Hi All, I am running multiple applications deployed on a Jboss cluster with infinispan used as a cache and for distributed sessions. I verified and can see that session replication is working for a normal application where I can see the same session on all the servers in the cluster and hence the application is working fine without session stickiness. However when I am trying to use any Keycloak SAML client based application it is only working if the request is going to a particular box in the cluster. On all the other boxes we are getting errors. >From this behavior I am concluding that somehow for Keycloak based applications sessions are not getting replicated. Both these applications has <distributable /> tag in them so I am not sure why it is showing different behaviour. I know we can fix this by just enabling session stickiness but we want the sessions to be replicated as well. This is because we want to make our set up more resilient. Also in case of logout when Keycloak is sending a back channel logout request it amy send it to any server in the cluster. If the sessions are not properly replicated then the logout will fail as the session will remain preserved on some other server in the cluster. Can someone please suggest me something what to try.

We can't really move to OIDC as we have already used SAML for a number of apps. Is clustering not supported by SAML client adapters for Jboss? Regards, Pulkit On Fri, Jan 20, 2017 at 1:47 PM, Marek Posolda <mposolda(a)redhat.com <mailto:mposolda@redhat.com>> wrote: This is supposed to work for Keycloak OIDC clients and some docs is here https://keycloak.gitbooks.io/securing-client-applications-guide/content/t... <https://keycloak.gitbooks.io/securing-client-applications-guide/content/t... . I don't know about Keycloak SAML clients. Is it an alternative for you to try OIDC instead of SAML? Marek On 20/01/17 08:19, Pulkit Gupta wrote: Hi All, I am running multiple applications deployed on a Jboss cluster with infinispan used as a cache and for distributed sessions. I verified and can see that session replication is working for a normal application where I can see the same session on all the servers in the cluster and hence the application is working fine without session stickiness. However when I am trying to use any Keycloak SAML client based application it is only working if the request is going to a particular box in the cluster. On all the other boxes we are getting errors. >From this behavior I am concluding that somehow for Keycloak based applications sessions are not getting replicated. Both these applications has <distributable /> tag in them so I am not sure why it is showing different behaviour. I know we can fix this by just enabling session stickiness but we want the sessions to be replicated as well. This is because we want to make our set up more resilient. Also in case of logout when Keycloak is sending a back channel logout request it amy send it to any server in the cluster. If the sessions are not properly replicated then the logout will fail as the session will remain preserved on some other server in the cluster. Can someone please suggest me something what to try. -- Thanks, Pulkit AMS

Thanks Marek, I worked more around this and now the sessions are getting replicated across the cluster for our applications. However still I can see that when we logout we are able to login back without entering the credentials. This happens most of the times but a few times we are logged out correctly. I am not sure why the logout is not ending the user session and why we are able to visit the protected resource without re authenticating. Can you please suggest something where can I look. Regards, Pulkit On Mon, Jan 23, 2017 at 2:04 PM, Marek Posolda <mposolda(a)redhat.com&gt; wrote: > I don't see anything in our documentation for Keycloak SAML adapter. Not > sure if we support clustering or not. Maybe someone else knows. > > But I think that if you have <distributable /> in your applications and > it still doesn't work, then feel free to create JIRA. > > Marek > > On 20/01/17 17:29, Pulkit Gupta wrote: > > We can't really move to OIDC as we have already used SAML for a number of > apps. > Is clustering not supported by SAML client adapters for Jboss? > > Regards, > Pulkit > > > On Fri, Jan 20, 2017 at 1:47 PM, Marek Posolda <mposolda(a)redhat.com&gt; > wrote: > >> This is supposed to work for Keycloak OIDC clients and some docs is here >> https://keycloak.gitbooks.io/securing-client-applications-gu >> ide/content/topics/oidc/java/application-clustering.html . >> >> I don't know about Keycloak SAML clients. Is it an alternative for you >> to try OIDC instead of SAML? >> >> Marek >> >> On 20/01/17 08:19, Pulkit Gupta wrote: >> >>> Hi All, >>> >>> I am running multiple applications deployed on a Jboss cluster with >>> infinispan used as a cache and for distributed sessions. >>> I verified and can see that session replication is working for a normal >>> application where I can see the same session on all the servers in the >>> cluster and hence the application is working fine without session >>> stickiness. >>> >>> However when I am trying to use any Keycloak SAML client based >>> application >>> it is only working if the request is going to a particular box in the >>> cluster. On all the other boxes we are getting errors. >>> >From this behavior I am concluding that somehow for Keycloak based >>> applications sessions are not getting replicated. >>> Both these applications has <distributable /> tag in them so I am not >>> sure >>> why it is showing different behaviour. >>> >>> I know we can fix this by just enabling session stickiness but we want >>> the >>> sessions to be replicated as well. >>> This is because we want to make our set up more resilient. Also in case >>> of >>> logout when Keycloak is sending a back channel logout request it amy >>> send >>> it to any server in the cluster. >>> If the sessions are not properly replicated then the logout will fail as >>> the session will remain preserved on some other server in the cluster. >>> >>> Can someone please suggest me something what to try. >>> >>> >> > > > -- > Thanks, > Pulkit > AMS > > > -- Thanks, Pulkit AMS

There's quite a lot of useful information in this thread. Could you please file a JIRA issue with a reference to this thread? Thank you --Hynek On Wed, Jan 25, 2017 at 11:08 AM, Pulkit Gupta <pulgupta(a)redhat.com&gt; wrote: > Hi Marek, > > In continuation to the previous mail I can see that the SAML assertion is > getting deleted but the individual sessions within different applications > are getting maintained. > And thus the user is able to login back to the applications which he was > using. > But if he is opening a new application for the first time and as there is > no existing session and SAML assertion is already deleted he is correctly > asked to enter his credentials. > I think this will be helpful for you to pin point the issue. > > Regards, > Pulkit > > On Wed, Jan 25, 2017 at 1:59 PM, Pulkit Gupta <pulgupta(a)redhat.com&gt; wrote: > >> Thanks Marek, >> >> I worked more around this and now the sessions are getting replicated >> across the cluster for our applications. >> >> However still I can see that when we logout we are able to login back >> without entering the credentials. >> This happens most of the times but a few times we are logged out correctly. >> >> I am not sure why the logout is not ending the user session and why we are >> able to visit the protected resource without re authenticating. >> Can you please suggest something where can I look. >> >> Regards, >> Pulkit >> >> >> >> On Mon, Jan 23, 2017 at 2:04 PM, Marek Posolda <mposolda(a)redhat.com&gt; >> wrote: >> >>> I don't see anything in our documentation for Keycloak SAML adapter. Not >>> sure if we support clustering or not. Maybe someone else knows. >>> >>> But I think that if you have <distributable /> in your applications and >>> it still doesn't work, then feel free to create JIRA. >>> >>> Marek >>> >>> On 20/01/17 17:29, Pulkit Gupta wrote: >>> >>> We can't really move to OIDC as we have already used SAML for a number of >>> apps. >>> Is clustering not supported by SAML client adapters for Jboss? >>> >>> Regards, >>> Pulkit >>> >>> >>> On Fri, Jan 20, 2017 at 1:47 PM, Marek Posolda <mposolda(a)redhat.com&gt; >>> wrote: >>> >>>> This is supposed to work for Keycloak OIDC clients and some docs is here >>>> https://keycloak.gitbooks.io/securing-client-applications-gu >>>> ide/content/topics/oidc/java/application-clustering.html . >>>> >>>> I don't know about Keycloak SAML clients. Is it an alternative for you >>>> to try OIDC instead of SAML? >>>> >>>> Marek >>>> >>>> On 20/01/17 08:19, Pulkit Gupta wrote: >>>> >>>>> Hi All, >>>>> >>>>> I am running multiple applications deployed on a Jboss cluster with >>>>> infinispan used as a cache and for distributed sessions. >>>>> I verified and can see that session replication is working for a normal >>>>> application where I can see the same session on all the servers in the >>>>> cluster and hence the application is working fine without session >>>>> stickiness. >>>>> >>>>> However when I am trying to use any Keycloak SAML client based >>>>> application >>>>> it is only working if the request is going to a particular box in the >>>>> cluster. On all the other boxes we are getting errors. >>>>> >From this behavior I am concluding that somehow for Keycloak based >>>>> applications sessions are not getting replicated. >>>>> Both these applications has <distributable /> tag in them so I am not >>>>> sure >>>>> why it is showing different behaviour. >>>>> >>>>> I know we can fix this by just enabling session stickiness but we want >>>>> the >>>>> sessions to be replicated as well. >>>>> This is because we want to make our set up more resilient. Also in case >>>>> of >>>>> logout when Keycloak is sending a back channel logout request it amy >>>>> send >>>>> it to any server in the cluster. >>>>> If the sessions are not properly replicated then the logout will fail as >>>>> the session will remain preserved on some other server in the cluster. >>>>> >>>>> Can someone please suggest me something what to try. >>>>> >>>>> >>>> >>> >>> >>> -- >>> Thanks, >>> Pulkit >>> AMS >>> >>> >>> >> >> >> -- >> Thanks, >> Pulkit >> AMS >> > > > > -- > Thanks, > Pulkit > AMS > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user -- --Hynek