Keycloak 16 Dockerfile with custom provider #15670

Kagemusha-san · 2022-11-24T11:41:14Z

Kagemusha-san
Nov 24, 2022

We are still using Keycloak 16.1.1 at a customer and are not able to upgrade to a Quarkus-based Keycloak yet because of required code changes on our end. Unfortunately, we have a pressing request that requires a custom Identity Provider implementation.

According to the docs, it is enough to provide the custom provider to /opt/jboss/keycloak/standalone/deployments folder. When doing this via volume mapping we can see the custom provider in Keycloak's admin console:

docker run -d --restart unless-stopped --name keycloak-custom-volume \
	-e KEYCLOAK_USER=<user> \
	-e KEYCLOAK_PASSWORD=<pass> \
	-e DB_VENDOR=postgres \
	-e DB_ADDR=<db-host> \
	-e DB_PORT=5432 \
	-e DB_USER=<db-user> \
	-e DB_PASSWORD=<db-pass> \
	-e DB_DATABASE=<keycloak-db> \
	-v /path/to/custom-provider-with-dependencies.jar:/opt/jboss/keycloak/standalone/deployments/custom-provider-with-dependencies.jar \
	-p 4090:8080 jboss/keycloak:16.1.1

Our plan was to build a custom Keycloak image that we can directly use at our customer. First, it's easier to use since we don't have to download the provider's .jar. Second, volume mapping with AWS can get cumbersome. So we defined a two stage Dockerfile that first builds the .jar and copies it to Keycloak image afterwards:

ARG VERSION=16.1.1
FROM custom-maven as builder # custom-maven is a custom maven image based on maven:3-openjdk-18-slim that adds Sonar scanner to the image

COPY ./src pom.xml  ./
RUN mvn clean install

FROM jboss/keycloak:$VERSION

COPY --chown=1000 --from=builder target/custom-provider-with-dependencies.jar /opt/jboss/keycloak/standalone/deployments

The image is built fine and also starts without problems. We even see custom provider specific log entries:

09:10:10,001 INFO  [org.jboss.as.server.deployment] (MSC service thread 1-3) WFLYSRV0027: Starting deployment of "custom-provider-with-dependencies.jar" (runtime-name: "custom-provider-with-dependencies.jar")
09:10:26,613 INFO  [org.jboss.as.server] (ServerService Thread Pool -- 33) WFLYSRV0010: Deployed "custom-provider-with-dependencies.jar" (runtime-name : "custom-provider-with-dependencies.jar")

But the custom provider is not available in admin console. When checking /opt/jboss/keycloak/standalone/deployments in the docker container, we see the .jar and the .jar.deployed files. --chown:1000 was added because without, the .jar is owned by root and we thought that this might be a problem. We first tried --chown:jboss which also didn't help.

When using volume mapping there is one additional log entry

09:11:05,018 INFO  [org.jboss.as.server.deployment] (MSC service thread 1-3) WFLYSRV0027: Starting deployment of "custom-provider-with-dependencies.jar" (runtime-name: "custom-provider-with-dependencies.jar")
09:11:08,039 INFO  [org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor] (MSC service thread 1-2) Deploying Keycloak provider: custom-provider-with-dependencies.jar
09:11:20,813 INFO  [org.jboss.as.server] (ServerService Thread Pool -- 33) WFLYSRV0010: Deployed "custom-provider-with-dependencies.jar" (runtime-name : "custom-provider-with-dependencies.jar")

I looked through other discussions but could only find Quarkus-related ones (here and here).
Does anybody have some input what we are doing wrong or if what we want to achieve is possible at all?

Answered by Kagemusha-san

Dec 6, 2022

We found the problem. It was the first COPY statement in the Dockerfile. Using COPY . . fixed it.

View full answer

Kagemusha-san · 2022-12-06T13:36:54Z

Kagemusha-san
Dec 6, 2022
Author

We found the problem. It was the first COPY statement in the Dockerfile. Using COPY . . fixed it.

0 replies

Navigation Menu

Repository navigation

Keycloak 16 Dockerfile with custom provider #15670

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak 16 Dockerfile with custom provider #15670

Uh oh!

Uh oh!

Kagemusha-san Nov 24, 2022

Replies: 1 comment

Uh oh!

Kagemusha-san Dec 6, 2022 Author

Kagemusha-san
Nov 24, 2022

Kagemusha-san
Dec 6, 2022
Author