Don't use ENV parameters in spring-security-oauth/oauth-rest/oauth-authorization-server for keycloak-server.json

[Dimantchick]

Find problem. keycloak-server.json don't use ENV vars.
Find solution
Dimantchick@7ea1e38
Fix please

[ulisseslima]

Hey, @Dimantchick.

Could you elaborate on what is the issue?

Also, please include a link to the article you were following so we can take a look.

[Dimantchick]

@ulisseslima
To view bug, open keycloak-server.json, found "url": "${keycloak.connectionsJpa.url:jdbc:h2:mem:test;DB_CLOSE_DELAY=-1}",
Set ENV var keycloak.connectionsJpa.url on start to other value (sample jdbc:h2:mem:test_changed;DB_CLOSE_DELAY=-1) and run server.
You can see in log:

DefaultJpaConnectionProviderFactory : Database info: {databaseUrl=jdbc:h2:mem:test, databaseUser=SA, databaseProduct=H2 2.1.214 (2022-06-13), databaseDriver=H2 JDBC Driver 2.1.214 (2022-06-13)}

Now I search more and found root cause:
In JsonConfigProviderFactory
protected Properties getProperties() { return new SystemEnvProperties(); }
SystemEnvProperties
`public String getProperty(String key) {

    if (this.overrides.containsKey(key)) {

        return (String)this.overrides.get(key);

    } else {

        return key.startsWith("env.") ? (String)System.getenv().get(key.substring(4)) : System.getProperty(key);

    }

}`

Keycloak using env vars to config only if they starts vith env.
For example other solution it change keycloak-server.json, adding all vars 'env.', like ""url": "${env.keycloak.connectionsJpa.url:jdbc:h2:mem:test;DB_CLOSE_DELAY=-1}"", but in environment use 'keycloak.connectionsJpa.url=jdbc:h2:mem:test_changed;DB_CLOSE_DELAY=-1'.

[Dimantchick]

Additional.
In my solution i ovveride method to use other constructor
public SystemEnvProperties(Map<String, String> overrides)
It adds override values for env vars.
See org.keycloak.common.util.SystemEnvProperties#getProperty(java.lang.String) line 41, 42

[ulisseslima]

Hey, @Dimantchick.

Thanks for the feedback. I'm assuming you were following this article: https://www.baeldung.com/keycloak-embedded-in-spring-boot-app

We'll look into this. This issue will remain open until then.

[Dimantchick]

Yes. Find this repo from it article.

[kasramp]

The article is updated to reflect that the default Keycloack behavior does not allow to overwrite values via environment variable unless the key starts with env.*. Additionally, added a small example of how it can be achieved.