External rest call during authentication flow without blocking transaction #53738

bilak · 2026-10-08T11:49:25Z

bilak
Oct 8, 2026

Hello,
We have a need to call external service during the authentication flow and add returned data into the token which is being created. However the problem is that this is currently running under the transaction inside org.keycloak.authentication.Authenticator and obviously when running performance tests it escalates quickly. Is there any mechanism how to have the external rest call outside of the transaction but then forward the requested data back to authenticator? We'd like to work it out for all types of authentication (browser, client, ...).

Thanks in advance

TanbirRamim · 2026-10-10T00:02:16Z

TanbirRamim
Oct 10, 2026

There's a helper for exactly this in KeycloakModelUtils:

KeycloakModelUtils.suspendJtaTransaction(session.getKeycloakSessionFactory(), () -> {
    // your REST call here, no JTA transaction attached while it runs
});

It suspends the current JTA transaction, runs your code, then resumes it (see KeycloakModelUtils.suspendJtaTransaction in server-spi-private). Keycloak uses it internally for things like the liquibase lock.

To get the result into the token, store it on the auth session in your authenticator, e.g. context.getAuthenticationSession().setUserSessionNote("ext_data", value), then add a "User Session Note" mapper on the client (or a client scope) that maps ext_data to a claim. That works the same for browser and direct grant flows. For client credentials you're in a ClientAuthenticator instead, but the same suspend helper works there.

I'd also put a short timeout on the HTTP client and maybe cache the response, since the login still waits on that call even though the transaction isn't held open anymore.

0 replies

JuanTorchia · 2026-10-17T07:35:20Z

JuanTorchia
Oct 17, 2026

For your load test, I'd check what stays open during the REST call before relying on suspendJtaTransaction.

In 26.8.1, that helper suspends the thread's JTA transaction, runs the callback, then resumes it in finally. It doesn't commit or roll back the transaction. Running the callback outside the transaction context therefore isn't proof that database connections or locks have been released. The helper also runs the callback synchronously.

For the client-credentials part, you can pass the returned value through a custom ClientAuthenticator:

context.getClientAuthAttributes().put("ext_data", value);

Here context is a ClientAuthenticationFlowContext and value is a String. These client-auth attributes become user-session notes. The client-credentials grant copies them before issuing the token.

Then configure a User Session Note mapper on the client, or a client scope effective for this request: read note ext_data, use your desired token claim name, choose String for this example, and enable inclusion in the access token. If you use an optional client scope, include it in the token request. The mapper reads the value from the user-session note.

Which Keycloak version are you running, and what fails first under load: the database pool, database lock waits, or outbound HTTP/request capacity?

I checked these source paths in 26.8.1; I haven't reproduced your load test.

0 replies

Navigation Menu

Repository navigation

External rest call during authentication flow without blocking transaction #53738

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

External rest call during authentication flow without blocking transaction #53738

Uh oh!

Uh oh!

bilak Oct 8, 2026

Replies: 2 comments

Uh oh!

TanbirRamim Oct 10, 2026

Uh oh!

JuanTorchia Oct 17, 2026

bilak
Oct 8, 2026

TanbirRamim
Oct 10, 2026

JuanTorchia
Oct 17, 2026