{"record":{"id":"5e282627a765e646","repo":"apereo/cas","slug":"keystore-file-password-or-alias-assigned-to-the-r","errorCode":null,"errorMessage":"Keystore file, password or alias assigned to the realm are undefined","messagePattern":"Keystore file, password or alias assigned to the realm are undefined","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-sts/src/main/java/org/apereo/cas/config/CoreWsSecuritySecurityTokenServiceConfiguration.java","lineNumber":239,"sourceCode":"                casProperties.getServer().getPrefix(), hostnameVerifier, casSslContext);\n        }\n    }\n\n    @Configuration(value = \"CoreWsSecuritySecurityTokenServiceRealmsConfiguration\", proxyBeanMethods = false)\n    @EnableConfigurationProperties(CasConfigurationProperties.class)\n    static class CoreWsSecuritySecurityTokenServiceRealmsConfiguration {\n        @ConditionalOnMissingBean(name = \"casRealm\")\n        @Bean\n        public RealmProperties casRealm(final CasConfigurationProperties casProperties) {\n            val wsfed = casProperties.getAuthn().getWsfedIdp().getSts();\n            val realmConfig = wsfed.getRealm();\n            val realm = new RealmProperties();\n            realm.setIssuer(StringUtils.defaultIfBlank(realmConfig.getIssuer(), casProperties.getServer().getPrefix()));\n            if (StringUtils.isBlank(realmConfig.getKeystoreFile())\n                || StringUtils.isBlank(realmConfig.getKeystorePassword())\n                || StringUtils.isBlank(realmConfig.getKeyPassword())\n                || StringUtils.isBlank(realmConfig.getKeystoreAlias())) {\n                LOGGER.warn(\"Keystore file, password or alias assigned to the realm are undefined\");\n            } else {\n                val properties = CryptoUtils.getSecurityProperties(realmConfig.getKeystoreFile(), realmConfig.getKeystorePassword(), realmConfig.getKeystoreAlias());\n                realm.setSignatureCryptoProperties(properties);\n                realm.setCallbackHandler(new RealmPasswordVerificationCallbackHandler(realmConfig.getKeyPassword().toCharArray()));\n            }\n            return realm;\n        }\n\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @Bean\n        @ConditionalOnMissingBean(name = \"securityTokenServiceRealms\")\n        public Map<String, RealmProperties> securityTokenServiceRealms(\n            final CasConfigurationProperties casProperties,\n            @Qualifier(\"casRealm\") final RealmProperties casRealm) {\n            val idp = casProperties.getAuthn().getWsfedIdp().getIdp();\n            val realms = new HashMap<String, RealmProperties>();\n            realms.put(idp.getRealmName(), casRealm);\n            return realms;","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-sts/src/main/java/org/apereo/cas/config/CoreWsSecuritySecurityTokenServiceConfiguration.java#L221-L257","documentation":"CoreWsSecuritySecurityTokenServiceConfiguration.casRealm builds a RealmProperties for the STS. If keystoreFile, keystorePassword, keyPassword, or keystoreAlias is blank for the realm configuration it logs this warning and skips assigning signature crypto properties and the callback handler, leaving the realm without signing capability.","triggerScenarios":"cas.authn.ws-sts.realm.* configuration lacks any of keystore-file, keystore-password, key-password, or keystore-alias.","commonSituations":"Keystore path typo or file not mounted in container; secrets injected as empty env vars; only partial realm config copied from another environment; alias wrong so developer removed it.","solutions":["Set all four properties: keystoreFile, keystorePassword, keyPassword, keystoreAlias for each configured realm.","Verify the keystore file exists at the configured path and is readable by the CAS process.","Check env var/secret injection isn't producing empty strings for these values.","After fixing, confirm the realm logs signature crypto setup instead of the warning."],"exampleFix":"// before\ncas.authn.ws-sts.realm[0].keystore-file=\n// after\ncas.authn.ws-sts.realm[0].keystore-file=/etc/cas/sts-keystore.jks\ncas.authn.ws-sts.realm[0].keystore-password=changeit\ncas.authn.ws-sts.realm[0].key-password=changeit\ncas.authn.ws-sts.realm[0].keystore-alias=sts","handlingStrategy":"validation","validationCode":"var rc = casProperties.getAuthn().getWsSts().getRealm();\nif (StringUtils.isBlank(rc.getKeystoreFile()) || StringUtils.isBlank(rc.getKeystorePassword())\n    || StringUtils.isBlank(rc.getKeyPassword()) || StringUtils.isBlank(rc.getKeystoreAlias())) {\n    throw new IllegalStateException(\"WS-STS realm keystore settings incomplete\");\n}\nif (!new File(rc.getKeystoreFile()).canRead()) {\n    throw new IllegalStateException(\"Keystore not readable: \" + rc.getKeystoreFile());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast at startup with a config validation check for all four keystore properties.","Verify secrets injection yields non-empty values in each environment.","Check keystore file permissions for the CAS service user."],"tags":["sts","keystore","configuration","crypto"],"backgroundTag":"missing-required-config-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}