[madurangasiriwardena]

Purpose

Tenant keystores are generated with a hardcoded RSA-2048 key. Some deployments must use asymmetric keys with different size of bits. The primary keystore ([keystore.primary]) does not cover non-super tenants, so their keys cannot meet that requirement today.

This PR adds the configuration and one shared, validated API. carbon-multitenancy and carbon-identity-framework use it when they generate tenant keystores and tenant context keystores.

wso2/product-is#28544

Approach

• carbon.xml.j2: render KeyAlgorithm and KeySize under Security.TenantKeyStore when [keystore.tenant] key_algorithm and key_size are defined.
• default.json: default keystore.tenant.key_algorithm to RSA and keystore.tenant.key_size to 2048, next to keystore.tenant.type. Products that merge this file (product-is merges it as the base for its own default.json) get the defaults without changes.
• KeystoreUtils:
  • getTenantKeyAlgorithm() returns the configured algorithm. The default is RSA. Only RSA is supported. This method is the extension point for EC later.
  • getTenantKeySize() returns the configured size. The default is 2048. The value must be a multiple of 1024 between 2048 and 8192.
  • An invalid value throws CarbonException with a clear message. It never falls back to a smaller key.

Configuration:

[keystore.tenant]
type = "PKCS12"        # existing
key_algorithm = "RSA"  # new, optional
key_size = 3072        # new, optional

User stories

Summary of user stories addressed by this change>

Release note

Brief description of the new feature or bug fix as it will appear in the release notes

Documentation

Link(s) to product documentation that addresses the changes of this PR. If no doc impact, enter “N/A” plus brief explanation of why there’s no doc impact

Training

Link to the PR for changes to the training content in https://github.com/wso2/WSO2-Training, if applicable

Certification

Type “Sent” when you have provided new/updated certification questions, plus four answers for each question (correct answer highlighted in bold), based on this change. Certification questions/answers should be sent to certification@wso2.com and NOT pasted in this PR. If there is no impact on certification exams, type “N/A” and explain why.

Marketing

Link to drafts of marketing content that will describe and promote this feature, including product page changes, technical articles, blog posts, videos, etc., if applicable

Automation tests

• Unit tests

  Code coverage information

• Integration tests

  Details about the test cases and coverage

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes/no
• Ran FindSecurityBugs plugin and verified report? yes/no
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes/no

Samples

Provide high-level details about the samples related to this feature

Related PRs

List any other related PRs

Migrations (if applicable)

Describe migration steps and platforms on which migration has been tested

Test environment

List all JDK versions, operating systems, databases, and browser/versions on which this feature/fix was tested

Learning

Describe the research phase and any blog posts, patterns, libraries, or add-ons you used to solve the problem.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: wso2/carbon-kernel/.coderabbit.yml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 06625961-30e9-462e-887d-d23c41481374

📥 Commits

Reviewing files that changed from the base of the PR and between 0fc1375 and 9e1e09e.

📒 Files selected for processing (2)

• core/org.wso2.carbon.utils/src/main/java/org/wso2/carbon/utils/security/KeystoreUtils.java
• distribution/kernel/carbon-home/repository/resources/conf/default.json

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Tenant keystore settings now support configuring the key algorithm and key size. RSA is the default algorithm, and the default key size is 2048 bits.
  • Supported key sizes range from 2048 to 8192 bits in increments of 1024. Algorithm values are accepted regardless of capitalization or surrounding whitespace.
  • Unsupported algorithms and invalid key sizes produce clear configuration errors.

Walkthrough

Tenant keystore configuration now specifies an algorithm and key size. KeystoreUtils exposes getters that apply defaults and reject unsupported values. Tests cover default, valid, and invalid settings.

Changes

Tenant Keystore Key Settings

Layer / File(s)	Summary
Tenant keystore configuration distribution/kernel/carbon-home/repository/resources/conf/default.json, distribution/kernel/carbon-home/repository/resources/conf/templates/repository/conf/carbon.xml.j2	The default configuration sets the tenant keystore algorithm to RSA and size to 2048. The TenantKeyStore template conditionally emits the configured algorithm and size.
Key setting getters and tests core/org.wso2.carbon.utils/src/main/java/org/wso2/carbon/utils/security/KeystoreUtils.java, core/org.wso2.carbon.utils/src/test/java/org/wso2/carbon/utils/security/KeystoreUtilsTest.java	KeystoreUtils adds getters that default missing or blank settings and validate configured algorithms and key sizes. Tests cover accepted values and exceptions for invalid values.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 9e1e0

No demonstrated issue blocks merging. Confirm that both tenant keystore generators use the configured settings as part of normal integration validation.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 9e1e0

The new APIs preserve RSA-2048 defaults and reject unsupported algorithms and nonblank invalid sizes. No introduced security vulnerability was established. However, downstream key-generation integration and failure handling were not available to verify, so the change does not yet establish end-to-end enforcement.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — If downstream generators adopt these APIs, the server-level settings can govern new tenant keystores across the deployment, rather than a single request or tenant. Existing-key exposure is outside the documented scope, and actual downstream inheritance remains unverified.

Trust Boundaries and Controls

• observed — The inspected entrypoints accept no request or tenant input parameters; they consume server configuration and enforce an algorithm allowlist and bounded key sizes. No direct attacker-controlled input path or control bypass was established in these blocks. Authority over configuration and downstream callers is not fully traced.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and approach, includes configuration details, and links a related issue. However, most template sections remain as prompts or placeholders, including user stories,…	Complete the missing template sections. Add user stories, a release note, documentation links or an N/A explanation, training and marketing applicability, unit and integration test details, security-check results, samples, related PRs, migr…
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 2 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: configurable algorithm and key size for new tenant keystores.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the purpose and approach, includes configuration details, and links a related issue. However, most template sections remain as prompts or placeholders, including user stories, release note, documentation, automation test results, security checks, and test environment.

Resolution

Complete the missing template sections. Add user stories, a release note, documentation links or an N/A explanation, training and marketing applicability, unit and integration test details, security-check results, samples, related PRs, migration details or an N/A explanation, tested environments, and learning notes. Use N/A with a brief reason for sections that do not apply.

Full details: Docstring Coverage

Explanation

Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}