Re: [keycloak-user] Architectural Blueprint/Recommendations

Hi David, Please see the answers and remarks inline. On Mon, 2018-06-18 at 14:40 +0000, Everson, David (MNIT) wrote: (skipped) Speaking of Keycloak on AWS, this is absolutely doable, but not that trivial. Please be sure to have read the document [1], especially the "Troubleshooting AWS specifics" part, and relevant ML postings [2]. Long story short, AWS doesn't allow for IP multicast between the nodes, which is the default node discovery mode in JGroups (the backbone of Keycloak clustering). You should use S3_PING or JDBC_PING instead. AFAIK, nobody has performed actual Keycloak benchmarking yet (publicly). There's however a Keycloak benchmarking suite based on Gatling [3]. It hasn't been updated for about two years, so first we'll need to make sure it works with recent Keycloak versions. The pros for A and B is obviously that you get some degree of separation/isolation, which might be good from the security and availability POV. However, this comes at a price of complexity; you'll have to deploy, monitor & maintain each separate instance / group of instances, each having different configs and dedicated database. Another big issue is load distribution. I doubt that your clients/realms all have equal, uniform load patterns. Given that each Keycloak instance will have its hardware limitations (CPU, RAM), you potentially end up with some nodes overloaded and others idle. The C scenario is obviously free from this issue. As you will necessarily have a load balancer / reverse proxy in front of your Keycloak cluster, you can enforce rate limiting / throttling on your load balancer. For example, haproxy implements rate limiting based on IP addresses, URLs and HTTP headers [4]. Could you please elaborate on template deployment? In Keycloak parlance, "templates" can be understood either as "client templates" or "HTML templates" (within custom GUI themes). Client templates surely can be created/updated via GUI or REST API, without the need for restart. For GUI themes, they can be deployed a) as Wildfly modules, b) via "themes" directory. While the former option indeed requires restart, the latter does not. Keycloak 4.x also adds c) hot deployment of themes by dropping theme JARs into the "deployments" directory. Is this indeed addressed by Keycloak 4.x? (just wondering, couldn't find any info) Keycloak admin REST API has an endpoint called "Return List of Users that have the specified role name", see [5] (identical for KC 3.x and 4.x). You could use this endpoint, however you will have to iterate over client roles and then merge and de-duplicate the results. Anyway, this should be much more efficient than your current approach. In general, this looks like a classical use case for Realm Resource Provider [6]. The query you described easily maps to a single SQL/JPQL statement, so you could implement a custom REST resource that would execute exactly that query and return results. Unfortunately, custom REST resources in Keycloak are public by default (protected resources should become a part of the hypothetical Admin Resource SPI somewhere in the future). However, you can implement that (relatively) easily with the techniques demonstrated in Beercloak [7]. Could you please elaborate a bit on the problems that you're facing? The export/import scenario is relevant for database upgrades (e.g. PostgreSQL 9 -> 10), but Keycloak does ship migration scripts that should upgrade the data+metadata automatically. Why doesn't that work in your case? Let us know, probably this could be fixed. Sorry it took so long to reply. Keycloak is a great product, I hope it fulfills your needs. Good luck! Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training [1] https://blog.keycloak.org/2018/01/keycloak-cross-data-center-setup- in-aws.html [2] https://www.keycloak.org/search.html?q=aws [3] https://github.com/rvansa/keycloak-benchmark [4] https://blog.codecentric.de/en/2014/12/haproxy-http-header-rate-lim iting/ [5] https://www.keycloak.org/docs-api/3.4/rest-api/index.html [6] https://www.keycloak.org/docs/latest/server_development/index.html# _extensions_rest [7] https://github.com/dteleguin/beercloak