Repository navigation
|
We have setup Keycloak OpenTelemetery successfully and see traces in the Jaeger (all-in-one) instance. However I am unable to see traces for calls made from the Keycloak-IDP to other identity providers, however it is mentioned here: https://www.keycloak.org/observability/tracing As mentioned: Spans
See last bullet. From the Jaeger UI I can see a-lot of operations, but I do not see any related to an IDP call ? Anyone else experience the same or has seen these traces? Are they named differently? Then at least I know it is related to our current setup. |
Replies: 1 comment
|
So digging into this and going through the source-code I found the following on why the tracing for the IDP is not (directly) visible within e.g. Jaeger: So the spans do exist, but they are flat, one-per-HTTP-request. Everything inside (token exchange HTTP call, identity extraction, mapper processing, user lookup/creation) is visible within that single span. So there are no child spans created for those sub-operations. The auto-instrumented span (e.g. Endpoint.authResponse) covers the entire method as one block — you can see it started and ended in Jaeger, but you cannot So for example, inside authResponse() these things happen sequentially:
In Jaeger, all of that appears as a single flat bar with one duration. You can't tell whether a slow request was caused by the external IDP being slow at step 2, or by a slow database lookup at step 4. The only way is to open the trace and drill down each call. Bottom line, you need to search within Jaeger on the operation: GET /realms/{realm}/broker/{provider_alias}/endpoint Inside that trace you will see the POST and the GET to the IDP. Hope this helps anyone; but for Keycloak, would be nice to at least add the attributes to the trace like "kc.idp.alias" or better start a new trace for the http calls towards an IDP; but at least knowing above already helps. |
So digging into this and going through the source-code I found the following on why the tracing for the IDP is not (directly) visible within e.g. Jaeger:
So the spans do exist, but they are flat, one-per-HTTP-request. Everything inside (token exchange HTTP call, identity extraction, mapper processing, user lookup/creation) is visible within that single span.
So there are no child spans created for those sub-operations. The auto-instrumented span (e.g. Endpoint.authResponse) covers the entire method as one block — you can see it started and ended in Jaeger, but you cannot
see a breakdown of how time was spent within it on the trace level, only within the trace.
So for example, inside authR…