Keycloak: Outbound SSL Connection in SPI - keycloak

Question

I am implementing a custom OIDC Protocol Mapper for Keycloak 4.x. Within I have to make a https connection, which currently fails because I do not have a truststore configured on my http connection.
I have added a truststore SPI to my standalone.xml (as described here https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore):
<spi name="truststore">
<provider name="file" enabled="true">
<properties>
<property name="file" value="${jboss.server.config.dir}/nak.test.jks"/>
<property name="password" value="****"/>
<property name="hostname-verification-policy" value="WILDCARD"/>
<property name="disabled" value="false"/>
</properties>
</provider>
</spi>
But I do not know how to get a HttpClient instance which uses this truststore. I have tried with:
org.apache.http.client.HttpClient httpClient = new org.keycloak.connections.httpclient.HttpClientBuilder().build();
and
DefaultHttpClientFactory factory = new DefaultHttpClientFactory();
HttpClientProvider httpClientProvider = factory.create((KeycloakSession)session);
return httpClientProvider.getHttpClient();
whereas the first just does not have the truststore configured, and the second fails with a NPE.
So how do I get an outbound http connection which uses my truststore SPI?

Answer 1

See https://lists.jboss.org/pipermail/keycloak-user/2018-July/014878.html
I implemented as follows, which uses the Truststore SPI of Keycloak:
private org.apache.http.client.HttpClient getConnection(org.keycloak.models.KeycloakSession session) {
org.keycloak.connections.httpclient.HttpClientProvider cp = session.getProvider(org.keycloak.connections.httpclient.HttpClientProvider.class);
HttpClient httpClient = cp.getHttpClient();
return httpClient;
}