[keycloak-user] failover scenario

[Stian Thorgersen]

Having two completely separate and independent clusters seems very limited,
error prone and hard to manage IMO. What about things like user sessions,
required actions, users, dynamic client registration, etc.. None of those
things will work properly if you don't have it propagated to the two
clusters.

By the way we are working on introducing cross DC support. See the recent
blog post for an early preview that can be tried out.

On 19 October 2017 at 16:15, Sud Ramasamy <to_sud at yahoo.com> wrote:

> With our need to treat the two clusters as being independent, we did
> consider scripting the replication of the configuration data from one db to
> the other. But we’d have to be selective about what we replicate and update
> the script as the schema changes with upgrades.
>
> We’re now looking at using signed JWT as the client authentication
> mechanism instead of the Keycloak generated secret. So long as we use the
> same key’s and certificates between the PROD and DR configuration it
> appears that this should solve this issue.
>
> Thoughts?
> -sud
>
> On October 18, 2017 at 11:47:56 PM, Stian Thorgersen (sthorger at redhat.com)
> wrote:
>
> Why not just do DB replication?
>
> On 18 Oct 2017 10:33 pm, "Sud Ramasamy" <to_sud at yahoo.com> wrote:
> Hi Keycloak devs/users,
>
> We are trying to wrap our heads around how we might deploy Keycloak in a
> PROD with DR failover topology and are running into a concern with the
> client secret being different between the clusters.
>
> We have two separate Keycloak clusters with their own databases for our
> PROD and DR datacenters. As part of initial one-time client setup when we
> register the client in the PROD cluster we also register the same client in
> our DR cluster. The configuration for the client is identical between the
> two clusters except for the client secret which is generated by Keycloak.
>
> When there is a DR event for Keycloak (either failure or scheduled
> maintenance) we have the ability to repoint the URL for the PROD Keycloak
> to the DR Keycloak cluster. We don’t change anything else. Unfortunately
> the PROD clients will not be able to establish SSO with the DR cluster
> because the client secret is different.
>
> We’ve considered instead of using the Keycloak APIs to register the client
> in both clusters (thereby having different client secrets) to register the
> client in one cluster and use database scripts to push the same
> configuration to the other cluster database and thereby keep the secrets
> the same.
>
> I was wondering if others have run into this limitation and how you may
> have solved for it. Also we are on Keycloak 2.5 (for RH-SSO support
> purposes). This might be addressed in the upcoming release of Keycloak with
> multi-datacenter support. But that is currently not an option for us.
>
> Thanks in advance for your insight.
> -sud
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>