8:22 a.m.
Hi Team,
Please find the details on setup and observation below. Please provide your suggestion on
how to overcome this issue. We are using Keycloak 1.0.4.Final (Adapter & Server).
Setup:
1. We have brought up Jboss cluster ( Using mod_cluster, httpd ) with 2 nodes in
domain mode and enabled session replication between these nodes.
2. Our Recourse server is deployed in this clustered environment with distributable
and Sticky session Off.
Behavior observed :
During the Authorization/Authentication process ,when Initial call(Resource Access) lands
on master and next redirection (post Code To token) falls on slave Adapter is treating it
as a new session and redirecting to login URL again. So we ended up with circular
redirection error. After further investigation seems like session replication delay is
causing adapter to behave this way. As the redirection call happens very quickly and this
results in circular redirection error.
NOTE: Sticky Session in mod_cluster environment solves the issue but it does not provide
true load balancing. Therefore we are not considering Stick session option.
Thanks
Bappaditya Gorai
8:27 a.m.
New subject: Facing Issue with Resource Server in Clustered Environment
1.0.4.Final had very limited support for clustering, please upgrade to 1.1.0.Final and
refer to chapter 24 and 25 in the documentation
(http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
----- Original Message -----
From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Friday, 30 January, 2015 8:22:26 AM
Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi Team,
Please find the details on setup and observation below. Please provide your
suggestion on how to overcome this issue. We are using Keycloak 1.0.4.Final
(Adapter & Server).
Setup:
1. We have brought up Jboss cluster ( Using mod_cluster, httpd ) with 2 nodes
in domain mode and enabled session replication between these nodes.
2. Our Recourse server is deployed in this clustered environment with
distributable and Sticky session Off.
Behavior observed :
During the Authorization/Authentication process ,when Initial call(Resource
Access) lands on master and next redirection (post Code To token) falls on
slave Adapter is treating it as a new session and redirecting to login URL
again. So we ended up with circular redirection error. After further
investigation seems like session replication delay is causing adapter to
behave this way. As the redirection call happens very quickly and this
results in circular redirection error.
NOTE: Sticky Session in mod_cluster environment solves the issue but it does
not provide true load balancing. Therefore we are not considering Stick
session option.
Thanks
Bappaditya Gorai
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
8:38 a.m.
New subject: Facing Issue with Resource Server in Clustered Environment
We are not talking about clustering for Keycloak server. The setup is for Resource Server
(Keycloak Adapter) in clustered environment.
Thanks
Bappaditya Gorai
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 12:57 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
1.0.4.Final had very limited support for clustering, please upgrade to 1.1.0.Final and
refer to chapter 24 and 25 in the documentation
(http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
----- Original Message -----
From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Friday, 30 January, 2015 8:22:26 AM
Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi Team,
Please find the details on setup and observation below. Please provide
your suggestion on how to overcome this issue. We are using Keycloak
1.0.4.Final (Adapter & Server).
Setup:
1. We have brought up Jboss cluster ( Using mod_cluster, httpd ) with
2 nodes in domain mode and enabled session replication between these nodes.
2. Our Recourse server is deployed in this clustered environment with
distributable and Sticky session Off.
Behavior observed :
During the Authorization/Authentication process ,when Initial
call(Resource
Access) lands on master and next redirection (post Code To token)
falls on slave Adapter is treating it as a new session and redirecting
to login URL again. So we ended up with circular redirection error.
After further investigation seems like session replication delay is
causing adapter to behave this way. As the redirection call happens
very quickly and this results in circular redirection error.
NOTE: Sticky Session in mod_cluster environment solves the issue but
it does not provide true load balancing. Therefore we are not
considering Stick session option.
Thanks
Bappaditya Gorai
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
8:47 a.m.
New subject: Facing Issue with Resource Server in Clustered Environment
----- Original Message -----
From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Friday, 30 January, 2015 8:38:49 AM
Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
We are not talking about clustering for Keycloak server. The setup is for
Resource Server (Keycloak Adapter) in clustered environment.
Same answer
Thanks
Bappaditya Gorai
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 12:57 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered
Environment
1.0.4.Final had very limited support for clustering, please upgrade to
1.1.0.Final and refer to chapter 24 and 25 in the documentation
(http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
----- Original Message -----
> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Friday, 30 January, 2015 8:22:26 AM
> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
> Environment
>
>
>
> Hi Team,
>
> Please find the details on setup and observation below. Please provide
> your suggestion on how to overcome this issue. We are using Keycloak
> 1.0.4.Final (Adapter & Server).
>
>
>
>
>
> Setup:
>
> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd ) with
> 2 nodes in domain mode and enabled session replication between these nodes.
>
> 2. Our Recourse server is deployed in this clustered environment with
> distributable and Sticky session Off.
>
>
>
> Behavior observed :
>
> During the Authorization/Authentication process ,when Initial
> call(Resource
> Access) lands on master and next redirection (post Code To token)
> falls on slave Adapter is treating it as a new session and redirecting
> to login URL again. So we ended up with circular redirection error.
> After further investigation seems like session replication delay is
> causing adapter to behave this way. As the redirection call happens
> very quickly and this results in circular redirection error.
>
>
>
>
>
>
>
> NOTE: Sticky Session in mod_cluster environment solves the issue but
> it does not provide true load balancing. Therefore we are not
> considering Stick session option.
>
>
>
>
>
> Thanks
>
> Bappaditya Gorai
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
11:26 a.m.
New subject: Facing Issue with Resource Server in Clustered Environment
Thanks for clarifying. So, I think adapter has become stateless in 1.1.0.Final. Is my
understanding correct?
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 1:18 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
----- Original Message -----
From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Friday, 30 January, 2015 8:38:49 AM
Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
We are not talking about clustering for Keycloak server. The setup is
for Resource Server (Keycloak Adapter) in clustered environment.
Same answer
Thanks
Bappaditya Gorai
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 12:57 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
1.0.4.Final had very limited support for clustering, please upgrade to
1.1.0.Final and refer to chapter 24 and 25 in the documentation
(http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
----- Original Message -----
> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Friday, 30 January, 2015 8:22:26 AM
> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
> Environment
>
>
>
> Hi Team,
>
> Please find the details on setup and observation below. Please
> provide your suggestion on how to overcome this issue. We are using
> Keycloak 1.0.4.Final (Adapter & Server).
>
>
>
>
>
> Setup:
>
> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
> with
> 2 nodes in domain mode and enabled session replication between these nodes.
>
> 2. Our Recourse server is deployed in this clustered environment
> with distributable and Sticky session Off.
>
>
>
> Behavior observed :
>
> During the Authorization/Authentication process ,when Initial
> call(Resource
> Access) lands on master and next redirection (post Code To token)
> falls on slave Adapter is treating it as a new session and
> redirecting to login URL again. So we ended up with circular redirection error.
> After further investigation seems like session replication delay is
> causing adapter to behave this way. As the redirection call happens
> very quickly and this results in circular redirection error.
>
>
>
>
>
>
>
> NOTE: Sticky Session in mod_cluster environment solves the issue but
> it does not provide true load balancing. Therefore we are not
> considering Stick session option.
>
>
>
>
>
> Thanks
>
> Bappaditya Gorai
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
9:30 a.m.
Hi,
it's not stateless by default. Data about keycloak authenticated
principal are saved in HTTP session by default and can be replicated
across cluster nodes (replication works as long as your application is
marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in HTTP
Session and won't create HTTP session and JSESSIONID cookie at all
(unless you're calling httpRequest.getSession() in your own
application). Instead all the data are saved in cookie.
Some more info in docs:
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
Thanks for clarifying. So, I think adapter has become stateless in
1.1.0.Final. Is my understanding correct?
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 1:18 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
----- Original Message -----
> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-dev(a)lists.jboss.org
> Sent: Friday, 30 January, 2015 8:38:49 AM
> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
>
> We are not talking about clustering for Keycloak server. The setup is
> for Resource Server (Keycloak Adapter) in clustered environment.
Same answer
> Thanks
> Bappaditya Gorai
>
> -----Original Message-----
> From: Stian Thorgersen [mailto:stian@redhat.com]
> Sent: Friday, January 30, 2015 12:57 PM
> To: Bappaditya Gorai (bgorai)
> Cc: keycloak-dev(a)lists.jboss.org
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
> 1.0.4.Final had very limited support for clustering, please upgrade to
> 1.1.0.Final and refer to chapter 24 and 25 in the documentation
> (http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com>
>> To: keycloak-dev(a)lists.jboss.org
>> Sent: Friday, 30 January, 2015 8:22:26 AM
>> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
>> Environment
>>
>>
>>
>> Hi Team,
>>
>> Please find the details on setup and observation below. Please
>> provide your suggestion on how to overcome this issue. We are using
>> Keycloak 1.0.4.Final (Adapter & Server).
>>
>>
>>
>>
>>
>> Setup:
>>
>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>> with
>> 2 nodes in domain mode and enabled session replication between these nodes.
>>
>> 2. Our Recourse server is deployed in this clustered environment
>> with distributable and Sticky session Off.
>>
>>
>>
>> Behavior observed :
>>
>> During the Authorization/Authentication process ,when Initial
>> call(Resource
>> Access) lands on master and next redirection (post Code To token)
>> falls on slave Adapter is treating it as a new session and
>> redirecting to login URL again. So we ended up with circular redirection error.
>> After further investigation seems like session replication delay is
>> causing adapter to behave this way. As the redirection call happens
>> very quickly and this results in circular redirection error.
>>
>>
>>
>>
>>
>>
>>
>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>> it does not provide true load balancing. Therefore we are not
>> considering Stick session option.
>>
>>
>>
>>
>>
>> Thanks
>>
>> Bappaditya Gorai
>>
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
1:37 p.m.
Thanks for the detailed description. Still, It seems in case of Clustered Resource
environment (distributable without Sticky sessions) we are relying on session replication
to happen immediately between CODE_TO_TOKEN and Resource Hit(302), which may or may not
happen. We are now facing the same issue where After CODE_TO_TOKEN client is redirected to
Login URL again.
Are we addressing this scenario with 1.1.0 Final ?
Thanks
Bappaditya Gorai
-----Original Message-----
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, February 02, 2015 2:00 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi,
it's not stateless by default. Data about keycloak authenticated principal are saved
in HTTP session by default and can be replicated across cluster nodes (replication works
as long as your application is marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in HTTP Session and
won't create HTTP session and JSESSIONID cookie at all (unless you're calling
httpRequest.getSession() in your own application). Instead all the data are saved in
cookie.
Some more info in docs:
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
Thanks for clarifying. So, I think adapter has become stateless in
1.1.0.Final. Is my understanding correct?
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 1:18 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
----- Original Message -----
> From: "Bappaditya Gorai (bgorai)"
<bgorai@cisco.com<mailto:bgorai@cisco.com>>
> To: "Stian Thorgersen"
<stian@redhat.com<mailto:stian@redhat.com>>
> Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
> Sent: Friday, 30 January, 2015 8:38:49 AM
> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered
Environment
>
> We are not talking about clustering for Keycloak server. The setup is
> for Resource Server (Keycloak Adapter) in clustered environment.
Same answer
> Thanks
> Bappaditya Gorai
>
> -----Original Message-----
> From: Stian Thorgersen [mailto:stian@redhat.com]
> Sent: Friday, January 30, 2015 12:57 PM
> To: Bappaditya Gorai (bgorai)
> Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
> 1.0.4.Final had very limited support for clustering, please upgrade
> to 1.1.0.Final and refer to chapter 24 and 25 in the documentation
> (http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)"
<bgorai@cisco.com<mailto:bgorai@cisco.com>>
>> To: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
>> Sent: Friday, 30 January, 2015 8:22:26 AM
>> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
>> Environment
>>
>>
>>
>> Hi Team,
>>
>> Please find the details on setup and observation below. Please
>> provide your suggestion on how to overcome this issue. We are using
>> Keycloak 1.0.4.Final (Adapter & Server).
>>
>>
>>
>>
>>
>> Setup:
>>
>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>> with
>> 2 nodes in domain mode and enabled session replication between these nodes.
>>
>> 2. Our Recourse server is deployed in this clustered environment
>> with distributable and Sticky session Off.
>>
>>
>>
>> Behavior observed :
>>
>> During the Authorization/Authentication process ,when Initial
>> call(Resource
>> Access) lands on master and next redirection (post Code To token)
>> falls on slave Adapter is treating it as a new session and
>> redirecting to login URL again. So we ended up with circular redirection error.
>> After further investigation seems like session replication delay is
>> causing adapter to behave this way. As the redirection call happens
>> very quickly and this results in circular redirection error.
>>
>>
>>
>>
>>
>>
>>
>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>> it does not provide true load balancing. Therefore we are not
>> considering Stick session option.
>>
>>
>>
>>
>>
>> Thanks
>>
>> Bappaditya Gorai
>>
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
3:35 p.m.
Hi,
I am not sure about the details of your environment. You mentioned that
you're not interested in clustering of keycloak server. So am I
understand correctly that you have just 1 node as keycloak server and 2
nodes with your application deployed? Are you using "distributable" tag
in web.xml of your app on both nodes to ensure session replication? Are
you using loadbalancer?
Marek
On 4.2.2015 13:37, Bappaditya Gorai (bgorai) wrote:
Thanks for the detailed description. Still, It seems in case of
Clustered Resource environment (distributable without Sticky sessions)
we are relying on session replication to happen immediately between
CODE_TO_TOKEN and Resource Hit(302), which may or may not happen. We
are now facing the same issue where After CODE_TO_TOKEN client is
redirected to Login URL again.
Are we addressing this scenario with 1.1.0 Final ?
Thanks
Bappaditya Gorai
-----Original Message-----
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, February 02, 2015 2:00 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
Hi,
it's not stateless by default. Data about keycloak authenticated
principal are saved in HTTP session by default and can be replicated
across cluster nodes (replication works as long as your application is
marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in
HTTP Session and won't create HTTP session and JSESSIONID cookie at
all (unless you're calling httpRequest.getSession() in your own
application). Instead all the data are saved in cookie.
Some more info in docs:
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
> Thanks for clarifying. So, I think adapter has become stateless in 1.1.0.Final. Is
my understanding correct?
>
>
> -----Original Message-----
> From: Stian Thorgersen [mailto:stian@redhat.com]
> Sent: Friday, January 30, 2015 1:18 PM
> To: Bappaditya Gorai (bgorai)
> Cc:keycloak-dev@lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
>
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com
<mailto:bgorai@cisco.com>>
>> To: "Stian Thorgersen" <stian(a)redhat.com
<mailto:stian@redhat.com>>
>> Cc:keycloak-dev@lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
>> Sent: Friday, 30 January, 2015 8:38:49 AM
>> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered
Environment
>>
>> We are not talking about clustering for Keycloak server. The setup is
>> for Resource Server (Keycloak Adapter) in clustered environment.
> Same answer
>
>> Thanks
>> Bappaditya Gorai
>>
>> -----Original Message-----
>> From: Stian Thorgersen [mailto:stian@redhat.com]
>> Sent: Friday, January 30, 2015 12:57 PM
>> To: Bappaditya Gorai (bgorai)
>> Cc:keycloak-dev@lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
>> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
>> Clustered Environment
>>
>> 1.0.4.Final had very limited support for clustering, please upgrade
>> to 1.1.0.Final and refer to chapter 24 and 25 in the documentation
>>
(http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
>>
>> ----- Original Message -----
>>> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com
<mailto:bgorai@cisco.com>>
>>> To:keycloak-dev@lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
>>> Sent: Friday, 30 January, 2015 8:22:26 AM
>>> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
>>> Environment
>>>
>>>
>>>
>>> Hi Team,
>>>
>>> Please find the details on setup and observation below. Please
>>> provide your suggestion on how to overcome this issue. We are using
>>> Keycloak 1.0.4.Final (Adapter & Server).
>>>
>>>
>>>
>>>
>>>
>>> Setup:
>>>
>>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>>> with
>>> 2 nodes in domain mode and enabled session replication between these nodes.
>>>
>>> 2. Our Recourse server is deployed in this clustered environment
>>> with distributable and Sticky session Off.
>>>
>>>
>>>
>>> Behavior observed :
>>>
>>> During the Authorization/Authentication process ,when Initial
>>> call(Resource
>>> Access) lands on master and next redirection (post Code To token)
>>> falls on slave Adapter is treating it as a new session and
>>> redirecting to login URL again. So we ended up with circular redirection
error.
>>> After further investigation seems like session replication delay is
>>> causing adapter to behave this way. As the redirection call happens
>>> very quickly and this results in circular redirection error.
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>>> it does not provide true load balancing. Therefore we are not
>>> considering Stick session option.
>>>
>>>
>>>
>>>
>>>
>>> Thanks
>>>
>>> Bappaditya Gorai
>>>
>>> _______________________________________________
>>> keycloak-dev mailing list
>>>keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
>>>https://lists.jboss.org/mailman/listinfo/keycloak-dev
> _______________________________________________
> keycloak-dev mailing list
>keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
>https://lists.jboss.org/mailman/listinfo/keycloak-dev
6:45 a.m.
Please find my response inline for your queries.
Thanks
Bappaditya Gorai
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Wednesday, February 04, 2015 8:06 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi,
I am not sure about the details of your environment. You mentioned that you're not
interested in clustering of keycloak server.
So am I understand correctly that you have just 1 node as keycloak server and 2 nodes with
your application deployed?
[[Bappaditya]] Yes, only one instance of keycloak Server (Running in standalone mode).
My Application is deployed in 2 nodes (cluster) and running in domain mode.
Are you using "distributable" tag in web.xml of your app on both nodes to ensure
session replication?
[[Bappaditya]] Yes, Application is using "distributable" tag in web.xml.
Are you using loadbalancer?
[[Bappaditya]] We are using mod_cluster & httpd. Sticky sessions disabled.
Marek
On 4.2.2015 13:37, Bappaditya Gorai (bgorai) wrote:
Thanks for the detailed description. Still, It seems in case of Clustered Resource
environment (distributable without Sticky sessions) we are relying on session replication
to happen immediately between CODE_TO_TOKEN and Resource Hit(302), which may or may not
happen. We are now facing the same issue where After CODE_TO_TOKEN client is redirected to
Login URL again.
Are we addressing this scenario with 1.1.0 Final ?
Thanks
Bappaditya Gorai
-----Original Message-----
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, February 02, 2015 2:00 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi,
it's not stateless by default. Data about keycloak authenticated principal are saved
in HTTP session by default and can be replicated across cluster nodes (replication works
as long as your application is marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in HTTP Session and
won't create HTTP session and JSESSIONID cookie at all (unless you're calling
httpRequest.getSession() in your own application). Instead all the data are saved in
cookie.
Some more info in docs:
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
Thanks for clarifying. So, I think adapter has become stateless in
1.1.0.Final. Is my understanding correct?
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 1:18 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
----- Original Message -----
> From: "Bappaditya Gorai (bgorai)"
<bgorai@cisco.com<mailto:bgorai@cisco.com>>
> To: "Stian Thorgersen"
<stian@redhat.com<mailto:stian@redhat.com>>
> Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
> Sent: Friday, 30 January, 2015 8:38:49 AM
> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered
Environment
>
> We are not talking about clustering for Keycloak server. The setup is
> for Resource Server (Keycloak Adapter) in clustered environment.
Same answer
> Thanks
> Bappaditya Gorai
>
> -----Original Message-----
> From: Stian Thorgersen [mailto:stian@redhat.com]
> Sent: Friday, January 30, 2015 12:57 PM
> To: Bappaditya Gorai (bgorai)
> Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
> 1.0.4.Final had very limited support for clustering, please upgrade
> to 1.1.0.Final and refer to chapter 24 and 25 in the documentation
> (http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)"
<bgorai@cisco.com<mailto:bgorai@cisco.com>>
>> To: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
>> Sent: Friday, 30 January, 2015 8:22:26 AM
>> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
>> Environment
>>
>>
>>
>> Hi Team,
>>
>> Please find the details on setup and observation below. Please
>> provide your suggestion on how to overcome this issue. We are using
>> Keycloak 1.0.4.Final (Adapter & Server).
>>
>>
>>
>>
>>
>> Setup:
>>
>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>> with
>> 2 nodes in domain mode and enabled session replication between these nodes.
>>
>> 2. Our Recourse server is deployed in this clustered environment
>> with distributable and Sticky session Off.
>>
>>
>>
>> Behavior observed :
>>
>> During the Authorization/Authentication process ,when Initial
>> call(Resource
>> Access) lands on master and next redirection (post Code To token)
>> falls on slave Adapter is treating it as a new session and
>> redirecting to login URL again. So we ended up with circular redirection error.
>> After further investigation seems like session replication delay is
>> causing adapter to behave this way. As the redirection call happens
>> very quickly and this results in circular redirection error.
>>
>>
>>
>>
>>
>>
>>
>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>> it does not provide true load balancing. Therefore we are not
>> considering Stick session option.
>>
>>
>>
>>
>>
>> Thanks
>>
>> Bappaditya Gorai
>>
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
10:03 a.m.
It looks there might be issue with session replication in your environment.
When you bootstrap your domain with cluster nodes, are you seeing message in the log
similar to:
INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(Incoming-10,shared=udp)
ISPN000094: Received new cluster view: [node1/web|1] (2) [node1/web, node2/web]
Does it help if you try to switch to
"token-store": "cookie"
in the adapter configuration of your application?
Thanks,
Marek
On 5.2.2015 06:45, Bappaditya Gorai (bgorai) wrote:
Please find my response inline for your queries.
Thanks
Bappaditya Gorai
*From:* Marek Posolda [mailto:mposolda@redhat.com]
*Sent:* Wednesday, February 04, 2015 8:06 PM
*To:* Bappaditya Gorai (bgorai); Stian Thorgersen
*Cc:* keycloak-dev(a)lists.jboss.org
*Subject:* Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
Hi,
I am not sure about the details of your environment. You mentioned
that you're not interested in clustering of keycloak server.
So am I understand correctly that you have just 1 node as keycloak
server and 2 nodes with your application deployed?
*[[Bappaditya]]* Yes, only one instance of keycloak Server (Running in
standalone mode). My Application is deployed in 2 nodes (cluster) and
running in domain mode.
Are you using "distributable" tag in web.xml of your app on both nodes
to ensure session replication?
*[[Bappaditya]]* Yes, Application is using “distributable” tag in
web.xml.
Are you using loadbalancer?
*[[Bappaditya]] * We are using mod_cluster & httpd. Sticky sessions
disabled.
Marek
On 4.2.2015 13:37, Bappaditya Gorai (bgorai) wrote:
Thanks for the detailed description. Still, It seems in case of
Clustered Resource environment (distributable without Sticky sessions)
we are relying on session replication to happen immediately between
CODE_TO_TOKEN and Resource Hit(302), which may or may not happen. We
are now facing the same issue where After CODE_TO_TOKEN client is
redirected to Login URL again.
Are we addressing this scenario with 1.1.0 Final ?
Thanks
Bappaditya Gorai
-----Original Message-----
From: Marek Posolda [_mailto:mposolda@redhat.com_]
Sent: Monday, February 02, 2015 2:00 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: _keycloak-dev(a)lists.jboss.org_ <mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
Hi,
it's not stateless by default. Data about keycloak authenticated
principal are saved in HTTP session by default and can be replicated
across cluster nodes (replication works as long as your application is
marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in
HTTP Session and won't create HTTP session and JSESSIONID cookie at
all (unless you're calling httpRequest.getSession() in your own
application). Instead all the data are saved in cookie.
Some more info in docs:
_http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicati...
<http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
> Thanks for clarifying. So, I think adapter has become stateless in 1.1.0.Final. Is
my understanding correct?
>
>
> -----Original Message-----
> From: Stian Thorgersen [_mailto:stian@redhat.com_]
> Sent: Friday, January 30, 2015 1:18 PM
> To: Bappaditya Gorai (bgorai)
> Cc:_keycloak-dev@lists.jboss.org_ <mailto:keycloak-dev@lists.jboss.org>
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
>
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)" <_bgorai(a)cisco.com_
<mailto:bgorai@cisco.com>>
>> To: "Stian Thorgersen" <_stian(a)redhat.com_
<mailto:stian@redhat.com>>
>> Cc:_keycloak-dev@lists.jboss.org_ <mailto:keycloak-dev@lists.jboss.org>
>> Sent: Friday, 30 January, 2015 8:38:49 AM
>> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered
Environment
>>
>> We are not talking about clustering for Keycloak server. The setup is
>> for Resource Server (Keycloak Adapter) in clustered environment.
> Same answer
>
>> Thanks
>> Bappaditya Gorai
>>
>> -----Original Message-----
>> From: Stian Thorgersen [_mailto:stian@redhat.com_]
>> Sent: Friday, January 30, 2015 12:57 PM
>> To: Bappaditya Gorai (bgorai)
>> Cc:_keycloak-dev@lists.jboss.org_ <mailto:keycloak-dev@lists.jboss.org>
>> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
>> Clustered Environment
>>
>> 1.0.4.Final had very limited support for clustering, please upgrade
>> to 1.1.0.Final and refer to chapter 24 and 25 in the documentation
>>
(_http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clusterin...).
>>
>> ----- Original Message -----
>>> From: "Bappaditya Gorai (bgorai)" <_bgorai(a)cisco.com_
<mailto:bgorai@cisco.com>>
>>> To:_keycloak-dev@lists.jboss.org_
<mailto:keycloak-dev@lists.jboss.org>
>>> Sent: Friday, 30 January, 2015 8:22:26 AM
>>> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
>>> Environment
>>>
>>>
>>>
>>> Hi Team,
>>>
>>> Please find the details on setup and observation below. Please
>>> provide your suggestion on how to overcome this issue. We are using
>>> Keycloak 1.0.4.Final (Adapter & Server).
>>>
>>>
>>>
>>>
>>>
>>> Setup:
>>>
>>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>>> with
>>> 2 nodes in domain mode and enabled session replication between these nodes.
>>>
>>> 2. Our Recourse server is deployed in this clustered environment
>>> with distributable and Sticky session Off.
>>>
>>>
>>>
>>> Behavior observed :
>>>
>>> During the Authorization/Authentication process ,when Initial
>>> call(Resource
>>> Access) lands on master and next redirection (post Code To token)
>>> falls on slave Adapter is treating it as a new session and
>>> redirecting to login URL again. So we ended up with circular redirection
error.
>>> After further investigation seems like session replication delay is
>>> causing adapter to behave this way. As the redirection call happens
>>> very quickly and this results in circular redirection error.
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>>> it does not provide true load balancing. Therefore we are not
>>> considering Stick session option.
>>>
>>>
>>>
>>>
>>>
>>> Thanks
>>>
>>> Bappaditya Gorai
>>>
>>> _______________________________________________
>>> keycloak-dev mailing list
>>>_keycloak-dev(a)lists.jboss.org_ <mailto:keycloak-dev@lists.jboss.org>
>>>_https://lists.jboss.org/mailman/listinfo/keycloak-dev_
> _______________________________________________
> keycloak-dev mailing list
>_keycloak-dev(a)lists.jboss.org_ <mailto:keycloak-dev@lists.jboss.org>
>_https://lists.jboss.org/mailman/listinfo/keycloak-dev_
noon
We have verified it, session replication is happening without issue.
We found one JIRA which seems somewhat relevant to our issue. We are currently using
Keycloak 1.0.4.Final release, however this JIRA got fixed in later version. So we will
upgrade to 1.1.0.Final and see it that helps.
https://issues.jboss.org/browse/KEYCLOAK-743
Cookie as token-store can definitely help. Although, wo would like to know whether
distributable (replicated http session) without sticky session is supported by adapter.
Thanks
Bappaditya Gorai
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Friday, February 06, 2015 2:34 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev(a)lists.jboss.org
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
It looks there might be issue with session replication in your environment.
When you bootstrap your domain with cluster nodes, are you seeing message in the log
similar to:
INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(Incoming-10,shared=udp)
ISPN000094: Received new cluster view: [node1/web|1] (2) [node1/web, node2/web]
Does it help if you try to switch to
"token-store": "cookie"
in the adapter configuration of your application?
Thanks,
Marek
On 5.2.2015 06:45, Bappaditya Gorai (bgorai) wrote:
Please find my response inline for your queries.
Thanks
Bappaditya Gorai
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Wednesday, February 04, 2015 8:06 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi,
I am not sure about the details of your environment. You mentioned that you're not
interested in clustering of keycloak server.
So am I understand correctly that you have just 1 node as keycloak server and 2 nodes with
your application deployed?
[[Bappaditya]] Yes, only one instance of keycloak Server (Running in standalone mode). My
Application is deployed in 2 nodes (cluster) and running in domain mode.
Are you using "distributable" tag in web.xml of your app on both nodes to ensure
session replication?
[[Bappaditya]] Yes, Application is using "distributable" tag in web.xml.
Are you using loadbalancer?
[[Bappaditya]] We are using mod_cluster & httpd. Sticky sessions disabled.
Marek
On 4.2.2015 13:37, Bappaditya Gorai (bgorai) wrote:
Thanks for the detailed description. Still, It seems in case of Clustered Resource
environment (distributable without Sticky sessions) we are relying on session replication
to happen immediately between CODE_TO_TOKEN and Resource Hit(302), which may or may not
happen. We are now facing the same issue where After CODE_TO_TOKEN client is redirected to
Login URL again.
Are we addressing this scenario with 1.1.0 Final ?
Thanks
Bappaditya Gorai
-----Original Message-----
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, February 02, 2015 2:00 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in Clustered Environment
Hi,
it's not stateless by default. Data about keycloak authenticated principal are saved
in HTTP session by default and can be replicated across cluster nodes (replication works
as long as your application is marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in HTTP Session and
won't create HTTP session and JSESSIONID cookie at all (unless you're calling
httpRequest.getSession() in your own application). Instead all the data are saved in
cookie.
Some more info in docs:
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
Thanks for clarifying. So, I think adapter has become stateless in
1.1.0.Final. Is my understanding correct?
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Friday, January 30, 2015 1:18 PM
To: Bappaditya Gorai (bgorai)
Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
----- Original Message -----
> From: "Bappaditya Gorai (bgorai)"
<bgorai@cisco.com<mailto:bgorai@cisco.com>>
> To: "Stian Thorgersen"
<stian@redhat.com<mailto:stian@redhat.com>>
> Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
> Sent: Friday, 30 January, 2015 8:38:49 AM
> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in Clustered
Environment
>
> We are not talking about clustering for Keycloak server. The setup is
> for Resource Server (Keycloak Adapter) in clustered environment.
Same answer
> Thanks
> Bappaditya Gorai
>
> -----Original Message-----
> From: Stian Thorgersen [mailto:stian@redhat.com]
> Sent: Friday, January 30, 2015 12:57 PM
> To: Bappaditya Gorai (bgorai)
> Cc: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
> 1.0.4.Final had very limited support for clustering, please upgrade
> to 1.1.0.Final and refer to chapter 24 and 25 in the documentation
> (http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)"
<bgorai@cisco.com<mailto:bgorai@cisco.com>>
>> To: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
>> Sent: Friday, 30 January, 2015 8:22:26 AM
>> Subject: [keycloak-dev] Facing Issue with Resource Server in Clustered
>> Environment
>>
>>
>>
>> Hi Team,
>>
>> Please find the details on setup and observation below. Please
>> provide your suggestion on how to overcome this issue. We are using
>> Keycloak 1.0.4.Final (Adapter & Server).
>>
>>
>>
>>
>>
>> Setup:
>>
>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>> with
>> 2 nodes in domain mode and enabled session replication between these nodes.
>>
>> 2. Our Recourse server is deployed in this clustered environment
>> with distributable and Sticky session Off.
>>
>>
>>
>> Behavior observed :
>>
>> During the Authorization/Authentication process ,when Initial
>> call(Resource
>> Access) lands on master and next redirection (post Code To token)
>> falls on slave Adapter is treating it as a new session and
>> redirecting to login URL again. So we ended up with circular redirection error.
>> After further investigation seems like session replication delay is
>> causing adapter to behave this way. As the redirection call happens
>> very quickly and this results in circular redirection error.
>>
>>
>>
>>
>>
>>
>>
>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>> it does not provide true load balancing. Therefore we are not
>> considering Stick session option.
>>
>>
>>
>>
>>
>> Thanks
>>
>> Bappaditya Gorai
>>
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
12:09 p.m.
Oops, I somehow assumed that you upgraded already :-)
We didn't support cluster for adapters at 1.0.4.Final. You can also see
that clustering documentations mentioned above are available in our
reference guide in 1.1.0.Final, but not in In 1.0.4.Final. So I believe
that upgrading should solve your issues.
Marek
On 6.2.2015 12:00, Bappaditya Gorai (bgorai) wrote:
We have verified it, session replication is happening without issue.
We found one JIRA which seems somewhat relevant to our issue. We are
currently using *Keycloak 1.0.4.Final* release, however this JIRA got
fixed in later version. So we will upgrade to *1.1.0.Final* and see it
that helps.
_https://issues.jboss.org/browse/KEYCLOAK-743_
Cookie as token-store can definitely help. Although, wo would like to
know whether distributable (replicated http session) without sticky
session is supported by adapter.
Thanks
Bappaditya Gorai
*From:*Marek Posolda [mailto:mposolda@redhat.com]
*Sent:* Friday, February 06, 2015 2:34 PM
*To:* Bappaditya Gorai (bgorai); Stian Thorgersen
*Cc:* keycloak-dev(a)lists.jboss.org
*Subject:* Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
It looks there might be issue with session replication in your
environment.
When you bootstrap your domain with cluster nodes, are you seeing message in the log
similar to:
INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(Incoming-10,shared=udp)
ISPN000094: Received new cluster view: [node1/web|1] (2) [node1/web, node2/web]
Does it help if you try to switch to
"token-store": "cookie"
in the adapter configuration of your application?
Thanks,
Marek
On 5.2.2015 06:45, Bappaditya Gorai (bgorai) wrote:
Please find my response inline for your queries.
Thanks
Bappaditya Gorai
*From:*Marek Posolda [mailto:mposolda@redhat.com]
*Sent:* Wednesday, February 04, 2015 8:06 PM
*To:* Bappaditya Gorai (bgorai); Stian Thorgersen
*Cc:* keycloak-dev(a)lists.jboss.org
<mailto:keycloak-dev@lists.jboss.org>
*Subject:* Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
Hi,
I am not sure about the details of your environment. You mentioned
that you're not interested in clustering of keycloak server.
So am I understand correctly that you have just 1 node as keycloak
server and 2 nodes with your application deployed?
*[[Bappaditya]]*Yes, only one instance of keycloak Server (Running
in standalone mode). My Application is deployed in 2 nodes
(cluster) and running in domain mode.
Are you using "distributable" tag in web.xml of your app on both
nodes to ensure session replication?
*[[Bappaditya]]*Yes, Application is using “distributable” tag in
web.xml.
Are you using loadbalancer?
*[[Bappaditya]] *We are using mod_cluster & httpd. Sticky sessions
disabled.
Marek
On 4.2.2015 13:37, Bappaditya Gorai (bgorai) wrote:
Thanks for the detailed description. Still, It seems in case of
Clustered Resource environment (distributable without Sticky
sessions) we are relying on session replication to happen
immediately between CODE_TO_TOKEN and Resource Hit(302), which may
or may not happen. We are now facing the same issue where After
CODE_TO_TOKEN client is redirected to Login URL again.
Are we addressing this scenario with 1.1.0 Final ?
Thanks
Bappaditya Gorai
-----Original Message-----
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, February 02, 2015 2:00 PM
To: Bappaditya Gorai (bgorai); Stian Thorgersen
Cc: keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
Hi,
it's not stateless by default. Data about keycloak authenticated
principal are saved in HTTP session by default and can be
replicated across cluster nodes (replication works as long as your
application is marked as "distributable" in web.xml).
However we support stateless adapter, which won't save anything in
HTTP Session and won't create HTTP session and JSESSIONID cookie
at all (unless you're calling httpRequest.getSession() in your own
application). Instead all the data are saved in cookie.
Some more info in docs:
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
<http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/applicatio...
Marek
On 30.1.2015 11:26, Bappaditya Gorai (bgorai) wrote:
> Thanks for clarifying. So, I think adapter has become stateless
in 1.1.0.Final. Is my understanding correct?
>
>
> -----Original Message-----
> From: Stian Thorgersen [mailto:stian@redhat.com]
> Sent: Friday, January 30, 2015 1:18 PM
> To: Bappaditya Gorai (bgorai)
> Cc: keycloak-dev(a)lists.jboss.org
<mailto:keycloak-dev@lists.jboss.org>
> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
> Clustered Environment
>
>
>
> ----- Original Message -----
>> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com
<mailto:bgorai@cisco.com>>
>> To: "Stian Thorgersen" <stian(a)redhat.com
<mailto:stian@redhat.com>>
>> Cc: keycloak-dev(a)lists.jboss.org
<mailto:keycloak-dev@lists.jboss.org>
>> Sent: Friday, 30 January, 2015 8:38:49 AM
>> Subject: RE: [keycloak-dev] Facing Issue with Resource Server in
Clustered Environment
>>
>> We are not talking about clustering for Keycloak server. The
setup is
>> for Resource Server (Keycloak Adapter) in clustered environment.
> Same answer
>
>> Thanks
>> Bappaditya Gorai
>>
>> -----Original Message-----
>> From: Stian Thorgersen [mailto:stian@redhat.com]
>> Sent: Friday, January 30, 2015 12:57 PM
>> To: Bappaditya Gorai (bgorai)
>> Cc: keycloak-dev(a)lists.jboss.org
<mailto:keycloak-dev@lists.jboss.org>
>> Subject: Re: [keycloak-dev] Facing Issue with Resource Server in
>> Clustered Environment
>>
>> 1.0.4.Final had very limited support for clustering, please upgrade
>> to 1.1.0.Final and refer to chapter 24 and 25 in the documentation
>>
(http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/clustering...).
>>
>> ----- Original Message -----
>>> From: "Bappaditya Gorai (bgorai)" <bgorai(a)cisco.com
<mailto:bgorai@cisco.com>>
>>> To: keycloak-dev(a)lists.jboss.org
<mailto:keycloak-dev@lists.jboss.org>
>>> Sent: Friday, 30 January, 2015 8:22:26 AM
>>> Subject: [keycloak-dev] Facing Issue with Resource Server in
Clustered
>>>Environment
>>>
>>>
>>>
>>> Hi Team,
>>>
>>> Please find the details on setup and observation below. Please
>>> provide your suggestion on how to overcome this issue. We are using
>>> Keycloak 1.0.4.Final (Adapter & Server).
>>>
>>>
>>>
>>>
>>>
>>> Setup:
>>>
>>> 1. We have brought up Jboss cluster ( Using mod_cluster, httpd )
>>> with
>>> 2 nodes in domain mode and enabled session replication between
these nodes.
>>>
>>> 2. Our Recourse server is deployed in this clustered environment
>>> with distributable and Sticky session Off.
>>>
>>>
>>>
>>> Behavior observed :
>>>
>>> During the Authorization/Authentication process ,when Initial
>>> call(Resource
>>> Access) lands on master and next redirection (post Code To token)
>>> falls on slave Adapter is treating it as a new session and
>>> redirecting to login URL again. So we ended up with circular
redirection error.
>>> After further investigation seems like session replication delay is
>>> causing adapter to behave this way. As the redirection call happens
>>> very quickly and this results in circular redirection error.
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> NOTE: Sticky Session in mod_cluster environment solves the issue but
>>> it does not provide true load balancing. Therefore we are not
>>> considering Stick session option.
>>>
>>>
>>>
>>>
>>>
>>> Thanks
>>>
>>> Bappaditya Gorai
>>>
>>> _______________________________________________
>>> keycloak-dev mailing list
>>> keycloak-dev(a)lists.jboss.org
<mailto:keycloak-dev@lists.jboss.org>
>>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
3375
days inactive
3382
days old
11 comments
3 participants
participants (3)
-
Bappaditya Gorai (bgorai) -
Marek Posolda -
Stian Thorgersen