11:01 a.m.
Hi all,
We've just found keycloak, and are evaluating it. It's looking great so
far! We have two questions.
Question one:
We are running three AD DCs, and would like to configure all three in
keycloak, to get failover & redundancy.
To do this, I have simply configured three comma-seperated DCs in the
ldap URL field. Keycloak accepted this input, but I'm not sure that all
three will be used...
Is the above the way to provide multiple ldap servers to keycloak?
Question two:
How about backing up keycloak? We are running from an extracted tar.gz.
If we keep backups of this keycloak-directory, is that enough? Does
keycloak need to be shutdown at backup time?
Best regards,
MJ
11:10 a.m.
For question two, Keycloak uses h2 database by default which is stored
locally in KC directory. But for production you probably don't want to
use that. You should configure Keycloak to use an external database and
backup that instead. You basically just modify standalone.xml and change
the KeycloakDS datasource to use the database of your choice.
mj je 17. 11. 2016 ob 11:01 napisal:
Hi all,
We've just found keycloak, and are evaluating it. It's looking great so
far! We have two questions.
Question one:
We are running three AD DCs, and would like to configure all three in
keycloak, to get failover & redundancy.
To do this, I have simply configured three comma-seperated DCs in the
ldap URL field. Keycloak accepted this input, but I'm not sure that all
three will be used...
Is the above the way to provide multiple ldap servers to keycloak?
Question two:
How about backing up keycloak? We are running from an extracted tar.gz.
If we keep backups of this keycloak-directory, is that enough? Does
keycloak need to be shutdown at backup time?
Best regards,
MJ
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
9:58 p.m.
On 17/11/16 11:10, cen wrote:
For question two, Keycloak uses h2 database by default which is
stored
locally in KC directory. But for production you probably don't want to
use that. You should configure Keycloak to use an external database and
backup that instead. You basically just modify standalone.xml and change
the KeycloakDS datasource to use the database of your choice.
+1 . Never use h2 in
production.
For LDAP, we didn't yet try to test the configuration like this. What we
do is, that the configured "Connection URL" is used as the property
"java.naming.provider.url" of the LDAP InitialContext. So if that is
supported by Java OOTB, then it works. Otherwise probably not. You can
doublecheck and possibly create JIRA with the example URLs of your AD DCs.
Thanks,
Marek
mj je 17. 11. 2016 ob 11:01 napisal:
> Hi all,
>
> We've just found keycloak, and are evaluating it. It's looking great so
> far! We have two questions.
>
> Question one:
> We are running three AD DCs, and would like to configure all three in
> keycloak, to get failover & redundancy.
> To do this, I have simply configured three comma-seperated DCs in the
> ldap URL field. Keycloak accepted this input, but I'm not sure that all
> three will be used...
> Is the above the way to provide multiple ldap servers to keycloak?
>
> Question two:
> How about backing up keycloak? We are running from an extracted tar.gz.
> If we keep backups of this keycloak-directory, is that enough? Does
> keycloak need to be shutdown at backup time?
>
> Best regards,
> MJ
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:22 p.m.
Hi Marek,
On 11/18/2016 09:58 PM, Marek Posolda wrote:
+1 . Never use h2 in production.
ok, duly noted, thanks both.
For LDAP, we didn't yet try to test the configuration like this.
What we
do is, that the configured "Connection URL" is used as the property
"java.naming.provider.url" of the LDAP InitialContext. So if that is
supported by Java OOTB, then it works. Otherwise probably not. You can
doublecheck and possibly create JIRA with the example URLs of your AD DCs.
Ok, reading this:
http://stackoverflow.com/questions/40218516/a-way-to-define-implement-fai...
make me think that we should be able to provide multiple ldap servers,
space seperated.
Trying this:
Connection URL #1:
ldaps://nonexistant-dns.company.com:636 ldaps://ldap.company.com:636
Result: connection OK, authentication OK
(It ignores the non-existant URL, and talks to the second URL)
Connection URL #2:
ldaps://ldap1.company.com:636 ldaps://ldap2.company.com:636
AND make iptables drop all traffic from ldap1.company.com
Result: timeout in the logs, and connection does NOT work
Connection URL #3:
ldaps://ldap1.company.com:636 ldaps://ldap2.company.com:636
AND make iptables drop all traffic from ldap2.company.com
Result: connection OK, authentication OK
My conclusion #1: the field accepts valid and invalid urls, invalid URLs
are silently skipped, and the second (valid) url is checked and
validated. (expected: some error about the first invalid URL)
My conclusion #2: further to coclusion #1, it seems that keycloak is
able to skip URLs, so it should also be able to skip to the next url, if
a server happens to be down, but this does not happen, authentication
not possible, and the check fails. It 'hangs' on the non-responding URL.
For a piece of software so vital for authentication, we feel that
multiple ldap servers (failover) is a must.
So, you you think that this is worth filing 'a JIRA' about?
MJ
7:28 p.m.
For LDAP, looks like it must be space separated and comma separated (see
http://docs.oracle.com/javase/jndi/tutorial/ldap/misc/url.html) . I just
tried with "ldap://localhost:10359 ldap://localhost:10389" (the first one
is incorrect)
and when pressing "Test connection" it says "success" so apparently
it
fail over correctly.
On Fri, Nov 18, 2016 at 9:58 PM, Marek Posolda <mposolda(a)redhat.com> wrote:
On 17/11/16 11:10, cen wrote:
> For question two, Keycloak uses h2 database by default which is stored
> locally in KC directory. But for production you probably don't want to
> use that. You should configure Keycloak to use an external database and
> backup that instead. You basically just modify standalone.xml and change
> the KeycloakDS datasource to use the database of your choice.
+1 . Never use h2 in production.
For LDAP, we didn't yet try to test the configuration like this. What we
do is, that the configured "Connection URL" is used as the property
"java.naming.provider.url" of the LDAP InitialContext. So if that is
supported by Java OOTB, then it works. Otherwise probably not. You can
doublecheck and possibly create JIRA with the example URLs of your AD DCs.
Thanks,
Marek
>
>
> mj je 17. 11. 2016 ob 11:01 napisal:
>> Hi all,
>>
>> We've just found keycloak, and are evaluating it. It's looking great so
>> far! We have two questions.
>>
>> Question one:
>> We are running three AD DCs, and would like to configure all three in
>> keycloak, to get failover & redundancy.
>> To do this, I have simply configured three comma-seperated DCs in the
>> ldap URL field. Keycloak accepted this input, but I'm not sure that all
>> three will be used...
>> Is the above the way to provide multiple ldap servers to keycloak?
>>
>> Question two:
>> How about backing up keycloak? We are running from an extracted tar.gz.
>> If we keep backups of this keycloak-directory, is that enough? Does
>> keycloak need to be shutdown at backup time?
>>
>> Best regards,
>> MJ
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
7:48 p.m.
Hi Sebastien,
On 11/19/2016 07:28 PM, Sebastien Blanc wrote:
For LDAP, looks like it must be space separated and comma separated
(see
http://docs.oracle.com/javase/jndi/tutorial/ldap/misc/url.html) . I just
tried with "ldap://localhost:10359 ldap://localhost:10389" (the first
one is incorrect)
and when pressing "Test connection" it says "success" so apparently
it
fail over correctly.
Yes, I see that too. See example #1 in my last email. (only
difference:
me: wrong dns name, you: wrong port number)
However, what I'm concerned about is my example #2, where both URLs are
in fact correct, but only the second one is responding.
(in my case: iptables dropping traffic, but could also be something
else, like malfuctioning ldap server)
The result of this seems to be that things NO LONGER work (a timeout).
At least in my testing...
Do you not see that?
MJ
7:54 p.m.
Sorry I missed your latest email withy the examples, for some reasons it
ended in my spam box.
Looks like you spotted some bugs so yes opening a jira is the best thing to
do.
Le sam. 19 nov. 2016 à 19:48, mj <lists(a)merit.unu.edu> a écrit :
Hi Sebastien,
On 11/19/2016 07:28 PM, Sebastien Blanc wrote:
For LDAP, looks like it must be space separated and comma separated
(see
http://docs.oracle.com/javase/jndi/tutorial/ldap/misc/url.html) . I just
tried with "ldap://localhost:10359 ldap://localhost:10389" (the first
one is incorrect)
and when pressing "Test connection" it says "success" so apparently
it
fail over correctly.
Yes, I see that too. See example #1 in my last email. (only
difference:
me: wrong dns name, you: wrong port number)
However, what I'm concerned about is my example #2, where both URLs are
in fact correct, but only the second one is responding.
(in my case: iptables dropping traffic, but could also be something
else, like malfuctioning ldap server)
The result of this seems to be that things NO LONGER work (a timeout).
At least in my testing...
Do you not see that?
MJ
9:45 p.m.
Hello what is the status of this issue ?
Cause i can confirm during a network outage when one LDAP went down (the
first one configured in the connection URL) the Keycloak server hanged.
--
View this message in context:
http://keycloak-user.88327.x6.nabble.com/keycloak-user-multiple-ldap-serv...
Sent from the keycloak-user mailing list archive at Nabble.com.
9:53 p.m.
Hi,
I did not file an issue, but instead worked around it, by using HAproxy
on the keycloak server:
- make keycloak talk to haproxy on ldaps://localhost:636
- make haproxy connect to our three ldap backend servers.
As I am using this on most of our other servers as well, so it actually
makes our config more standard, plus: haproxy keeps a log of backend
servers coming up and going down, so you know at all times what is going on.
Perhaps this solution works for you too.
Best,
MJ
On 28-11-2016 21:45, dimitrios.gkazgkas wrote:
Hello what is the status of this issue ?
Cause i can confirm during a network outage when one LDAP went down (the
first one configured in the connection URL) the Keycloak server hanged.
--
View this message in context:
http://keycloak-user.88327.x6.nabble.com/keycloak-user-multiple-ldap-serv...
Sent from the keycloak-user mailing list archive at Nabble.com.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
9:50 a.m.
Thank you.
We will try to use the same Workaround.
Br
Dimitrios Gkazgkas
IT Solutions Architect
..............................................................................................
-----Original Message-----
From: keycloak-user-bounces(a)lists.jboss.org [mailto:keycloak-user-bounces@lists.jboss.org]
On Behalf Of lists
Sent: 28 November 2016 21:53
To: keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] multiple ldap servers (failover)
Hi,
I did not file an issue, but instead worked around it, by using HAproxy on the keycloak
server:
- make keycloak talk to haproxy on ldaps://localhost:636
- make haproxy connect to our three ldap backend servers.
As I am using this on most of our other servers as well, so it actually makes our config
more standard, plus: haproxy keeps a log of backend servers coming up and going down, so
you know at all times what is going on.
Perhaps this solution works for you too.
Best,
MJ
On 28-11-2016 21:45, dimitrios.gkazgkas wrote:
Hello what is the status of this issue ?
Cause i can confirm during a network outage when one LDAP went down
(the first one configured in the connection URL) the Keycloak server hanged.
--
View this message in context:
http://keycloak-user.88327.x6.nabble.com/keycloak-user-multiple-ldap-s
ervers-failover-tp1567p1668.html Sent from the keycloak-user mailing
list archive at Nabble.com.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
________________________________
**** DISCLAIMER ****
http://www.tango.lu/maildisclaimer
2703
days inactive
2717
days old
9 comments
7 participants
participants (7)
-
cen -
dimitrios.gkazgkas -
GKAZGKAS Dimitrios (TAN/MST)
-
lists -
Marek Posolda -
mj
-
Sebastien Blanc