: ["view", "edit", "create", "delete"]

    - resource: ksql
      actions: ["view", "edit", "create", "delete"]
- name: "readonly"
  clusters:
    - kafka-test
  subjects:
    - provider: oauth
      type: role
      value: "Viewer"

Screenshots

No response

Logs

No response

Additional context

No response

[github-actions[bot]]

Hi gble6141! 👋

Welcome, and thank you for opening your first issue in the repo!

Please wait for triaging by our maintainers.

As development is carried out in our spare time, you can support us by sponsoring our activities or even funding the development of specific issues.
Sponsorship link

If you plan to raise a PR for this issue, please take a look at our contributing guide.

[Haarolean]

Hi, this should work:

server:
  ssl:
    trust-store: classpath:keycloak-truststore.jks
    trust-store-password: changeit

[gble6141]

I built a Docker image and placed the keystore.jks file in the /etc/keystore directory. Here is my Dockerfile:

COPY keystore.jks /etc/keystore/keystore.jks

When I deploy the minimal configuration and inspect the container, I can see the file:

/etc/keystore $ ls
keystore.jks

However, when I run the following configuration:

yamlApplicationConfig:
  auth:
    oauth2:
      client:
        keycloak:
          client-name: keycloak
          clientId: kafka-ui
          clientSecret:
          custom-params:
            type: keycloak
          issuer-uri:
          provider: keycloak
          scope: openid
          user-name-attribute: preferred_username
    type: OAUTH2
  server:
    ssl:
      trust-store: /etc/keystore/keystore.jks
      trust-store-password: kafka-ui

I encounter the same error.

I then checked my jks file using the following command:

keytool -list -v -keystore keystore.jks -storepass kafka-ui

This was the output:

Keystore type: PKCS12
Keystore provider: 

Alias name: keycloak
Creation date:
Entry type: trustedCertEntry

Owner:
Issuer:
Valid from:
Certificate fingerprints:
Signature algorithm name:
Subject Public Key Algorithm:
Version: 3

Extensions:

It seems that everything is fine with the keystore.jks. Could you help me figure out what might be the issue?

[gble6141]

Thanks, I found the problem. Your answer helped me a lot