6:39 a.m.
Thanks Stian!
We will have a look at both options.
Concerning clustering we have a different challenge which is that we currently re-import
all Keycloak realm data on every start up of Keycloak (and because we do continuous
delivery and are developing actively this is multiple times a day). This because we treat
all (realm) configuration as source code for which our Git repo is leading.
Effectively this means that we recreate the Keycloak database for every new deployment and
of course a cluster is not going to help us here when it comes to uptime. Not sure how to
deal with this as yet. Ideally we would want some sort of realm update/patch mechanism
instead of a full import but that sounds rather complex to implement.
cheers
On 02 Mar 2016, at 13:23, Stian Thorgersen
<sthorger@redhat.com<mailto:sthorger@redhat.com>> wrote:
The tokens themselves are not stored, but can be verified by Keycloak as long as the user
session is active. So your question is how to make user sessions persisted. We do not
support persisting user sessions at the moment. You have two choices:
1. Add an additional node and configure set owners to 2 for the user session caches, or
change it to a replicated cache. See the clustering section in the docs for more
details.
2. Try to configure Infinispan to persist the sessions. See
https://docs.jboss.org/author/display/WFLY10/Infinispan+Subsystem for more details.
On 1 March 2016 at 20:56, Edgar Vonk - Info.nl<http://info.nl>
<Edgar@info.nl<mailto:Edgar@info.nl>> wrote:
Hi all,
What would we need to do to make Keycloak user sessions persistent in the database?
I think the information in:
http://lists.jboss.org/pipermail/keycloak-user/2015-April/001921.html is not relevant
anymore with Keycloak 1.9.0? Specifically:
"userSessions": {
"provider": "jpa"
}
Does not seem to work (“Failed to find provider jpa for userSessions”). User sessions are
now managed using Infinispan by default if I understand correctly:
http://keycloak.github.io/docs/userguide/keycloak-server/html/clustering.... ?
Is there a way to make user sessions persistent?
Our issue is that we send out a lot of activation (‘update password’) emails from our
(single) Keycloak server to new users and since we have a continuous delivery pipeline
Keycloak does down and up quite a bit and every time it restarts all temporary log in
tokens used for these update password actions are lost (since they are stored in memory
only). And if I understand correctly these tokens are actually a sort of user sessions.
cheers
Edgar
On 29 Feb 2016, at 17:52, Edgar Vonk - Info.nl<http://info.nl/>
<Edgar@info.nl<mailto:Edgar@info.nl>> wrote:
Hi,
See if I understand this correctly: in the default set up of Keycloak sessions and
temporary tokens are not persisted in the Keycloak database? So consider this scenario:
1/ login as admin to master realm
2/ go to Users - Credentials and send a ‘Update Password’ reset action email
3/ user receives an email with a link with a unique token to update his/her password in
Keycloak
4/ Keycloak server is restarted for whatever reason
5/ the temporary ‘login action token’ no longer exists and the link from 3/ no longer
works
Is this correct and expected behaviour?
And if so, can somebody maybe point us in the direction to solve this? I.e. by making
sessions/tokens by persistent I guess.
cheers
Edgar
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user