10:27 a.m.
Hi Team,
We are facing similar problem where kelcloak is not running in cluster and
giving the same error log as mentioned by Subash in jira.
https://issues.jboss.org/browse/KEYCLOAK-5013
I tried to use the private interface as suggested into the document but
still no luck.
am I missing anything else? CAN YOU please help?? I am using Keycloak -
Version 3.2.1.Final.
I have load balancer configured above 2 keycloak nodes (nodes are running in
on different VMs)
Start command :
nohup ./bin/standalone.sh --server-config=standalone-ha.xml -b $HOSTNAME -u
230.0.0.4 &
HA configuration :
<interface name="private">
<inet-address value="$
{jboss.bind.address.private:(node1 IP address and on second node that IP
address)}
" />
</interface>
</interfaces>
<socket-binding-group name="standard-sockets"
default-interface="public" port-offset="$
{jboss.socket.binding.port-offset:0}
">
<socket-binding name="management-http" interface="private"
port="$
{jboss.management.http.port:9990}
" />
<socket-binding name="management-https" interface="private"
port="$
{jboss.management.https.port:9993}
" />
<socket-binding name="ajp" port="$
{jboss.ajp.port:8009}
" />
<socket-binding name="http" port="$
{jboss.http.port:8080}
" />
<socket-binding name="https" port="$
{jboss.https.port:8443}
" />
<socket-binding name="proxy-https" port="443"/>
<socket-binding name="jgroups-mping" interface="private"
port="0" multicast-address="$
{jboss.default.multicast.address:230.0.0.4}
"
multicast-port="45700" />
<socket-binding name="jgroups-tcp" interface="private"
port="7600" />
<socket-binding name="jgroups-tcp-fd" interface="private"
port="57600" />
<socket-binding name="jgroups-udp" interface="private"
port="55200" multicast-address="$
{jboss.default.multicast.address:230.0.0.4}
"
multicast-port="45688" />
<socket-binding name="jgroups-udp-fd" interface="private"
port="54200" />
<socket-binding name="modcluster" port="0"
multicast-address="224.0.1.105" multicast-port="23364" />
<socket-binding name="txn-recovery-environment" port="4712" />
<socket-binding name="txn-status-manager" port="4713" />
<outbound-socket-binding name="mail-smtp">
<remote-destination host="localhost" port="25" />
</outbound-socket-binding>
</socket-binding-group>
Log :
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000094: Received new cluster view for channel hibernate:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,750 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-4) ISPN000094: Received new cluster view for channel ejb:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,750 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000094: Received new cluster view for channel server:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000094: Received new cluster view for channel web:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,761 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000079: Channel keycloak local address is keycloak2,
physical addresses are [**.**.**.**]
2017-11-09 04:38:22,763 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000079: Channel web local address is keycloak2, physical
addresses are [**.**.**.**]
--
Sent from: http://keycloak-user.88327.x6.nabble.com/
10:46 a.m.
hi, we have a similar setup which is working with 3.2.1.Final. we have
since upgraded to 3.3.0.Final.
I'm assuming that you are private interface because you are using a web
proxy? however, to achieve what you need i think you may have to make the
jgroups public interface. we have used tcp ping successfully in this way.
On Thu, Nov 9, 2017 at 9:27 AM, mahendra sonawale <mahson1(a)gmail.com> wrote:
Hi Team,
We are facing similar problem where kelcloak is not running in cluster and
giving the same error log as mentioned by Subash in jira.
https://issues.jboss.org/browse/KEYCLOAK-5013
I tried to use the private interface as suggested into the document but
still no luck.
am I missing anything else? CAN YOU please help?? I am using Keycloak -
Version 3.2.1.Final.
I have load balancer configured above 2 keycloak nodes (nodes are running
in
on different VMs)
Start command :
nohup ./bin/standalone.sh --server-config=standalone-ha.xml -b $HOSTNAME
-u
230.0.0.4 &
HA configuration :
<interface name="private">
<inet-address value="$
{jboss.bind.address.private:(node1 IP address and on second node that IP
address)}
" />
</interface>
</interfaces>
<socket-binding-group name="standard-sockets"
default-interface="public" port-offset="$
{jboss.socket.binding.port-offset:0}
">
<socket-binding name="management-http" interface="private"
port="$
{jboss.management.http.port:9990}
" />
<socket-binding name="management-https" interface="private"
port="$
{jboss.management.https.port:9993}
" />
<socket-binding name="ajp" port="$
{jboss.ajp.port:8009}
" />
<socket-binding name="http" port="$
{jboss.http.port:8080}
" />
<socket-binding name="https" port="$
{jboss.https.port:8443}
" />
<socket-binding name="proxy-https" port="443"/>
<socket-binding name="jgroups-mping" interface="private"
port="0" multicast-address="$
{jboss.default.multicast.address:230.0.0.4}
"
multicast-port="45700" />
<socket-binding name="jgroups-tcp" interface="private"
port="7600" />
<socket-binding name="jgroups-tcp-fd" interface="private"
port="57600" />
<socket-binding name="jgroups-udp" interface="private"
port="55200" multicast-address="$
{jboss.default.multicast.address:230.0.0.4}
"
multicast-port="45688" />
<socket-binding name="jgroups-udp-fd" interface="private"
port="54200" />
<socket-binding name="modcluster" port="0"
multicast-address="224.0.1.105" multicast-port="23364" />
<socket-binding name="txn-recovery-environment" port="4712" />
<socket-binding name="txn-status-manager" port="4713" />
<outbound-socket-binding name="mail-smtp">
<remote-destination host="localhost" port="25" />
</outbound-socket-binding>
</socket-binding-group>
Log :
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000094: Received new cluster view for channel hibernate:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,750 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-4) ISPN000094: Received new cluster view for channel ejb:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,750 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000094: Received new cluster view for channel server:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000094: Received new cluster view for channel web:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,761 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000079: Channel keycloak local address is keycloak2,
physical addresses are [**.**.**.**]
2017-11-09 04:38:22,763 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000079: Channel web local address is keycloak2, physical
addresses are [**.**.**.**]
--
Sent from: http://keycloak-user.88327.x6.nabble.com/
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
11:36 a.m.
Hello Simon,
Thank you for the response.
yes, we are using proxy - APACHE HTTPD configuration PFB the same.
I tried to make the jpgroups public (kept the public interface IP as our
node server actual IP but no luck still the servers are logs are not
showing new cluster node.
apache proxy configuration:
-------------------------------------
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule remoteip_module modules/mod_remoteip.so
ProxyPreserveHost On
LimitRequestFieldSize 163840
LimitRequestLine 163840
#<VirtualHost _default_:80>
ServerName rapid.gi-de.com:443
ErrorLog /opt<dir>/fiam_error_log
CustomLog /<dir>/fiam_access_log combined
LogLevel warn
RequestHeader set X-Forwarded-Proto "https"
<Proxy https://abc.ac-bc.com/* >
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# not rewrite css, js and images
RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
RewriteRule ^(.*)$ /auth [NC,L,QSA]
#Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Proxy>
ProxyPass /auth http://<server IP>:8080/auth
ProxyPassReverse /auth http://<server IP>:8080/auth
-------------------------------------------------
PFB the logs: (tried to run the changes only on 2nd node)
2017-11-09 11:26:20,169 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-6) ISPN000094: Received new cluster view for channel server:
[muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000094: Received new cluster view for channel keycloak:
[muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-5) ISPN000094: Received new cluster view for channel hibernate:
[muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-4) ISPN000094: Received new cluster view for channel ejb:
[muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,175 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000094: Received new cluster view for channel web:
[muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,177 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-6) ISPN000079: Channel server local address is muc1rapidv2s,
physical addresses are *******
Please guide.
Thanks,
Mahendra Sonawale
Ph +91 9130775865
On Thu, Nov 9, 2017 at 3:16 PM, Simon Payne <simonpayne58(a)gmail.com> wrote:
hi, we have a similar setup which is working with 3.2.1.Final. we
have
since upgraded to 3.3.0.Final.
I'm assuming that you are private interface because you are using a web
proxy? however, to achieve what you need i think you may have to make the
jgroups public interface. we have used tcp ping successfully in this way.
On Thu, Nov 9, 2017 at 9:27 AM, mahendra sonawale <mahson1(a)gmail.com>
wrote:
> Hi Team,
>
> We are facing similar problem where kelcloak is not running in cluster and
> giving the same error log as mentioned by Subash in jira.
>
> https://issues.jboss.org/browse/KEYCLOAK-5013
>
> I tried to use the private interface as suggested into the document but
> still no luck.
> am I missing anything else? CAN YOU please help?? I am using Keycloak -
> Version 3.2.1.Final.
> I have load balancer configured above 2 keycloak nodes (nodes are running
> in
> on different VMs)
>
> Start command :
> nohup ./bin/standalone.sh --server-config=standalone-ha.xml -b $HOSTNAME
> -u
> 230.0.0.4 &
>
> HA configuration :
> <interface name="private">
> <inet-address value="$
> {jboss.bind.address.private:(node1 IP address and on second node that IP
> address)}
> " />
> </interface>
> </interfaces>
> <socket-binding-group name="standard-sockets"
> default-interface="public" port-offset="$
> {jboss.socket.binding.port-offset:0}
> ">
> <socket-binding name="management-http" interface="private"
> port="$
> {jboss.management.http.port:9990}
> " />
> <socket-binding name="management-https" interface="private"
> port="$
> {jboss.management.https.port:9993}
> " />
> <socket-binding name="ajp" port="$
> {jboss.ajp.port:8009}
> " />
> <socket-binding name="http" port="$
> {jboss.http.port:8080}
> " />
> <socket-binding name="https" port="$
> {jboss.https.port:8443}
> " />
> <socket-binding name="proxy-https" port="443"/>
> <socket-binding name="jgroups-mping" interface="private"
> port="0" multicast-address="$
> {jboss.default.multicast.address:230.0.0.4}
> "
> multicast-port="45700" />
> <socket-binding name="jgroups-tcp" interface="private"
> port="7600" />
> <socket-binding name="jgroups-tcp-fd" interface="private"
> port="57600" />
> <socket-binding name="jgroups-udp" interface="private"
> port="55200" multicast-address="$
> {jboss.default.multicast.address:230.0.0.4}
> "
> multicast-port="45688" />
> <socket-binding name="jgroups-udp-fd" interface="private"
> port="54200" />
> <socket-binding name="modcluster" port="0"
> multicast-address="224.0.1.105" multicast-port="23364" />
> <socket-binding name="txn-recovery-environment" port="4712"
/>
> <socket-binding name="txn-status-manager" port="4713" />
> <outbound-socket-binding name="mail-smtp">
> <remote-destination host="localhost" port="25" />
> </outbound-socket-binding>
> </socket-binding-group>
> Log :
> 2017-11-09 04:38:22,749 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-3) ISPN000094: Received new cluster view for channel hibernate:
> [keycloak2|0] (1) [keycloak2]
> 2017-11-09 04:38:22,750 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
> [keycloak2|0] (1) [keycloak2]
> 2017-11-09 04:38:22,749 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-4) ISPN000094: Received new cluster view for channel ejb:
> [keycloak2|0] (1) [keycloak2]
> 2017-11-09 04:38:22,750 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-7) ISPN000094: Received new cluster view for channel server:
> [keycloak2|0] (1) [keycloak2]
> 2017-11-09 04:38:22,749 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-1) ISPN000094: Received new cluster view for channel web:
> [keycloak2|0] (1) [keycloak2]
> 2017-11-09 04:38:22,761 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-2) ISPN000079: Channel keycloak local address is keycloak2,
> physical addresses are [**.**.**.**]
> 2017-11-09 04:38:22,763 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-1) ISPN000079: Channel web local address is keycloak2, physical
> addresses are [**.**.**.**]
>
>
>
> --
> Sent from: http://keycloak-user.88327.x6.nabble.com/
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
12:17 p.m.
did you provide the machine ip address for the public interface when you
start keycloak? i start my keycloak using
/opt/jboss/keycloak/bin/standalone.sh -c standalone-ha.xml -b x.x.x.x
On Thu, Nov 9, 2017 at 10:36 AM, mahendra sonawale <mahson1(a)gmail.com>
wrote:
Hello Simon,
Thank you for the response.
yes, we are using proxy - APACHE HTTPD configuration PFB the same.
I tried to make the jpgroups public (kept the public interface IP as our
node server actual IP but no luck still the servers are logs are not
showing new cluster node.
apache proxy configuration:
-------------------------------------
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule remoteip_module modules/mod_remoteip.so
ProxyPreserveHost On
LimitRequestFieldSize 163840
LimitRequestLine 163840
#<VirtualHost _default_:80>
ServerName rapid.gi-de.com:443
ErrorLog /opt<dir>/fiam_error_log
CustomLog /<dir>/fiam_access_log combined
LogLevel warn
RequestHeader set X-Forwarded-Proto "https"
<Proxy https://abc.ac-bc.com/* >
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# not rewrite css, js and images
RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
RewriteRule ^(.*)$ /auth [NC,L,QSA]
#Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Proxy>
ProxyPass /auth http://<server IP>:8080/auth
ProxyPassReverse /auth http://<server IP>:8080/auth
-------------------------------------------------
PFB the logs: (tried to run the changes only on 2nd node)
2017-11-09 11:26:20,169 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(MSC service thread 1-6) ISPN000094: Received new cluster view for channel
server: [muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(MSC service thread 1-7) ISPN000094: Received new cluster view for channel
keycloak: [muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(MSC service thread 1-5) ISPN000094: Received new cluster view for channel
hibernate: [muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(MSC service thread 1-4) ISPN000094: Received new cluster view for channel
ejb: [muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,175 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(MSC service thread 1-3) ISPN000094: Received new cluster view for channel
web: [muc1rapidv2s|0] (1) [muc1rapidv2s]
2017-11-09 11:26:20,177 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
(MSC service thread 1-6) ISPN000079: Channel server local address is
muc1rapidv2s, physical addresses are *******
Please guide.
Thanks,
Mahendra Sonawale
Ph +91 9130775865 <+91%2091307%2075865>
On Thu, Nov 9, 2017 at 3:16 PM, Simon Payne <simonpayne58(a)gmail.com>
wrote:
> hi, we have a similar setup which is working with 3.2.1.Final. we have
> since upgraded to 3.3.0.Final.
>
> I'm assuming that you are private interface because you are using a web
> proxy? however, to achieve what you need i think you may have to make the
> jgroups public interface. we have used tcp ping successfully in this way.
>
>
>
>
> On Thu, Nov 9, 2017 at 9:27 AM, mahendra sonawale <mahson1(a)gmail.com>
> wrote:
>
>> Hi Team,
>>
>> We are facing similar problem where kelcloak is not running in cluster
>> and
>> giving the same error log as mentioned by Subash in jira.
>>
>> https://issues.jboss.org/browse/KEYCLOAK-5013
>>
>> I tried to use the private interface as suggested into the document but
>> still no luck.
>> am I missing anything else? CAN YOU please help?? I am using Keycloak -
>> Version 3.2.1.Final.
>> I have load balancer configured above 2 keycloak nodes (nodes are
>> running in
>> on different VMs)
>>
>> Start command :
>> nohup ./bin/standalone.sh --server-config=standalone-ha.xml -b
>> $HOSTNAME -u
>> 230.0.0.4 &
>>
>> HA configuration :
>> <interface name="private">
>> <inet-address value="$
>> {jboss.bind.address.private:(node1 IP address and on second node that IP
>> address)}
>> " />
>> </interface>
>> </interfaces>
>> <socket-binding-group name="standard-sockets"
>> default-interface="public" port-offset="$
>> {jboss.socket.binding.port-offset:0}
>> ">
>> <socket-binding name="management-http"
interface="private"
>> port="$
>> {jboss.management.http.port:9990}
>> " />
>> <socket-binding name="management-https"
interface="private"
>> port="$
>> {jboss.management.https.port:9993}
>> " />
>> <socket-binding name="ajp" port="$
>> {jboss.ajp.port:8009}
>> " />
>> <socket-binding name="http" port="$
>> {jboss.http.port:8080}
>> " />
>> <socket-binding name="https" port="$
>> {jboss.https.port:8443}
>> " />
>> <socket-binding name="proxy-https" port="443"/>
>> <socket-binding name="jgroups-mping" interface="private"
>> port="0" multicast-address="$
>> {jboss.default.multicast.address:230.0.0.4}
>> "
>> multicast-port="45700" />
>> <socket-binding name="jgroups-tcp" interface="private"
>> port="7600" />
>> <socket-binding name="jgroups-tcp-fd" interface="private"
>> port="57600" />
>> <socket-binding name="jgroups-udp" interface="private"
>> port="55200" multicast-address="$
>> {jboss.default.multicast.address:230.0.0.4}
>> "
>> multicast-port="45688" />
>> <socket-binding name="jgroups-udp-fd" interface="private"
>> port="54200" />
>> <socket-binding name="modcluster" port="0"
>> multicast-address="224.0.1.105" multicast-port="23364" />
>> <socket-binding name="txn-recovery-environment"
port="4712" />
>> <socket-binding name="txn-status-manager" port="4713"
/>
>> <outbound-socket-binding name="mail-smtp">
>> <remote-destination host="localhost" port="25" />
>> </outbound-socket-binding>
>> </socket-binding-group>
>> Log :
>> 2017-11-09 04:38:22,749 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-3) ISPN000094: Received new cluster view for channel hibernate:
>> [keycloak2|0] (1) [keycloak2]
>> 2017-11-09 04:38:22,750 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
>> [keycloak2|0] (1) [keycloak2]
>> 2017-11-09 04:38:22,749 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-4) ISPN000094: Received new cluster view for channel ejb:
>> [keycloak2|0] (1) [keycloak2]
>> 2017-11-09 04:38:22,750 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-7) ISPN000094: Received new cluster view for channel server:
>> [keycloak2|0] (1) [keycloak2]
>> 2017-11-09 04:38:22,749 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-1) ISPN000094: Received new cluster view for channel web:
>> [keycloak2|0] (1) [keycloak2]
>> 2017-11-09 04:38:22,761 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-2) ISPN000079: Channel keycloak local address is keycloak2,
>> physical addresses are [**.**.**.**]
>> 2017-11-09 04:38:22,763 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-1) ISPN000079: Channel web local address is keycloak2, physical
>> addresses are [**.**.**.**]
>>
>>
>>
>> --
>> Sent from: http://keycloak-user.88327.x6.nabble.com/
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
12:34 p.m.
Hello Simon,
yes, I did provide server IP into public interface as well as into private
interface..
in another reply I have been asked to check multicast
(You can look for the value in
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
In our production linux env the value is 1 -- does that really affect??
and would that be the only cause?
Currently configuration are as below: (changed the ip to some random)
<interfaces>
<interface name="management">
<inet-address
value="${jboss.bind.address.management:127.0.0.1}" />
</interface>
<interface name="public">
<inet-address value="${jboss.bind.address:1.2.3.4}"
/>
</interface>
<interface name="private">
<inet-address
value="${jboss.bind.address.private:1.2.3.4}" />
</interface>
</interfaces>
<socket-binding-group name="standard-sockets"
default-interface="public"
port-offset="${jboss.socket.binding.port-offset:0}">
<socket-binding name="management-http"
interface="private"
port="${jboss.management.http.port:9990}" />
<socket-binding name="management-https"
interface="private"
port="${jboss.management.https.port:9993}" />
<socket-binding name="ajp"
port="${jboss.ajp.port:8009}" />
<socket-binding name="http"
port="${jboss.http.port:8080}"
/>
<socket-binding name="https"
port="${jboss.https.port:8443}" />
<socket-binding name="proxy-https" port="443"/>
<socket-binding name="jgroups-mping"
interface="public"
port="0"
multicast-address="${jboss.default.multicast.address:230.0.0.4}"
multicast-port="45700" />
<socket-binding name="jgroups-tcp"
interface="public"
port="7600" />
<socket-binding name="jgroups-tcp-fd"
interface="public"
port="57600" />
<socket-binding name="jgroups-udp"
interface="public"
port="55200"
multicast-address="${jboss.default.multicast.address:230.0.0.4}"
multicast-port="45688" />
<socket-binding name="jgroups-udp-fd"
interface="public"
port="54200" />
<socket-binding name="modcluster" port="0"
multicast-address="224.0.1.105"
multicast-port="23364" />
<socket-binding name="txn-recovery-environment"
port="4712"
/>
<socket-binding name="txn-status-manager"
port="4713" />
<outbound-socket-binding name="mail-smtp">
<remote-destination host="localhost"
port="25" />
</outbound-socket-binding>
</socket-binding-group>
On Thu, Nov 9, 2017 at 4:47 PM, Simon Payne <simonpayne58(a)gmail.com> wrote:
did you provide the machine ip address for the public interface when
you
start keycloak? i start my keycloak using /opt/jboss/keycloak/bin/standalone.sh
-c standalone-ha.xml -b x.x.x.x
On Thu, Nov 9, 2017 at 10:36 AM, mahendra sonawale <mahson1(a)gmail.com>
wrote:
> Hello Simon,
>
> Thank you for the response.
> yes, we are using proxy - APACHE HTTPD configuration PFB the same.
> I tried to make the jpgroups public (kept the public interface IP as our
> node server actual IP but no luck still the servers are logs are not
> showing new cluster node.
>
> apache proxy configuration:
>
> -------------------------------------
> LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
> LoadModule remoteip_module modules/mod_remoteip.so
>
> ProxyPreserveHost On
> LimitRequestFieldSize 163840
> LimitRequestLine 163840
>
> #<VirtualHost _default_:80>
> ServerName rapid.gi-de.com:443
> ErrorLog /opt<dir>/fiam_error_log
> CustomLog /<dir>/fiam_access_log combined
> LogLevel warn
>
> RequestHeader set X-Forwarded-Proto "https"
>
> <Proxy https://abc.ac-bc.com/* >
> RewriteEngine on
> RewriteCond %{REQUEST_FILENAME} !-f
> RewriteCond %{REQUEST_FILENAME} !-d
> # not rewrite css, js and images
> RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
> RewriteRule ^(.*)$ /auth [NC,L,QSA]
> #Options -Indexes FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
> </Proxy>
>
>
> ProxyPass /auth http://<server IP>:8080/auth
> ProxyPassReverse /auth http://<server IP>:8080/auth
>
> -------------------------------------------------
>
> PFB the logs: (tried to run the changes only on 2nd node)
>
> 2017-11-09 11:26:20,169 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (MSC service thread 1-6) ISPN000094: Received new cluster view for channel
> server: [muc1rapidv2s|0] (1) [muc1rapidv2s]
> 2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (MSC service thread 1-7) ISPN000094: Received new cluster view for channel
> keycloak: [muc1rapidv2s|0] (1) [muc1rapidv2s]
> 2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (MSC service thread 1-5) ISPN000094: Received new cluster view for channel
> hibernate: [muc1rapidv2s|0] (1) [muc1rapidv2s]
> 2017-11-09 11:26:20,174 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (MSC service thread 1-4) ISPN000094: Received new cluster view for channel
> ejb: [muc1rapidv2s|0] (1) [muc1rapidv2s]
> 2017-11-09 11:26:20,175 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (MSC service thread 1-3) ISPN000094: Received new cluster view for channel
> web: [muc1rapidv2s|0] (1) [muc1rapidv2s]
> 2017-11-09 11:26:20,177 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (MSC service thread 1-6) ISPN000079: Channel server local address is
> muc1rapidv2s, physical addresses are *******
>
>
> Please guide.
>
>
> Thanks,
> Mahendra Sonawale
> Ph +91 9130775865 <+91%2091307%2075865>
>
> On Thu, Nov 9, 2017 at 3:16 PM, Simon Payne <simonpayne58(a)gmail.com>
> wrote:
>
>> hi, we have a similar setup which is working with 3.2.1.Final. we have
>> since upgraded to 3.3.0.Final.
>>
>> I'm assuming that you are private interface because you are using a web
>> proxy? however, to achieve what you need i think you may have to make the
>> jgroups public interface. we have used tcp ping successfully in this way.
>>
>>
>>
>>
>> On Thu, Nov 9, 2017 at 9:27 AM, mahendra sonawale <mahson1(a)gmail.com>
>> wrote:
>>
>>> Hi Team,
>>>
>>> We are facing similar problem where kelcloak is not running in cluster
>>> and
>>> giving the same error log as mentioned by Subash in jira.
>>>
>>> https://issues.jboss.org/browse/KEYCLOAK-5013
>>>
>>> I tried to use the private interface as suggested into the document but
>>> still no luck.
>>> am I missing anything else? CAN YOU please help?? I am using Keycloak -
>>> Version 3.2.1.Final.
>>> I have load balancer configured above 2 keycloak nodes (nodes are
>>> running in
>>> on different VMs)
>>>
>>> Start command :
>>> nohup ./bin/standalone.sh --server-config=standalone-ha.xml -b
>>> $HOSTNAME -u
>>> 230.0.0.4 &
>>>
>>> HA configuration :
>>> <interface name="private">
>>> <inet-address value="$
>>> {jboss.bind.address.private:(node1 IP address and on second node that
>>> IP
>>> address)}
>>> " />
>>> </interface>
>>> </interfaces>
>>> <socket-binding-group name="standard-sockets"
>>> default-interface="public" port-offset="$
>>> {jboss.socket.binding.port-offset:0}
>>> ">
>>> <socket-binding name="management-http"
interface="private"
>>> port="$
>>> {jboss.management.http.port:9990}
>>> " />
>>> <socket-binding name="management-https"
interface="private"
>>> port="$
>>> {jboss.management.https.port:9993}
>>> " />
>>> <socket-binding name="ajp" port="$
>>> {jboss.ajp.port:8009}
>>> " />
>>> <socket-binding name="http" port="$
>>> {jboss.http.port:8080}
>>> " />
>>> <socket-binding name="https" port="$
>>> {jboss.https.port:8443}
>>> " />
>>> <socket-binding name="proxy-https" port="443"/>
>>> <socket-binding name="jgroups-mping"
interface="private"
>>> port="0" multicast-address="$
>>> {jboss.default.multicast.address:230.0.0.4}
>>> "
>>> multicast-port="45700" />
>>> <socket-binding name="jgroups-tcp"
interface="private"
>>> port="7600" />
>>> <socket-binding name="jgroups-tcp-fd"
interface="private"
>>> port="57600" />
>>> <socket-binding name="jgroups-udp"
interface="private"
>>> port="55200" multicast-address="$
>>> {jboss.default.multicast.address:230.0.0.4}
>>> "
>>> multicast-port="45688" />
>>> <socket-binding name="jgroups-udp-fd"
interface="private"
>>> port="54200" />
>>> <socket-binding name="modcluster" port="0"
>>> multicast-address="224.0.1.105" multicast-port="23364"
/>
>>> <socket-binding name="txn-recovery-environment"
port="4712" />
>>> <socket-binding name="txn-status-manager" port="4713"
/>
>>> <outbound-socket-binding name="mail-smtp">
>>> <remote-destination host="localhost" port="25" />
>>> </outbound-socket-binding>
>>> </socket-binding-group>
>>> Log :
>>> 2017-11-09 04:38:22,749 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-3) ISPN000094: Received new cluster view for channel hibernate:
>>> [keycloak2|0] (1) [keycloak2]
>>> 2017-11-09 04:38:22,750 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
>>> [keycloak2|0] (1) [keycloak2]
>>> 2017-11-09 04:38:22,749 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-4) ISPN000094: Received new cluster view for channel ejb:
>>> [keycloak2|0] (1) [keycloak2]
>>> 2017-11-09 04:38:22,750 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-7) ISPN000094: Received new cluster view for channel server:
>>> [keycloak2|0] (1) [keycloak2]
>>> 2017-11-09 04:38:22,749 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-1) ISPN000094: Received new cluster view for channel web:
>>> [keycloak2|0] (1) [keycloak2]
>>> 2017-11-09 04:38:22,761 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-2) ISPN000079: Channel keycloak local address is keycloak2,
>>> physical addresses are [**.**.**.**]
>>> 2017-11-09 04:38:22,763 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-1) ISPN000079: Channel web local address is keycloak2, physical
>>> addresses are [**.**.**.**]
>>>
>>>
>>>
>>> --
>>> Sent from: http://keycloak-user.88327.x6.nabble.com/
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
2:05 p.m.
2017-11-09 12:34 GMT+01:00 mahendra sonawale <mahson1(a)gmail.com>:
(You can look for the value in
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
In our production linux env the value is 1 -- does that really affect??
and would that be the only cause?
Yes, it is important. At least for us, changing this value to 0 was
enough to have a working cluster.
As I understand it, the value 1 is a protection against DOS but, in
the case of Keycloak prevents each node to discover the others. In a
controlled environment (as recommended in the keycloak docs), I see no
problem enabling it.
I'm far for expert, so maybe someone will have a better idea.
2:38 p.m.
Hello Cedric/Keycloak User comm,
Sorry for getting back late over this. my set-up needs Admin team`s
intervention to change the broadcast value hence the delay in response.
I got /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts value changed to 0
And also tested the multicast set-up message test with "McastReceiverTest"
and "McastSenderTest" which works fine.
BUT KEYCLOAK is still NOT working in cluster. I get auto logged out.
PFA the HA file which I am using in my configuration.
IP addresses are dummy.
Node 1 : 1.2.3.4
Node 2 : 1.2.3.5
This all I tried.
1) Start command - nohup ./bin/standalone.sh
--server-config=standalone-ha.xml -b $HOSTNAME -u 230.0.0.4 &
2) Tried to run both the nodes with public as well as private interface -
but no luck.
3) I have hardware load balancer where SSL terminates. so domain will
communicate to the both the nodes in round robin and both nodes should be
4) PFB the HTTPD Conf
-------------------------
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule remoteip_module modules/mod_remoteip.so
ProxyPreserveHost On
LimitRequestFieldSize 163840
LimitRequestLine 163840
#<VirtualHost _default_:80>
ServerName rapid.gi-de.com:443
ErrorLog /opt/keycloak/fiam_error_log
CustomLog /opt/keycloak/fiam_access_log combined
LogLevel warn
RequestHeader set X-Forwarded-Proto "https"
<Proxy https://abc.com/* >
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# not rewrite css, js and images
RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
RewriteRule ^(.*)$ /auth [NC,L,QSA]
#Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Proxy>
ProxyPass /auth http://1.2.3.4:8080/auth
ProxyPassReverse /auth http://1.2.3.4:8080/auth
------------------
And on 2nd node only proxy pass has change in IP address as 1.2.3.5
6) Server logs:
2017-11-15 14:03:06,255 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,256 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000094: Received new cluster view for channel hibernate:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,259 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-8) ISPN000094: Received new cluster view for channel web:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,263 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000094: Received new cluster view for channel server:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,263 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000079: Channel hibernate local address is
keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
2017-11-15 14:03:06,264 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000079: Channel server local address is
keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
2017-11-15 14:03:06,264 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000094: Received new cluster view for channel ejb:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,265 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000079: Channel ejb local address is
keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
ProxyPass /auth http://1.2.3.4:8080/auth
ProxyPassReverse /auth http://1.2.3.4:8080/auth
Thanks,
Mahendra
On Thu, Nov 9, 2017 at 6:35 PM, Cédric Couralet <cedric.couralet(a)gmail.com>
wrote:
2017-11-09 12:34 GMT+01:00 mahendra sonawale
<mahson1(a)gmail.com>:
> (You can look for the value in
> /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
>
> In our production linux env the value is 1 -- does that really affect??
> and would that be the only cause?
>
Yes, it is important. At least for us, changing this value to 0 was
enough to have a working cluster.
As I understand it, the value 1 is a protection against DOS but, in
the case of Keycloak prevents each node to discover the others. In a
controlled environment (as recommended in the keycloak docs), I see no
problem enabling it.
I'm far for expert, so maybe someone will have a better idea.
3:55 p.m.
Did you check the docs? Specifically
http://www.keycloak.org/docs/latest/server_installation/index.html#multic...
On 15 November 2017 at 14:38, mahendra sonawale <mahson1(a)gmail.com> wrote:
Hello Cedric/Keycloak User comm,
Sorry for getting back late over this. my set-up needs Admin team`s
intervention to change the broadcast value hence the delay in response.
I got /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts value changed to 0
And also tested the multicast set-up message test with "McastReceiverTest"
and "McastSenderTest" which works fine.
BUT KEYCLOAK is still NOT working in cluster. I get auto logged out.
PFA the HA file which I am using in my configuration.
IP addresses are dummy.
Node 1 : 1.2.3.4
Node 2 : 1.2.3.5
This all I tried.
1) Start command - nohup ./bin/standalone.sh
--server-config=standalone-ha.xml -b $HOSTNAME -u 230.0.0.4 &
2) Tried to run both the nodes with public as well as private interface -
but no luck.
3) I have hardware load balancer where SSL terminates. so domain will
communicate to the both the nodes in round robin and both nodes should be
4) PFB the HTTPD Conf
-------------------------
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule remoteip_module modules/mod_remoteip.so
ProxyPreserveHost On
LimitRequestFieldSize 163840
LimitRequestLine 163840
#<VirtualHost _default_:80>
ServerName rapid.gi-de.com:443
ErrorLog /opt/keycloak/fiam_error_log
CustomLog /opt/keycloak/fiam_access_log combined
LogLevel warn
RequestHeader set X-Forwarded-Proto "https"
<Proxy https://abc.com/* >
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# not rewrite css, js and images
RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
RewriteRule ^(.*)$ /auth [NC,L,QSA]
#Options -Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Proxy>
ProxyPass /auth http://1.2.3.4:8080/auth
ProxyPassReverse /auth http://1.2.3.4:8080/auth
------------------
And on 2nd node only proxy pass has change in IP address as 1.2.3.5
6) Server logs:
2017-11-15 14:03:06,255 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,256 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000094: Received new cluster view for channel hibernate:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,259 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-8) ISPN000094: Received new cluster view for channel web:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,263 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000094: Received new cluster view for channel server:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,263 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000079: Channel hibernate local address is
keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
2017-11-15 14:03:06,264 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000079: Channel server local address is
keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
2017-11-15 14:03:06,264 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000094: Received new cluster view for channel ejb:
[keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
2017-11-15 14:03:06,265 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000079: Channel ejb local address is
keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
ProxyPass /auth http://1.2.3.4:8080/auth
ProxyPassReverse /auth http://1.2.3.4:8080/auth
Thanks,
Mahendra
On Thu, Nov 9, 2017 at 6:35 PM, Cédric Couralet <cedric.couralet(a)gmail.com
>
wrote:
> 2017-11-09 12:34 GMT+01:00 mahendra sonawale <mahson1(a)gmail.com>:
> > (You can look for the value in
> > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
> >
> > In our production linux env the value is 1 -- does that really
affect??
> > and would that be the only cause?
> >
>
> Yes, it is important. At least for us, changing this value to 0 was
> enough to have a working cluster.
> As I understand it, the value 1 is a protection against DOS but, in
> the case of Keycloak prevents each node to discover the others. In a
> controlled environment (as recommended in the keycloak docs), I see no
> problem enabling it.
>
> I'm far for expert, so maybe someone will have a better idea.
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
5:19 p.m.
Hello Stian,
Thank you for your reply.
I have gone through the links and reference links as well.
Trying Keycloak cluster with multicast over private interface and on
separate testing, messages are getting through with
(McastReceiverTest, McastSenderTest)
Tried my best to accommodate needed things into cluster environment and as
per my understanding looks same which is present the given guidelines .
Appreciate your help in identifying if anything is missing in config
I have been stuck here from couple of weeks :(
Have shared whatever set up we have in mail trail.
Thanks,
Mahendra Sonawale.
On Wed, Nov 15, 2017 at 8:25 PM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
Did you check the docs? Specifically
http://www.keycloak.org/docs/latest/
server_installation/index.html#multicast-network-setup
On 15 November 2017 at 14:38, mahendra sonawale <mahson1(a)gmail.com> wrote:
> Hello Cedric/Keycloak User comm,
>
> Sorry for getting back late over this. my set-up needs Admin team`s
> intervention to change the broadcast value hence the delay in response.
>
> I got /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts value changed to 0
>
> And also tested the multicast set-up message test with "McastReceiverTest"
> and "McastSenderTest" which works fine.
>
> BUT KEYCLOAK is still NOT working in cluster. I get auto logged out.
>
> PFA the HA file which I am using in my configuration.
>
> IP addresses are dummy.
> Node 1 : 1.2.3.4
> Node 2 : 1.2.3.5
>
> This all I tried.
> 1) Start command - nohup ./bin/standalone.sh
> --server-config=standalone-ha.xml -b $HOSTNAME -u 230.0.0.4 &
> 2) Tried to run both the nodes with public as well as private interface -
> but no luck.
> 3) I have hardware load balancer where SSL terminates. so domain will
> communicate to the both the nodes in round robin and both nodes should be
>
> 4) PFB the HTTPD Conf
>
> -------------------------
> LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
> LoadModule remoteip_module modules/mod_remoteip.so
>
> ProxyPreserveHost On
> LimitRequestFieldSize 163840
> LimitRequestLine 163840
>
> #<VirtualHost _default_:80>
> ServerName rapid.gi-de.com:443
> ErrorLog /opt/keycloak/fiam_error_log
> CustomLog /opt/keycloak/fiam_access_log combined
> LogLevel warn
>
> RequestHeader set X-Forwarded-Proto "https"
>
> <Proxy https://abc.com/* >
> RewriteEngine on
> RewriteCond %{REQUEST_FILENAME} !-f
> RewriteCond %{REQUEST_FILENAME} !-d
> # not rewrite css, js and images
> RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
> RewriteRule ^(.*)$ /auth [NC,L,QSA]
> #Options -Indexes FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
> </Proxy>
>
>
> ProxyPass /auth http://1.2.3.4:8080/auth
> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>
> ------------------
> And on 2nd node only proxy pass has change in IP address as 1.2.3.5
>
> 6) Server logs:
> 2017-11-15 14:03:06,255 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
> 2017-11-15 14:03:06,256 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-7) ISPN000094: Received new cluster view for channel hibernate:
> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
> 2017-11-15 14:03:06,259 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-8) ISPN000094: Received new cluster view for channel web:
> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
> 2017-11-15 14:03:06,263 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-1) ISPN000094: Received new cluster view for channel server:
> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
> 2017-11-15 14:03:06,263 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-7) ISPN000079: Channel hibernate local address is
> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
> 2017-11-15 14:03:06,264 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-1) ISPN000079: Channel server local address is
> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
> 2017-11-15 14:03:06,264 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-3) ISPN000094: Received new cluster view for channel ejb:
> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
> 2017-11-15 14:03:06,265 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-3) ISPN000079: Channel ejb local address is
> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>
>
>
>
> ProxyPass /auth http://1.2.3.4:8080/auth
> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>
> Thanks,
> Mahendra
>
>
>
>
>
>
> On Thu, Nov 9, 2017 at 6:35 PM, Cédric Couralet <
> cedric.couralet(a)gmail.com>
> wrote:
>
> > 2017-11-09 12:34 GMT+01:00 mahendra sonawale <mahson1(a)gmail.com>:
> > > (You can look for the value in
> > > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
> > >
> > > In our production linux env the value is 1 -- does that really
> affect??
> > > and would that be the only cause?
> > >
> >
> > Yes, it is important. At least for us, changing this value to 0 was
> > enough to have a working cluster.
> > As I understand it, the value 1 is a protection against DOS but, in
> > the case of Keycloak prevents each node to discover the others. In a
> > controlled environment (as recommended in the keycloak docs), I see no
> > problem enabling it.
> >
> > I'm far for expert, so maybe someone will have a better idea.
> >
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
8:17 p.m.
Try using a fresh install of Keycloak with no modifications at all and try
running:
# bin/standalone.sh --server-config=standalone-ha.xml -b <IP> -bprivate <IP>
On 15 November 2017 at 17:19, mahendra sonawale <mahson1(a)gmail.com> wrote:
Hello Stian,
Thank you for your reply.
I have gone through the links and reference links as well.
Trying Keycloak cluster with multicast over private interface and on
separate testing, messages are getting through with (McastReceiverTest,
McastSenderTest)
Tried my best to accommodate needed things into cluster environment and as
per my understanding looks same which is present the given guidelines .
Appreciate your help in identifying if anything is missing in config
I have been stuck here from couple of weeks :(
Have shared whatever set up we have in mail trail.
Thanks,
Mahendra Sonawale.
On Wed, Nov 15, 2017 at 8:25 PM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
> Did you check the docs? Specifically http://www.keyclo
> ak.org/docs/latest/server_installation/index.html#multicast-network-setup
>
> On 15 November 2017 at 14:38, mahendra sonawale <mahson1(a)gmail.com>
> wrote:
>
>> Hello Cedric/Keycloak User comm,
>>
>> Sorry for getting back late over this. my set-up needs Admin team`s
>> intervention to change the broadcast value hence the delay in response.
>>
>> I got /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts value changed to 0
>>
>> And also tested the multicast set-up message test with
>> "McastReceiverTest"
>> and "McastSenderTest" which works fine.
>>
>> BUT KEYCLOAK is still NOT working in cluster. I get auto logged out.
>>
>> PFA the HA file which I am using in my configuration.
>>
>> IP addresses are dummy.
>> Node 1 : 1.2.3.4
>> Node 2 : 1.2.3.5
>>
>> This all I tried.
>> 1) Start command - nohup ./bin/standalone.sh
>> --server-config=standalone-ha.xml -b $HOSTNAME -u 230.0.0.4 &
>> 2) Tried to run both the nodes with public as well as private interface -
>> but no luck.
>> 3) I have hardware load balancer where SSL terminates. so domain will
>> communicate to the both the nodes in round robin and both nodes should be
>>
>> 4) PFB the HTTPD Conf
>>
>> -------------------------
>> LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
>> LoadModule remoteip_module modules/mod_remoteip.so
>>
>> ProxyPreserveHost On
>> LimitRequestFieldSize 163840
>> LimitRequestLine 163840
>>
>> #<VirtualHost _default_:80>
>> ServerName rapid.gi-de.com:443
>> ErrorLog /opt/keycloak/fiam_error_log
>> CustomLog /opt/keycloak/fiam_access_log combined
>> LogLevel warn
>>
>> RequestHeader set X-Forwarded-Proto "https"
>>
>> <Proxy https://abc.com/* >
>> RewriteEngine on
>> RewriteCond %{REQUEST_FILENAME} !-f
>> RewriteCond %{REQUEST_FILENAME} !-d
>> # not rewrite css, js and images
>> RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
>> RewriteRule ^(.*)$ /auth [NC,L,QSA]
>> #Options -Indexes FollowSymLinks
>> AllowOverride None
>> Order allow,deny
>> Allow from all
>> </Proxy>
>>
>>
>> ProxyPass /auth http://1.2.3.4:8080/auth
>> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>>
>> ------------------
>> And on 2nd node only proxy pass has change in IP address as 1.2.3.5
>>
>> 6) Server logs:
>> 2017-11-15 14:03:06,255 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>> 2017-11-15 14:03:06,256 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-7) ISPN000094: Received new cluster view for channel hibernate:
>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>> 2017-11-15 14:03:06,259 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-8) ISPN000094: Received new cluster view for channel web:
>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>> 2017-11-15 14:03:06,263 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-1) ISPN000094: Received new cluster view for channel server:
>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>> 2017-11-15 14:03:06,263 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-7) ISPN000079: Channel hibernate local address is
>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>> 2017-11-15 14:03:06,264 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-1) ISPN000079: Channel server local address is
>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>> 2017-11-15 14:03:06,264 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-3) ISPN000094: Received new cluster view for channel ejb:
>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>> 2017-11-15 14:03:06,265 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>> service
>> thread 1-3) ISPN000079: Channel ejb local address is
>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>
>>
>>
>>
>> ProxyPass /auth http://1.2.3.4:8080/auth
>> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>>
>> Thanks,
>> Mahendra
>>
>>
>>
>>
>>
>>
>> On Thu, Nov 9, 2017 at 6:35 PM, Cédric Couralet <
>> cedric.couralet(a)gmail.com>
>> wrote:
>>
>> > 2017-11-09 12:34 GMT+01:00 mahendra sonawale <mahson1(a)gmail.com>:
>> > > (You can look for the value in
>> > > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
>> > >
>> > > In our production linux env the value is 1 -- does that really
>> affect??
>> > > and would that be the only cause?
>> > >
>> >
>> > Yes, it is important. At least for us, changing this value to 0 was
>> > enough to have a working cluster.
>> > As I understand it, the value 1 is a protection against DOS but, in
>> > the case of Keycloak prevents each node to discover the others. In a
>> > controlled environment (as recommended in the keycloak docs), I see no
>> > problem enabling it.
>> >
>> > I'm far for expert, so maybe someone will have a better idea.
>> >
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
9:44 a.m.
Hello Stian/Keycloak User group,
Appreciate your help on this.
As mentioned earlier, system is currently in productions and it would be
long and lenghtly process for us to bring the higher version into live env.
Though I checked the HA config from 3.4 Final version and did not see much
difference with the existing HA configuration present into our env.
Would you please give a another look at our configuration and suggest a
solution.
Thanks,
Mahendra Sonawale.
+91 9130775865
On Thu, Nov 16, 2017 at 12:47 AM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
Try using a fresh install of Keycloak with no modifications at all
and try
running:
# bin/standalone.sh --server-config=standalone-ha.xml -b <IP> -bprivate
<IP>
On 15 November 2017 at 17:19, mahendra sonawale <mahson1(a)gmail.com> wrote:
> Hello Stian,
>
> Thank you for your reply.
> I have gone through the links and reference links as well.
> Trying Keycloak cluster with multicast over private interface and on
> separate testing, messages are getting through with
> (McastReceiverTest, McastSenderTest)
> Tried my best to accommodate needed things into cluster environment and
> as per my understanding looks same which is present the given guidelines .
> Appreciate your help in identifying if anything is missing in config
> I have been stuck here from couple of weeks :(
>
> Have shared whatever set up we have in mail trail.
>
> Thanks,
> Mahendra Sonawale.
>
>
> On Wed, Nov 15, 2017 at 8:25 PM, Stian Thorgersen <sthorger(a)redhat.com>
> wrote:
>
>> Did you check the docs? Specifically http://www.keyclo
>> ak.org/docs/latest/server_installation/index.html#multicast-
>> network-setup
>>
>> On 15 November 2017 at 14:38, mahendra sonawale <mahson1(a)gmail.com>
>> wrote:
>>
>>> Hello Cedric/Keycloak User comm,
>>>
>>> Sorry for getting back late over this. my set-up needs Admin team`s
>>> intervention to change the broadcast value hence the delay in response.
>>>
>>> I got /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts value changed to 0
>>>
>>> And also tested the multicast set-up message test with
>>> "McastReceiverTest"
>>> and "McastSenderTest" which works fine.
>>>
>>> BUT KEYCLOAK is still NOT working in cluster. I get auto logged out.
>>>
>>> PFA the HA file which I am using in my configuration.
>>>
>>> IP addresses are dummy.
>>> Node 1 : 1.2.3.4
>>> Node 2 : 1.2.3.5
>>>
>>> This all I tried.
>>> 1) Start command - nohup ./bin/standalone.sh
>>> --server-config=standalone-ha.xml -b $HOSTNAME -u 230.0.0.4 &
>>> 2) Tried to run both the nodes with public as well as private interface
>>> -
>>> but no luck.
>>> 3) I have hardware load balancer where SSL terminates. so domain will
>>> communicate to the both the nodes in round robin and both nodes should
>>> be
>>>
>>> 4) PFB the HTTPD Conf
>>>
>>> -------------------------
>>> LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
>>> LoadModule remoteip_module modules/mod_remoteip.so
>>>
>>> ProxyPreserveHost On
>>> LimitRequestFieldSize 163840
>>> LimitRequestLine 163840
>>>
>>> #<VirtualHost _default_:80>
>>> ServerName rapid.gi-de.com:443
>>> ErrorLog /opt/keycloak/fiam_error_log
>>> CustomLog /opt/keycloak/fiam_access_log combined
>>> LogLevel warn
>>>
>>> RequestHeader set X-Forwarded-Proto "https"
>>>
>>> <Proxy https://abc.com/* >
>>> RewriteEngine on
>>> RewriteCond %{REQUEST_FILENAME} !-f
>>> RewriteCond %{REQUEST_FILENAME} !-d
>>> # not rewrite css, js and images
>>> RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
>>> RewriteRule ^(.*)$ /auth [NC,L,QSA]
>>> #Options -Indexes FollowSymLinks
>>> AllowOverride None
>>> Order allow,deny
>>> Allow from all
>>> </Proxy>
>>>
>>>
>>> ProxyPass /auth http://1.2.3.4:8080/auth
>>> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>>>
>>> ------------------
>>> And on 2nd node only proxy pass has change in IP address as 1.2.3.5
>>>
>>> 6) Server logs:
>>> 2017-11-15 14:03:06,255 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>> 2017-11-15 14:03:06,256 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-7) ISPN000094: Received new cluster view for channel hibernate:
>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>> 2017-11-15 14:03:06,259 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-8) ISPN000094: Received new cluster view for channel web:
>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>> 2017-11-15 14:03:06,263 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-1) ISPN000094: Received new cluster view for channel server:
>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>> 2017-11-15 14:03:06,263 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-7) ISPN000079: Channel hibernate local address is
>>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>> 2017-11-15 14:03:06,264 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-1) ISPN000079: Channel server local address is
>>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>> 2017-11-15 14:03:06,264 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-3) ISPN000094: Received new cluster view for channel ejb:
>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>> 2017-11-15 14:03:06,265 INFO
>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-3) ISPN000079: Channel ejb local address is
>>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>>
>>>
>>>
>>>
>>> ProxyPass /auth http://1.2.3.4:8080/auth
>>> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>>>
>>> Thanks,
>>> Mahendra
>>>
>>>
>>>
>>>
>>>
>>>
>>> On Thu, Nov 9, 2017 at 6:35 PM, Cédric Couralet <
>>> cedric.couralet(a)gmail.com>
>>> wrote:
>>>
>>> > 2017-11-09 12:34 GMT+01:00 mahendra sonawale <mahson1(a)gmail.com>:
>>> > > (You can look for the value in
>>> > > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
>>> > >
>>> > > In our production linux env the value is 1 -- does that really
>>> affect??
>>> > > and would that be the only cause?
>>> > >
>>> >
>>> > Yes, it is important. At least for us, changing this value to 0 was
>>> > enough to have a working cluster.
>>> > As I understand it, the value 1 is a protection against DOS but, in
>>> > the case of Keycloak prevents each node to discover the others. In a
>>> > controlled environment (as recommended in the keycloak docs), I see no
>>> > problem enabling it.
>>> >
>>> > I'm far for expert, so maybe someone will have a better idea.
>>> >
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
9:53 a.m.
I couldn't spot anything obviously wrong with your config, but I only took
a quick glance at it. We simply don't have capacity to debug issues for
users that are using Keycloak for free. Best I can do is give you some tips
on how to identify the issues yourself and the first thing I would
personally try is to go back to the clean config to see if the issues are
there as well. If they are then it's most likely something in your
environment, if it's not then there's probably something in your config.
If you want more support from Red Hat consider getting the supported RH-SSO
option.
On 16 November 2017 at 09:44, mahendra sonawale <mahson1(a)gmail.com> wrote:
Hello Stian/Keycloak User group,
Appreciate your help on this.
As mentioned earlier, system is currently in productions and it would be
long and lenghtly process for us to bring the higher version into live env.
Though I checked the HA config from 3.4 Final version and did not see much
difference with the existing HA configuration present into our env.
Would you please give a another look at our configuration and suggest a
solution.
Thanks,
Mahendra Sonawale.
+91 9130775865 <+91%2091307%2075865>
On Thu, Nov 16, 2017 at 12:47 AM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
> Try using a fresh install of Keycloak with no modifications at all and
> try running:
>
> # bin/standalone.sh --server-config=standalone-ha.xml -b <IP> -bprivate
> <IP>
>
> On 15 November 2017 at 17:19, mahendra sonawale <mahson1(a)gmail.com>
> wrote:
>
>> Hello Stian,
>>
>> Thank you for your reply.
>> I have gone through the links and reference links as well.
>> Trying Keycloak cluster with multicast over private interface and on
>> separate testing, messages are getting through with
>> (McastReceiverTest, McastSenderTest)
>> Tried my best to accommodate needed things into cluster environment and
>> as per my understanding looks same which is present the given guidelines .
>> Appreciate your help in identifying if anything is missing in config
>> I have been stuck here from couple of weeks :(
>>
>> Have shared whatever set up we have in mail trail.
>>
>> Thanks,
>> Mahendra Sonawale.
>>
>>
>> On Wed, Nov 15, 2017 at 8:25 PM, Stian Thorgersen <sthorger(a)redhat.com>
>> wrote:
>>
>>> Did you check the docs? Specifically http://www.keyclo
>>> ak.org/docs/latest/server_installation/index.html#multicast-
>>> network-setup
>>>
>>> On 15 November 2017 at 14:38, mahendra sonawale <mahson1(a)gmail.com>
>>> wrote:
>>>
>>>> Hello Cedric/Keycloak User comm,
>>>>
>>>> Sorry for getting back late over this. my set-up needs Admin team`s
>>>> intervention to change the broadcast value hence the delay in response.
>>>>
>>>> I got /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts value changed to
>>>> 0
>>>>
>>>> And also tested the multicast set-up message test with
>>>> "McastReceiverTest"
>>>> and "McastSenderTest" which works fine.
>>>>
>>>> BUT KEYCLOAK is still NOT working in cluster. I get auto logged out.
>>>>
>>>> PFA the HA file which I am using in my configuration.
>>>>
>>>> IP addresses are dummy.
>>>> Node 1 : 1.2.3.4
>>>> Node 2 : 1.2.3.5
>>>>
>>>> This all I tried.
>>>> 1) Start command - nohup ./bin/standalone.sh
>>>> --server-config=standalone-ha.xml -b $HOSTNAME -u 230.0.0.4 &
>>>> 2) Tried to run both the nodes with public as well as private
>>>> interface -
>>>> but no luck.
>>>> 3) I have hardware load balancer where SSL terminates. so domain will
>>>> communicate to the both the nodes in round robin and both nodes should
>>>> be
>>>>
>>>> 4) PFB the HTTPD Conf
>>>>
>>>> -------------------------
>>>> LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
>>>> LoadModule remoteip_module modules/mod_remoteip.so
>>>>
>>>> ProxyPreserveHost On
>>>> LimitRequestFieldSize 163840
>>>> LimitRequestLine 163840
>>>>
>>>> #<VirtualHost _default_:80>
>>>> ServerName rapid.gi-de.com:443
>>>> ErrorLog /opt/keycloak/fiam_error_log
>>>> CustomLog /opt/keycloak/fiam_access_log combined
>>>> LogLevel warn
>>>>
>>>> RequestHeader set X-Forwarded-Proto "https"
>>>>
>>>> <Proxy https://abc.com/* >
>>>> RewriteEngine on
>>>> RewriteCond %{REQUEST_FILENAME} !-f
>>>> RewriteCond %{REQUEST_FILENAME} !-d
>>>> # not rewrite css, js and images
>>>> RewriteCond %{REQUEST_URI} !\.(?:css|js|map|jpe?g|gif|png)$ [NC]
>>>> RewriteRule ^(.*)$ /auth [NC,L,QSA]
>>>> #Options -Indexes FollowSymLinks
>>>> AllowOverride None
>>>> Order allow,deny
>>>> Allow from all
>>>> </Proxy>
>>>>
>>>>
>>>> ProxyPass /auth http://1.2.3.4:8080/auth
>>>> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>>>>
>>>> ------------------
>>>> And on 2nd node only proxy pass has change in IP address as 1.2.3.5
>>>>
>>>> 6) Server logs:
>>>> 2017-11-15 14:03:06,255 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
>>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>>> 2017-11-15 14:03:06,256 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-7) ISPN000094: Received new cluster view for channel
>>>> hibernate:
>>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>>> 2017-11-15 14:03:06,259 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-8) ISPN000094: Received new cluster view for channel web:
>>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>>> 2017-11-15 14:03:06,263 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-1) ISPN000094: Received new cluster view for channel server:
>>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>>> 2017-11-15 14:03:06,263 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-7) ISPN000079: Channel hibernate local address is
>>>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>>> 2017-11-15 14:03:06,264 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-1) ISPN000079: Channel server local address is
>>>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>>> 2017-11-15 14:03:06,264 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-3) ISPN000094: Received new cluster view for channel ejb:
>>>> [keycloak1.accounts.intern|0] (1) [keycloak1.accounts.intern]
>>>> 2017-11-15 14:03:06,265 INFO
>>>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>>> service
>>>> thread 1-3) ISPN000079: Channel ejb local address is
>>>> keycloak1.accounts.intern, physical addresses are [1.2.3.4:55200]
>>>>
>>>>
>>>>
>>>>
>>>> ProxyPass /auth http://1.2.3.4:8080/auth
>>>> ProxyPassReverse /auth http://1.2.3.4:8080/auth
>>>>
>>>> Thanks,
>>>> Mahendra
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> On Thu, Nov 9, 2017 at 6:35 PM, Cédric Couralet <
>>>> cedric.couralet(a)gmail.com>
>>>> wrote:
>>>>
>>>> > 2017-11-09 12:34 GMT+01:00 mahendra sonawale
<mahson1(a)gmail.com>:
>>>> > > (You can look for the value in
>>>> > > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be
0)
>>>> > >
>>>> > > In our production linux env the value is 1 -- does that
really
>>>> affect??
>>>> > > and would that be the only cause?
>>>> > >
>>>> >
>>>> > Yes, it is important. At least for us, changing this value to 0 was
>>>> > enough to have a working cluster.
>>>> > As I understand it, the value 1 is a protection against DOS but, in
>>>> > the case of Keycloak prevents each node to discover the others. In
a
>>>> > controlled environment (as recommended in the keycloak docs), I see
>>>> no
>>>> > problem enabling it.
>>>> >
>>>> > I'm far for expert, so maybe someone will have a better idea.
>>>> >
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>
>
11:23 a.m.
We had a similar problem because we forgot to enable multicast on our linux box.
Are you sure it is enabled in your case?
(You can look for the value in
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts, it should be 0)
2017-11-09 10:27 GMT+01:00 mahendra sonawale <mahson1(a)gmail.com>:
Hi Team,
We are facing similar problem where kelcloak is not running in cluster and
giving the same error log as mentioned by Subash in jira.
https://issues.jboss.org/browse/KEYCLOAK-5013
I tried to use the private interface as suggested into the document but
still no luck.
am I missing anything else? CAN YOU please help?? I am using Keycloak -
Version 3.2.1.Final.
I have load balancer configured above 2 keycloak nodes (nodes are running in
on different VMs)
Start command :
nohup ./bin/standalone.sh --server-config=standalone-ha.xml -b $HOSTNAME -u
230.0.0.4 &
HA configuration :
<interface name="private">
<inet-address value="$
{jboss.bind.address.private:(node1 IP address and on second node that IP
address)}
" />
</interface>
</interfaces>
<socket-binding-group name="standard-sockets"
default-interface="public" port-offset="$
{jboss.socket.binding.port-offset:0}
">
<socket-binding name="management-http" interface="private"
port="$
{jboss.management.http.port:9990}
" />
<socket-binding name="management-https" interface="private"
port="$
{jboss.management.https.port:9993}
" />
<socket-binding name="ajp" port="$
{jboss.ajp.port:8009}
" />
<socket-binding name="http" port="$
{jboss.http.port:8080}
" />
<socket-binding name="https" port="$
{jboss.https.port:8443}
" />
<socket-binding name="proxy-https" port="443"/>
<socket-binding name="jgroups-mping" interface="private"
port="0" multicast-address="$
{jboss.default.multicast.address:230.0.0.4}
"
multicast-port="45700" />
<socket-binding name="jgroups-tcp" interface="private"
port="7600" />
<socket-binding name="jgroups-tcp-fd" interface="private"
port="57600" />
<socket-binding name="jgroups-udp" interface="private"
port="55200" multicast-address="$
{jboss.default.multicast.address:230.0.0.4}
"
multicast-port="45688" />
<socket-binding name="jgroups-udp-fd" interface="private"
port="54200" />
<socket-binding name="modcluster" port="0"
multicast-address="224.0.1.105" multicast-port="23364" />
<socket-binding name="txn-recovery-environment" port="4712" />
<socket-binding name="txn-status-manager" port="4713" />
<outbound-socket-binding name="mail-smtp">
<remote-destination host="localhost" port="25" />
</outbound-socket-binding>
</socket-binding-group>
Log :
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000094: Received new cluster view for channel hibernate:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,750 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000094: Received new cluster view for channel keycloak:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-4) ISPN000094: Received new cluster view for channel ejb:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,750 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-7) ISPN000094: Received new cluster view for channel server:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,749 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000094: Received new cluster view for channel web:
[keycloak2|0] (1) [keycloak2]
2017-11-09 04:38:22,761 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000079: Channel keycloak local address is keycloak2,
physical addresses are [**.**.**.**]
2017-11-09 04:38:22,763 INFO
[org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000079: Channel web local address is keycloak2, physical
addresses are [**.**.**.**]
--
Sent from: http://keycloak-user.88327.x6.nabble.com/
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2375
days inactive
2382
days old
12 comments
4 participants
participants (4)
-
Cédric Couralet -
mahendra sonawale -
Simon Payne -
Stian Thorgersen