12:27 a.m.
Hi Sai,
I believe this is the expected behavior because in an HA setup, Keycloak doesn’t persist
user sessions to the database, they are stored in the Infinispan distributed cache. Only
offline sessions are persisted to the JPA data store.
A core Keycloak developer can correct me if I’m wrong, but this is what I see looking at
the latest Keycloak source code and it’s the case on the version we run.
~ Scott
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com
On Jan 2, 2018, at 10:20 AM, Kalidindi, Sai Soma Kala
<sai-soma-kala.kalidindi(a)microfocus.com> wrote:
Hi,
Our backup product is using Keycloak for SSO. We are migrating all our users to a new
instance of keycloak in AWS environment. One of the requirement is all the existing
clients which is an agent on the user box running in background which does backup, should
not see any re-authentication or login window from their end after migration . User
initially login when they have first installed our product and they never see any login
any more(our client is non-intrusive, most users don't ever remember the login ), we
just refresh every 15 minutes get new set of tokens and so on... and it works for us. We
have tested locally where we have migrated the present keycloak database to our new
keycloak aws instance just by using pg_dump and restore command for database of keycloak
and we made sure the realm, redirect urls , client secrets are exactly same. We are
assuming if everything is exactly the same refresh tokens should still workand we can
avoid the login screen. Is this right a!
ssumption?
In our test what we have found is, we made a DNS swap where the client initially going
the old env gets routed to our new keycloak aws instance(We did CNAME change on the old
env to route traffic to new environment ). The reason for this Is to make sure our
redirect url does not change and the client could still talk to same old urls it is aware
of. Long story short, old key cloak env and new key cloak env has exactly same of
everything...What we have seen is that the client which is initalliay pointing to the
old env, after the migration and after doing the DNS switch the old tokens still work on
new environment. Once we remove the switch and when the clients go back to old env the
tokens still work. Is this a bug or is this expected?
Thanks,
Sai.
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev