Replies: 12 comments 9 replies
-
|
I second this ;) |
Beta Was this translation helpful? Give feedback.
-
|
@dasniko @omasseau there is no such possibility in Keycloak 17.0.0 related issue #10216 |
Beta Was this translation helpful? Give feedback.
-
|
This is a crutual feature when providing a software package for a customer. Please migrate this from the old wildfly distribution. |
Beta Was this translation helpful? Give feedback.
-
|
Specifically, I'd like to know the replacement for these startup configs -Dkeycloak.migration.action=import \
-Dkeycloak.migration.provider=singleFile \
-Dkeycloak.migration.file=/opt/jboss/keycloak/default_realm.json \
-Dkeycloak.migration.strategy=OVERWRITE_EXISTING |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
done, works for me |
Beta Was this translation helpful? Give feedback.
-
|
Here's an example service from a docker-compose that loads an import successfully. keycloak:
image: quay.io/keycloak/keycloak:17.0.0
environment:
- KEYCLOAK_LOGLEVEL=DEBUG
- KEYCLOAK_ADMIN=admin
- KEYCLOAK_ADMIN_PASSWORD=admin
- KEYCLOAK_IMPORT=/tmp/keycloak/config/default_realm.json
entrypoint: /tmp/keycloak/config/docker-compose-entrypoint.sh --hostname host.docker.internal:8080
ports:
- "8080:8080"
volumes:
- ./keycloak:/tmp/keycloak/configEDIT: added the below, thanks @MetroMarv for catching this! This set up has a #!/bin/bash
IMPORT_FLAG_FILE=/opt/keycloak/imported.flag
if [[ -z "${KEYCLOAK_IMPORT}" ]]; then
echo "Skipping Import (KEYCLOAK_IMPORT not used)"
else
if test -f "$IMPORT_FLAG_FILE"; then
echo "Skipping Import (already imported)"
else
echo "Import initial config: $KEYCLOAK_IMPORT)"
/opt/keycloak/bin/kc.sh import --file "$KEYCLOAK_IMPORT"
touch "$IMPORT_FLAG_FILE"
fi
fi
echo "Starting Keycloak ... "
/opt/keycloak/bin/kc.sh "$@" |
Beta Was this translation helpful? Give feedback.
-
|
Hey @jwsy, |
Beta Was this translation helpful? Give feedback.
-
|
Whoops, forgot to include it in my post. I got it from another issue and will update my earlier post #10216 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
Actually now made the import work too with the following script: #!/bin/sh
/opt/keycloak/bin/kc.sh start-dev \
-Dkeycloak.migration.action=import \
-Dkeycloak.migration.provider=dir \
-Dkeycloak.migration.dir=<Your directory to import> \
-Dkeycloak.migration.strategy=<Your Strategy>
/opt/keycloak/bin/kc.sh start-devThe script is based on the insights of bug ticket #10322. |
Beta Was this translation helpful? Give feedback.
-
|
@jwsy I tried your tips and got the following error: It looks like it does not work when a DB is used because the DB driver is not "initialized" |
Beta Was this translation helpful? Give feedback.
-
|
What did your docker-compose look like? The KC service in my toy example used the default file-based DB and you likely need to specify that info |
Beta Was this translation helpful? Give feedback.
-
Same issue for me with Mariadb |
Beta Was this translation helpful? Give feedback.
-
|
@jwsy : here it is: |
Beta Was this translation helpful? Give feedback.
-
|
Looks like you're having this issue: #10722 I don't know, looks like you're doing everything right and setting the env
|
Beta Was this translation helpful? Give feedback.
-
|
@jwsy : not possible: |
Beta Was this translation helpful? Give feedback.
-
|
I really want to get this working too. I've copied over the Logs do state: But when I log into keycloak, my realm is not there. I'm guessing it cannot connect to my database, and the imported realm is lost when it starts the second instance. The last line in the entrypoint is Is there any way to use these args for Any guidance would be amazing. |
Beta Was this translation helpful? Give feedback.
-
|
Hi all, thanks for your scripts and files. I've managed to import an exported realm at the initial startup with the help of @jwsy and @semangard :-) The important thing is to include the jdbc postgres driver in the .Dockerfile to build a customer Keycloak Docker image. Disclaimer:
Docker Compose: version: '3.4'
#### DOCS ####
# https://github.com/eabykov/keycloak-compose/blob/main/docker-compose.yml
# https://blog.codecentric.de/en/2021/12/keycloak-keycloak-x/
# https://github.com/keycloak/keycloak/discussions/10229#discussioncomment-2422564
##############
services:
postgres:
container_name: keycloak17-db
image: postgres:13.2-alpine
environment:
POSTGRES_DB: keycloak
POSTGRES_USER: keycloak
POSTGRES_PASSWORD: password
volumes:
- ./data/postgres17:/var/lib/postgresql/data
networks:
- keycloak17
ports:
- "5432:5432"
keycloak:
container_name: keycloak17
image: keycloak-dev:17.0.0 #quay.io/keycloak/keycloak:17.0.0
build: # "context" and "dockerfile" fields have to be under "build"
context: ./dev
network: host
dockerfile: .Dockerfile
cache_from:
- quay.io/keycloak/keycloak:17.0.0
environment:
KEYCLOAK_ADMIN: admin
KEYCLOAK_ADMIN_PASSWORD: admin
## https://www.keycloak.org/server/db
## https://www.keycloak.org/server/all-config#_database
KC_DB: postgres
KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak" # jdbc:postgresql://host:port/database
KC_DB_USERNAME: keycloak
KC_DB_PASSWORD: password
## https://www.keycloak.org/server/hostname
KC_HOSTNAME: penguin.linux.test # mandatory because we are using the production mode (launch with 'start' and not 'start-dev') better to be as closed as possible to the production
# KC_HOSTNAME_ADMIN: localhost
# KC_HOSTNAME_STRICT_BACKCHANNEL: true
# KC_HTTP_RELATIVE_PATH: "/auth" # mandatory to keep same URL compared to previous versions of KC
## https://www.keycloak.org/server/enabletls
## https://www.keycloak.org/server/all-config#_httptls
KC_HTTP_ENABLED: "true"
# KC_HOSTNAME_STRICT_HTTPS: "false"
KC_HTTPS_PROTOCOLS: "TLSv1.3,TLSv1.2"
#KC_HTTPS_CIPER_SUITES: ### TODO
KC_HTTPS_CERTIFICATE_FILE: "/etc/x509/https/tls.crt"
KC_HTTPS_CERTIFICATE_KEY_FILE: "/etc/x509/https/tls.key"
# X509_CA_BUNDLE: /etc/x509/https/rootCA.crt /etc/x509/https/hugrootCA.crt # use space to add multiple root CA if needed
### DEPRECATED => TODO: use instead --https-trust-store-file=/path/to/file --https.trust-store.password=<value>
## https://www.keycloak.org/server/all-config#_feature
## https://www.keycloak.org/server/features
KC_FEATURES: authorization,account-api,admin-fine-grained-authz,impersonation,scripts,token-exchange,upload-scripts,web-authn,client-policies,ciba,map-storage,par,declarative-user-profile,dynamic-scopes,preview
JAVA_TOOL_OPTIONS: -Dsun.security.krb5.debug=true -Dsun.security.spenego.degug=true -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=8790 -Dcom.sun.management.jmxremote.local.only=false -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dquarkus-log-max-startup-records=10000
JAVA_OPTS: -server -Xms512m -Xmx2048m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.awt.headless=true -Djava.net.preferIPv4Stack=true # JAVA_OPTS_APPEND does not work
## https://www.keycloak.org/server/all-config#_cluster
## https://www.keycloak.org/server/caching
## https://github.com/keycloak/keycloak/issues/10780
## https://github.com/keycloak/keycloak/issues/10875
# JGROUPS_DISCOVERY_PROTOCOL: JDBC_PING ### DEPRECATED : replaced by KC_CACHE_STACK
# JGROUPS_DISCOVERY_PROPERTIES: datasource_jndi_name=java:jboss/datasources/KeycloakDS,info_writer_sleep_time=500,remove_old_coords_on_view_change=true,remove_all_data_on_view_change=true ### DEPRECATED : => TODO: find a solution
# CACHE_OWNERS_COUNT: 1 ### DEPRECATED => useless now ?
# CACHE_OWNERS_AUTH_SESSIONS_COUNT: 1 ### DEPRECATED => useless now ?
KC_CACHE: ispn
KC_CACHE_STACK: tcp
## https://www.keycloak.org/server/logging
## https://www.keycloak.org/server/all-config#_logging
KC_LOG_LEVEL: INFO
## https://www.keycloak.org/server/all-config#_metrics
KC_METRICS_ENABLED: "true" # https://localhost/auth/metrics
# KEYCLOAK_STATISTICS: all ### DEPRECATED: no solution yet
# DEBUG: true
# DEBUG_PORT: "*:8787"
# DISABLE UI CACHE
# https://github.com/keycloak/keycloak/issues/10863
SPI_THEME_CACHE_THEMES: "false"
SPI_THEME_CACHE_TEMPLATES: "false"
SPI_THEME_STATIC_MAX_AGE: -1
KEYCLOAK_IMPORT: /tmp/keycloak/config/realm.json # depends on the line uncommented just below ### TODO : will be available with KC 17.0.1
## CUSTOM for HUG listener
#USER_EVENT_TO_SEND: CREATE,UPDATE,DELETE,LOGIN
#KEYCLOAK_SERVICE_URL: http://keycloak-service:10001/
###########################
## WARNING : --auto-build has to be used for dev purpose, for perf concern (quick start-up) ==> build your own custom image
# a) CUSTOM entrypoint to enable realm import : https://github.com/keycloak/keycloak/discussions/10229 ==> Does NOT WORK with a DB: driver is not yet initialized
entrypoint: ["/tmp/keycloak/config/docker-compose-entrypoint.sh", "start", "--auto-build"]
# b) STANDARD enrtrypoint
# entrypoint: ["/opt/keycloak/bin/kc.sh", "start", "--auto-build"]
volumes:
###########################
# Import test realm
- ./scripts:/tmp/keycloak/config
- ./export/realm-export.json:/tmp/keycloak/config/realm.json:ro
################
# Self-signed certificates to activate HTTPS for tests
- ./certs/penguin.linux.test+1.pem:/etc/x509/https/tls.crt:ro
- ./certs/penguin.linux.test+1-key.pem:/etc/x509/https/tls.key:ro
# CA certificates to enable user auth with certificates
#- ./certs/ca.crt:/etc/x509/https/rootCA.crt:ro # auto-signed CA cert
#- ./certs/hugca.crt:/etc/x509/https/hugrootCA.crt:ro # HUG CA cert
################
ports:
- "8080:8080" # KC HTTP : http://localhost:8080/
- "443:8443" # KC HTTPS : https://localhost/ (you must accept also warnings triggered by navigators)
- "8787:8787" # KC debug port
- "8790:8790" # KC JMX port
deploy:
replicas: 1
depends_on:
- postgres
networks:
- keycloak17
networks:
keycloak17:.Dockerfile (in my use case the .Dockerfile is in the folder "./dev"): FROM quay.io/keycloak/keycloak:17.0.0 as builder
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=authorization,account-api,admin-fine-grained-authz,impersonation,scripts,token-exchange,upload-scripts,web-authn,client-policies,ciba,map-storage,par,declarative-user-profile,dynamic-scopes,preview
ENV KC_DB=postgres
RUN /opt/keycloak/bin/kc.sh build
FROM quay.io/keycloak/keycloak:17.0.0
COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
WORKDIR /opt/keycloak
# for demonstration purposes only,please make sure to use proper certificates in production instead
# RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:2Fpenguin.linux.test,IP:127.0.0.1" -keystore conf/server.keystore
# ENV KEYCLOAK_ADMIN=admin
# ENV KEYCLOAK_ADMIN_PASSWORD=admin
# change these values to point to a running postgres instance
# ENV KC_DB_URL=jdbc:postgresql://postgres/keycloak
# ENV KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
# ENV KC_DB_USERNAME=keycloak
# ENV KC_DB_PASSWORD=password
# ENV KC_HOSTNAME=localhost:8443
# ENV KC_HOSTNAME_STRICT=false
# ENV KC_HOSTNAME_STRICT_HTTPS=false
# ENV KC_PROXY_ADDRESS_FORWARDING=true
# ENV KC_HTTP_ENABLED=true
ENTRYPOINT ["/opt/keycloak/bin/kc.sh","start"]For me, all resources like roles, clients, and authorization javascript policies are imported. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, Can we take export of all Realms from keycloak in h2 db in version 6.0 using bin/standalone.sh -Dkeycloak.migration.action=export Is the Keycloak export/import compatible across various Keycloak versions. |
Beta Was this translation helpful? Give feedback.
-
|
kindly let me know . this site is not allowing me to open a new discussion for this |
Beta Was this translation helpful? Give feedback.
-
|
We are taking Keycloak export from the inbuilt H2 database using After keycloak (16.1) version is configued to point to New Postgress RDS. After that I try to migrate the previous json file to new Keycloak 16.1 keycloak-16.1.1/bin/standalone.sh -c=standalone-ha.xml -Dkeycloak.migration.action=import -Djboss.socket.binding.port-offset=10 -Dkeycloak.migration.provider=singleFile -Dkeycloak.profile.feature.upload_scripts=enabled -Dkeycloak.migration.file=/opt/jboss/data_keycloak.json -Dkeycloak.migration.strategy=OVERWRITE_EXISTING My question is is it compatible or not. We are not upgrading the original keycloak in h2, however we are directly migrating to 16.1 version and also making it point to Postgress. After that I am triggering the import. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
I just saw, that the chapter about exporting and importing realm data in the docs is gone. Why?
There are the
exportandimportcommands available forkc.sh, but there's no documentation, besides the CLI help.Are the docs planned to be updated?
And:
In the legacy Docker container, it was possible to auto-import a realm JSON file on container startup. I don't see a possibility currently on how to do this with the new container.
Will there be such a feature/option in future?
Thanks, Niko
Beta Was this translation helpful? Give feedback.
All reactions