I have a pair of keycloak setup as cross datacenter HA as per https://www.keycloak.org/docs/4.0/server_installation/#setup All configuration data is replicated, and changes to session/config are seen immediately in both instances console. However, a user login to /auth/realms/master/account/ cannot re-use the same session between the instances. 1) login to http://host.domain.com:8080/auth/realms/master/account (instance 1) 2) go to http://host.domain.com:9080/auth/realms/master/account (instance 2) prompted to login again although all the cookies are sent to instance2 (AUTH_SESSION_ID, KEYCLOAK_SESSION, KEYCLOAK_IDENTITY) Any help appreciated Thanks a bunch! Regards, BL _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Thanks Ariel. I found out the following, request host.domain.com:port must be identical with the initial authentication. Session cookie itself is not sufficient. So yes, via a load balancer, it will work. Unlike many other SSO product that uses cookie domain .domain.com to share session cookies within the infrastructure, Keycloak does not alllow that and take it one level higher, not even allowing difference of port number. Maybe future version can have option to relax this enforcement as it will be beneficial should multi-site deployments want to have different hostnames within the same domain with each site having own load balancers. ie. ap.sso.domain.com, na.sso.domain.com, eu.sso.domain.com Thanks. Regards, BL On Tue, Jun 12, 2018 at 5:44 AM, Ariel Carrera <carreraariel(a)gmail.com&gt; wrote: > Have you got a load balancer in front of keycloaks ? Have you tested it > hitting to the balancer? maybe the issuer is changing from one token to > other. > > El El lun, 11 jun. 2018 a las 07:04, Long Man <longman(a)barramandi.com&gt; > escribió: > >> I have a pair of keycloak setup as cross datacenter HA >> as per https://www.keycloak.org/docs/4.0/server_installation/#setup >> >> All configuration data is replicated, and changes to session/config are >> seen immediately in both instances console. >> >> However, a user login to /auth/realms/master/account/ cannot re-use the >> same session between the instances. >> 1) login to http://host.domain.com:8080/auth/realms/master/account >> (instance 1) >> 2) go to http://host.domain.com:9080/auth/realms/master/account >> (instance 2) >> prompted to login again although all the cookies are sent to instance2 >> (AUTH_SESSION_ID, KEYCLOAK_SESSION, KEYCLOAK_IDENTITY) >> >> Any help appreciated >> >> Thanks a bunch! >> >> Regards, >> BL >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > -- > Ariel Carrera > --