[keycloak-dev] The ultimate fate of master realm

[Stian Thorgersen]

It is very unlikely that we will remove the master realm in 5.x.

There are already a way to deal with global config which is in
standalone.xml. The limitation there currently is that changes require a
server restart and we don't have a schema so it's a simple key-value type
config. Changes here can be done through jboss-cli and with domain mode you
can have these propagated to all nodes in the cluster. At this point we
won't consider adding another level of global config like Apache Commons
Configuration.

On Mon, 5 Nov 2018 at 10:47, Dmitry Telegin <dt at acutus.pro> wrote:

> Hi,
>
> The idea of getting rid of master realm has been around for years [1] [2].
> Just wanted to know, what's the current stance on this? Can we tell for
> sure that there still will be master realm in KC 5.0? Or can we tell the
> opposite?
>
> Some background: we're working on a Keycloak extension (provider) that
> needs to operate a global (non-realm-based) writable config. So I'm
> choosing between the two options:
> - store config keys as master realm attributes;
> - introduce full-fledged configuration system based on Apache Commons
> Configuration, backed by its own DB table and Infinispan cache.
>
> The latter is obviously more complex, however more powerful. I've posted a
> write-up on it about a year ago [3], but didn't get any feedback. I hope it
> could be reevaluated today; for Keycloak proper, there are several use
> cases like auto-update settings, admin email, periodic tasks etc.
>
> The former, on the contrary, is much easier to implement, however there is
> a risk of having to rewrite everything from scratch should master realm
> bite the dust one day.
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
>
> [1]
> http://lists.jboss.org/pipermail/keycloak-dev/2015-December/006066.html
> [2] https://issues.jboss.org/browse/KEYCLOAK-3443
> [3]
> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010261.html
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>