Can't really diagnose your problem as you've given very little information. On 11/2/2015 5:13 AM, Mai Zi wrote: > Hi, there, > I follow the instruction to import broker 's two realms and > successfully login in . When logout, it failed. > > > Any help will be appreciated > > > Maizi > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

That part of the user guide is clearly out of date.

It should be: <extensions> ... <extension module="org.keycloak.keycloak-server-subsystem"/> </extensions> And: <subsystem xmlns="urn:jboss:domain:keycloak-server:1.1"> <web-context>auth</web-context> </subsystem> On Mon, Nov 2, 2015 at 4:07 PM, Andrej P <ado.boj.83(a)gmail.com&gt; wrote: > Hi Bill, > > which more info would you request pls? > > I have issue with modify domain.xml for keycloak. > Because in chapter > http://keycloak.github.io/docs/userguide/keycloak-server/html/server-inst... > are missing some configuration infos and after add everything what was > advice me after start wildfly in command line: ./domain.sh > --domain-config=domain.xml --host-config=host.xml > Still http://localhost:8080/auth/admin/index.html doesn't work for > wildfly-domain. > > Br, > Andrej. > > On Mon, Nov 2, 2015 at 2:59 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: > >> Can't really diagnose your problem as you've given very little >> information. >> >> On 11/2/2015 5:13 AM, Mai Zi wrote: >> > Hi, there, >> > I follow the instruction to import broker 's two realms and >> > successfully login in . When logout, it failed. >> > >> > >> > Any help will be appreciated >> > >> > >> > Maizi >> > >> > >> > _______________________________________________ >> > keycloak-user mailing list >> > keycloak-user(a)lists.jboss.org >> > https://lists.jboss.org/mailman/listinfo/keycloak-user >> > >> >> -- >> Bill Burke >> JBoss, a division of Red Hat >> http://bill.burkecentral.com >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

By default Wildfly only binds to localhost (127.0.0.1), and is not reachable via any external network interfaces. Running in domain mode is an advanced Wildfly topic, so I suggest you check Wildfly documentation: https://docs.jboss.org/author/display/WFLY9/Interfaces+and+ports https://docs.jboss.org/author/display/WFLY9/Domain+Setup A quick way to bind to all the network interfaces in standalone mode is to use -b 0.0.0.0 as a parameter to standalone.sh. But that doesn't work for domain mode AFAIK.

From your descriptions of the problem it sounds like your server-one which binds to port 8080 doesn't have keycloak-server configured at all - it's using a server group, that uses a different profile than the one you configured.

There are four profiles in the default domain.xml - default, ha, full, and full-ha

If you want your multiple Keycloak instances to run in high availability mode, using a shared Infinispan cache, and a shared database, then that's the most complex of all configurations - you have to setup a standalone database, use "full-ha" profile to configure the datasource with proper database connection url, and configure the distributed Infinispan cache. Also add <subsystem xmlns="urn:jboss:domain:keycloak-server:1.1"> declaration.

In server-groups section define a new group or reuse existing one, and set its profile to "full-ha", and use "full-ha-sockets" binding group. In host.xml make sure that server definitions have the proper group set. Then you also have to copy some configurations. Assuming you have two servers defined in host.xml - called server-one, and server-two, create a directory: $WILDFLY_HOME/domain/servers/server-one/configuration $WILDFLY_HOME/domain/servers/server-two/configuration Then copy the following configurations from standalone/configuration: cp $WILDFLY_HOME/standalone/configuration/keycloak-server.json $WILDFLY_HOME/domain/servers/server-one/configuration/ cp -r $WILDFLY_HOME/standalone/configuration/themes $WILDFLY_HOME/domain/servers/server-one/configuration/ cp -r $WILDFLY_HOME/standalone/configuration/providers $WILDFLY_HOME/domain/servers/server-one/configuration/ cp $WILDFLY_HOME/standalone/configuration/keycloak-server.json $WILDFLY_HOME/domain/servers/server-two/configuration/ cp -r $WILDFLY_HOME/standalone/configuration/themes $WILDFLY_HOME/domain/servers/server-two/configuration/ cp -r $WILDFLY_HOME/standalone/configuration/providers $WILDFLY_HOME/domain/servers/server-two/configuration/

Your log.txt doesn't look right. Only a host controller is started - no server running your idbt-ha profile is started at all. There should be entries in the log looking like: [Server:configuration-server-demosetup] 15:58:05,712 INFO [org.jboss.modules] (main) JBoss Modules version 1.4.3.Final [Server:configuration-server-demosetup] 15:58:06,017 INFO [org.jboss.msc] (main) JBoss MSC version 1.2.6.Final [Server:configuration-server-demosetup] 15:58:06,118 INFO [org.jboss.as] (MSC service thread 1-6) WFLYSRV0049: WildFly Full 9.0.1.Final (WildFly Core 1.0.1.Final) starting

Can you confirm that you see the following lines in your host-controller.log: [Server:authentication-server-demosetup] 15:58:23,220 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 72) WFLYUT0021: Registered web context: /auth [Server:authentication-server-demosetup] 15:58:23,267 INFO [org.jboss.as.server] (ServerService Thread Pool -- 36) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war")

What does the following url show: http://localhost:8180/auth

Infinispan in HA mode ensures there is a distributed cache layer in use. It means there are not two local caches with possibly different states. That's important if you use round-robin front end proxy without sticky sessions. Otherwise you may see strange Admin UI behaviour.

On Wed, Nov 4, 2015 at 3:31 PM, Andrej P <ado.boj.83(a)gmail.com&gt; wrote: > Again inside text are my answers. > > > > On Wed, Nov 4, 2015 at 2:49 PM, Marko Strukelj <mstrukel(a)redhat.com&gt; > wrote: > >> Your log.txt doesn't look right. Only a host controller is started - no >> server running your idbt-ha profile is started at all. >> >> There should be entries in the log looking like: >> >> [Server:configuration-server-demosetup] 15:58:05,712 INFO >> [org.jboss.modules] (main) JBoss Modules version 1.4.3.Final >> [Server:configuration-server-demosetup] 15:58:06,017 INFO >> [org.jboss.msc] (main) JBoss MSC version 1.2.6.Final >> [Server:configuration-server-demosetup] 15:58:06,118 INFO [org.jboss.as] >> (MSC service thread 1-6) WFLYSRV0049: WildFly Full 9.0.1.Final (WildFly >> Core 1.0.1.Final) starting >> > ... >> > In log /opt/wildfly-9.0.1.Final/domain/log/host-controller.log are > presnt your requested lines (log.txt was copied from command line) > 2015-11-04 13:38:43,479 INFO [org.jboss.as.host.controller] > (Controller Boot Thread) WFLYHC0023: Starting server > configuration-server-demosetup > 2015-11-04 13:38:46,125 INFO [org.jboss.as.host.controller] (Remoting > "demosetup:MANAGEMENT" task-4) WFLYHC0021: Server > [Server:configuration-server-demosetup] connected using connection > [Channel ID 656dd302 (inbound) of Remoting connection 1d425566 to / > 127.0.0.1:50449] > 2015-11-04 13:38:46,193 INFO [org.jboss.as.host.controller] > (Controller Boot Thread) WFLYHC0023: Starting server > authentication-server-demosetup > 2015-11-04 13:38:46,246 INFO [org.jboss.as.host.controller] > (server-registration-threads - 1) WFLYHC0020: Registering server > configuration-server-demosetup > 2015-11-04 13:38:53,794 INFO [org.jboss.as.host.controller] (Remoting > "demosetup:MANAGEMENT" task-8) WFLYHC0021: Server > [Server:authentication-server-demosetup] connected using connection > [Channel ID 3e8ad11c (inbound) of Remoting connection 67282c6a to / > 127.0.0.1:52804] > 2015-11-04 13:38:53,867 INFO [org.jboss.as.host.controller] > (server-registration-threads - 1) WFLYHC0020: Registering server > authentication-server-demosetup > >> >> >> There must be a problem with your host.xml file. You should have a >> server definition there referring to one of your server groups, for example: >> >> <servers> >> <server name="configuration-server-demosetup" >> group="group-authentication"/> >> ... >> </servers> >> > I attached host-idbt.xml now and from my point of view it looks fine. > > >> >> Also, in domain-idbt.xml your Infinispan cache is configured to be >> local. For distributed setup you should be using distributed Infinispan >> cache: >> >> <cache-container name="keycloak" >> jndi-name="infinispan/Keycloak"> >> <transport lock-timeout="60000"/> >> <invalidation-cache name="realms" mode="SYNC"/> >> <invalidation-cache name="users" mode="SYNC"/> >> <distributed-cache name="sessions" mode="SYNC" >> owners="1"/> >> <distributed-cache name="loginFailures" mode="SYNC" >> owners="1"/> >> </cache-container> >> > In previous attached domain-idbt.xml I configured Infinispan cache > like local not distributed, is it conflict, have to be in HA mode? > > > >> >> >> >> On Wed, Nov 4, 2015 at 2:20 PM, Andrej P <ado.boj.83(a)gmail.com&gt; wrote: >> >>> Hi Marko, >>> >>> thanks for your hints, I went through but still w/o positive result. >>> I will write my comments inside your hints. >>> I attached 2 files: domain-idbt.xml - with added sections for keycloak >>> log.txt - log after start wildfly in command >>> line >>> >>> Br, >>> Andrej. >>> >>> On Tue, Nov 3, 2015 at 4:24 PM, Marko Strukelj <mstrukel(a)redhat.com&gt; >>> wrote: >>> >>>> From your descriptions of the problem it sounds like your server-one >>>> which binds to port 8080 doesn't have keycloak-server configured at all - >>>> it's using a server group, that uses a different profile than the one you >>>> configured. >>>> >>> Our group/server/profile setup looks like: >>> >>> GROUP SERVER PROFILE configuration configuration-server-demosetup >>> idbt-ha authentication authentication-server-demosetup idbt-ha >>> >>> >>>> >>>> There are four profiles in the default domain.xml - default, ha, full, >>>> and full-ha >>>> >>> In our domain-idbt.xml are only 2 profiles:idbt-ha and >>> idbt-security and I modified inifinispan for idbt-ha (but ha is only in >>> name not used inside configuration) >>> >>>> >>>> If you want your multiple Keycloak instances to run in high >>>> availability mode, using a shared Infinispan cache, and a shared database, >>>> then that's the most complex of all configurations - you have to setup a >>>> standalone database, use "full-ha" profile to configure the datasource with >>>> proper database connection url, and configure the distributed Infinispan >>>> cache. Also add <subsystem xmlns="urn:jboss:domain:keycloak-server:1.1"> >>>> declaration. >>>> >>> >>> I created Keycloak_DS, which was before missing. >>> I add : extension; inifinispan and subsystem section for Keycloak >>> inside my domain-idbt.xml (I attached finally modified domain-idbt.xml) Pls >>> you can check it inside. >>> >>>> >>>> >>>> In server-groups section define a new group or reuse existing one, and >>>> set its profile to "full-ha", and use "full-ha-sockets" binding group. >>>> In host.xml make sure that server definitions have the proper group >>>> set. >>>> >>>> Then you also have to copy some configurations. >>>> >>>> Assuming you have two servers defined in host.xml - called server-one, >>>> and server-two, create a directory: >>>> >>>> $WILDFLY_HOME/domain/servers/server-one/configuration >>>> $WILDFLY_HOME/domain/servers/server-two/configuration >>>> >>>> Then copy the following configurations from standalone/configuration: >>>> >>>> cp $WILDFLY_HOME/standalone/configuration/keycloak-server.json >>>> $WILDFLY_HOME/domain/servers/server-one/configuration/ >>>> cp -r $WILDFLY_HOME/standalone/configuration/themes >>>> $WILDFLY_HOME/domain/servers/server-one/configuration/ >>>> cp -r $WILDFLY_HOME/standalone/configuration/providers >>>> $WILDFLY_HOME/domain/servers/server-one/configuration/ >>>> >>>> cp $WILDFLY_HOME/standalone/configuration/keycloak-server.json >>>> $WILDFLY_HOME/domain/servers/server-two/configuration/ >>>> cp -r $WILDFLY_HOME/standalone/configuration/themes >>>> $WILDFLY_HOME/domain/servers/server-two/configuration/ >>>> cp -r $WILDFLY_HOME/standalone/configuration/providers >>>> $WILDFLY_HOME/domain/servers/server-two/configuration/ >>>> >>> >>> Done all creation and copying steps. >>> >>> >>> >>> >>> >> >

On Wed, Nov 4, 2015 at 4:10 PM, Andrej P <ado.boj.83(a)gmail.com&gt; wrote: > > > On Wed, Nov 4, 2015 at 3:48 PM, Marko Strukelj <mstrukel(a)redhat.com&gt; > wrote: > >> Can you confirm that you see the following lines in >> your host-controller.log: >> >> [Server:authentication-server-demosetup] 15:58:23,220 INFO >> [org.wildfly.extension.undertow] (ServerService Thread Pool -- 72) >> WFLYUT0021: Registered web context: /auth >> [Server:authentication-server-demosetup] 15:58:23,267 INFO >> [org.jboss.as.server] (ServerService Thread Pool -- 36) WFLYSRV0010: >> Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war") >> > No, this lines are missing in log. > That's the root of your problem then. Keycloak server subsystem doesn't seem to be initialized at all. From your config files it follows that your 'authentication-server-demosetup' server is using 'group-authentication' group, and 'group-authentication' group is using 'idbt-ha' profile, and 'idbt-ha' profile contains keycloak-server subsystem declaration ... I see no reason for Keycloak server to not get initialized. I'm sorry to say, but I'm out of ideas. If I were you I would try from scratch with an OOTB domain.xml, and host.xml, and setup up Keycloak server without any additional applications deployed, following the instructions I described previously - just get server-one, and server-two using the same group tied to full-ha profile. That way you should get Keycloak up and running. Then I would slowly evolve the configuration towards what you have now. Somewhere during that process there must be a step, that breaks things, and it's not obvious what that step is. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

@Andrej, try to use the following instructions to set up Keycloak in domain mode. These instructions work for me, so if you follow them precisely they should also work for you. This setup approach assumes that you may want to deploy your secured applications into the same server(s) running Keycloak server. Download keycloak-demo-1.6.1.Final.zip from http://keycloak.jboss.org/keycloak/downloads. unzip ~/Downloads/keycloak-demo-1.6.1.Final.zip cd keycloak-demo-1.6.1.Final/keycloak Open for edit: domain/configuration/domain.xml Add to <extensions> section: <extension module="org.keycloak.keycloak-server-subsystem"/> <extension module="org.keycloak.keycloak-adapter-subsystem"/> The second one is for securing your deployed .wars with Keycloak server. Scroll down to <profile name="full-ha"> Add to <subsystem xmlns="urn:jboss:domain:datasources:3.0"> section: <datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true"> <connection-url>jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE</connection-url> <driver>h2</driver> <security> <user-name>sa</user-name> <password>sa</password> </security> </datasource> Add to <subsystem xmlns="urn:jboss:domain:infinispan:3.0"> section: <cache-container name="keycloak" jndi-name="infinispan/Keycloak"> <transport lock-timeout="60000"/> <invalidation-cache name="realms" mode="SYNC"/> <invalidation-cache name="users" mode="SYNC"/> <distributed-cache name="sessions" mode="SYNC" owners="1"/> <distributed-cache name="loginFailures" mode="SYNC" owners="1"/> </cache-container> Before the ending </profile> add: <subsystem xmlns="urn:jboss:domain:keycloak-server:1.1"> <web-context>auth</web-context> </subsystem> <subsystem xmlns="urn:jboss:domain:keycloak:1.1"/> The second one is for securing your deployed .wars with Keycloak server. Make sure that you really add all these sections to 'full-ha'. If you use search or any kind of shortcuts to jump through the edited file, it very easy to end up in a different section. So doublecheck. Now scroll further down to <server-groups> section, and change 'main-server-group' to use 'full-ha' profile: <server-group name="main-server-group" profile="full-ha"> <jvm name="default"> <heap size="64m" max-size="512m"/> </jvm> <socket-binding-group ref="full-ha-sockets"/> </server-group> Save the file. Now start Keycloak in domain mode: bin/domain.sh Observing the log, you should see many entries for 'server-one', and 'server-two'. You should also see two big stacktraces, as the server will try to start up, and fail due to not being able to find the keycloak-server.json file. (The stacktrace should be more descriptive - current error reporting NullPointerException is a bug) But that's good, it means that keycloak-server subsystem was picked up, and started to get initialized. Running this results in two additional directories created: domain/servers/server-one and domain/servers/server-two Now just copy the configuration from standalone to these two directories: mkdir domain/servers/server-one/configuration cp standalone/configuration/keycloak-server.json domain/servers/server-one/configuration/ cp -r standalone/configuration/themes domain/servers/server-one/configuration/ cp -r standalone/configuration/providers domain/servers/server-one/configuration/ mkdir domain/servers/server-two/configuration cp standalone/configuration/keycloak-server.json domain/servers/server-two/configuration/ cp -r standalone/configuration/themes domain/servers/server-two/configuration/ cp -r standalone/configuration/providers domain/servers/server-two/configuration/ And start the server again: bin/domain.sh You should now see the server start up without any errors. You can now open Keycloak admin on server-one: http://localhost:8080/auth And on server-two: http://localhost:8230/auth/ This procedure has always worked for me. If it fails for you then provide your domain.xml, and stdout from console with any stack traces. On Thu, Nov 5, 2015 at 9:02 PM, Stian Thorgersen <sthorger(a)redhat.com&gt; wrote: > I came across this: > https://issues.jboss.org/browse/KEYCLOAK-2037 > > Maybe it's the same issue here? > > On 4 November 2015 at 16:35, Marko Strukelj <mstrukel(a)redhat.com&gt; wrote: > >> On Wed, Nov 4, 2015 at 4:10 PM, Andrej P <ado.boj.83(a)gmail.com&gt; wrote: >> >>> >>> >>> On Wed, Nov 4, 2015 at 3:48 PM, Marko Strukelj <mstrukel(a)redhat.com&gt; >>> wrote: >>> >>>> Can you confirm that you see the following lines in >>>> your host-controller.log: >>>> >>>> [Server:authentication-server-demosetup] 15:58:23,220 INFO >>>> [org.wildfly.extension.undertow] (ServerService Thread Pool -- 72) >>>> WFLYUT0021: Registered web context: /auth >>>> [Server:authentication-server-demosetup] 15:58:23,267 INFO >>>> [org.jboss.as.server] (ServerService Thread Pool -- 36) WFLYSRV0010: >>>> Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war") >>>> >>> No, this lines are missing in log. >>> >> >> That's the root of your problem then. Keycloak server subsystem doesn't >> seem to be initialized at all. >> From your config files it follows that your >> 'authentication-server-demosetup' server is using 'group-authentication' >> group, and 'group-authentication' group is using 'idbt-ha' profile, and >> 'idbt-ha' profile contains keycloak-server subsystem declaration ... >> >> I see no reason for Keycloak server to not get initialized. >> >> I'm sorry to say, but I'm out of ideas. If I were you I would try from >> scratch with an OOTB domain.xml, and host.xml, and setup up Keycloak server >> without any additional applications deployed, following the instructions I >> described previously - just get server-one, and server-two using the same >> group tied to full-ha profile. That way you should get Keycloak up and >> running. Then I would slowly evolve the configuration towards what you have >> now. Somewhere during that process there must be a step, that breaks >> things, and it's not obvious what that step is. >> >> >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > >

If you use keycloak-overlay, or keycloak-server dist then if you want to follow the above instructions to the letter, you also have to download and unpack keycloak-wf9-adapter-dist.zip. The point of this exercise it to get things up and running with as few steps as possible to reduce the number of things that can go wrong since you've been having a great deal of problems with it, and it seems like your problems are the result of your particular way of wanting to set it up. The point here is to show you that Keycloak server can be set up in domain mode, and it works. Apparently it's been impossible for us to determine the exact issue with your current set up, based on the information you have provided, apart from the fact that Keycloak doesn't seem to be initialised for you which is inconsistent with the configuration you have provided. If you think there is something wrong with Keycloak then the only way for us to do anything about it at this point is for you to create exact instructions to reproduce the problem.