There is cluster (high availability) setting in 'keycloak by Quarkus' like 'legacy keycloak` #13600
-
|
Hi all. I found documentation for HA cluster setup. Looks like I need to set the cluster mode, ping and architecture. So I looked for an option or guide for Quarkus Keycloak. But the only thing is a guide to caching.
Sorry for the basic question, thanks for the answer |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
I think I can answer the last question - at least in the legacy (WildFly) configuration, user sessions are not kept in the database at all; if the Infinispan cluster fails you will get inconsistent service configurations and dropped user sessions (e,g., if the Infinispan servers do not have any cache persistence configured, all users will have to re-authenticate if all Infinispan servers are restarted at the same time). Because of this, you cannot create a Keycloak cluster that does not rely on Infinispan to store data. The database mostly keeps information about more permanent service configurations (e.g., user 2FA tokens, client configurations), but not all information is placed in the database. |
Beta Was this translation helpful? Give feedback.
-
|
Hopefully someone will correct me if there is a way to not use caches at all; most issues that we have faced were caused by Infinispan nodes disconnecting from the cluster and likely creating a split brain. |
Beta Was this translation helpful? Give feedback.
I think I can answer the last question - at least in the legacy (WildFly) configuration, user sessions are not kept in the database at all; if the Infinispan cluster fails you will get inconsistent service configurations and dropped user sessions (e,g., if the Infinispan servers do not have any cache persistence configured, all users will have to re-authenticate if all Infinispan servers are restarted at the same time). Because of this, you cannot create a Keycloak cluster that does not rely on Infinispan to store data.
The database mostly keeps information about more permanent service configurations (e.g., user 2FA tokens, client configurations), but not all information is placed in the …