<div dir="ltr"><div>Not sure what could be wrong, but posting the whole realm config every X minutes is pretty crazy. Why are you doing that?!</div><div><br></div><div>A few questions:</div><div><br></div><div>* Is the realm role still there? If the ID of the role changes then the user role mappings will be lost. User role mappings are for a role by id, not by name. So if you delete a role and re-create it role mappings are lost</div><div>* What database are you using? </div><div>* Do you have multiple nodes in a cluster?<br></div><div>* Does it happen to all users or just some?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 17 November 2015 at 15:40, Johan Heylen <span dir="ltr"><<a href="mailto:johan.heylen.public@gmail.com" target="_blank">johan.heylen.public@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hallo,<div><br></div><div>we have noticed a strange behaviour in our Keycloak setup:</div><div><br></div><div>After a while, some users lose one of their assigned realm roles, without anyone actually requesting this from the keycloak server (We see no admin events who can explain this behaviour).</div><div>Could it be that something is wrong in some cache implementation or an in issue in concurrency?</div><div>When I make a dump of the database, the role can also no longer be found there in the user export, so it actually gets removed from there as well.<br></div><div><br></div><div>One specific thing we do, is managing the realm settings using the admin REST API, which PUTs the realm config JSON every X minutes (X is currently 5 to 2 minutes), so the PUT call happens a lot (I can see it in the admin events).</div><div><br></div><div>To exclude this as possible culprit, I've disable this constant updating of the realm. I'll send an update wether this has had any impact, but either way, the issue should not occur.</div><div><br></div><div>Has anyone already encountered this issue? </div><div>I can provide you with more config of the keycloak server and realm if required... We are one 1.6.0</div><div><br></div><div>Could you help me with enabling the correct logging, so I might be able to trace where the problem occurs or see what causes the drop of a realm role on a user (His other realms roles remain untouched...)</div><div><br></div><div>Currently I am not able to reproduce this with a testcase, it just occurs from time to time on a test platform, so I did not create a JIRA ticket yet</div><div><br></div><div>Tnx,</div><div><br></div><div>Johan Heylen</div><div>DNS Belgium</div></div>
<br>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>