You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Java adapter configuration "connection-ttl-millis" not being used
#19851
It appears that the Java adapter configuration connection-ttl-millis, specified in the keycloak.json file, is being harvested, but not actually being used.
After that, the connectionTTL member variable is not used anywhere.
It seems the locations where it's meant to be used is in org.keycloak.adapters.HttpClientBuilder around line # 308.
PoolingHttpClientConnectionManager tcm = new PoolingHttpClientConnectionManager(sf.build());
should be changed to
PoolingHttpClientConnectionManager tcm = new PoolingHttpClientConnectionManager(sf.build(),
null, null, null, connectionTTL, connectionTTLUnit);
in order to use the setting.
Our use case is that we have keycloak servers behind a load balancer, and that load balancer will close connections after a certain amount of time. We set the connection-ttl-millis configuration option to a value lower than that, but we were still seeing connection reset exceptions
java.net.SocketException: Connection reset
at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186)
at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140)
at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:478)
at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:472)
at java.base/sun.security.ssl.SSLSocketInputRecord.bytesInCompletePacket(SSLSocketInputRecord.java:70)
at java.base/sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1449)
at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1060)
at org.apache.http.impl.io.SessionInputBufferImpl.streamRead(SessionInputBufferImpl.java:137)
at org.apache.http.impl.io.SessionInputBufferImpl.fillBuffer(SessionInputBufferImpl.java:153)
at org.apache.http.impl.io.SessionInputBufferImpl.readLine(SessionInputBufferImpl.java:280)
at org.apache.http.impl.conn.DefaultHttpResponseParser.parseHead(DefaultHttpResponseParser.java:138)
at org.apache.http.impl.conn.DefaultHttpResponseParser.parseHead(DefaultHttpResponseParser.java:56)
at org.apache.http.impl.io.AbstractMessageParser.parse(AbstractMessageParser.java:259)
at org.apache.http.impl.DefaultBHttpClientConnection.receiveResponseHeader(DefaultBHttpClientConnection.java:163)
at org.apache.http.impl.conn.CPoolProxy.receiveResponseHeader(CPoolProxy.java:157)
at org.apache.http.protocol.HttpRequestExecutor.doReceiveResponse(HttpRequestExecutor.java:273)
at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:125)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:272)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
at org.keycloak.adapters.ServerRequest.invokeRefresh(ServerRequest.java:209)
...
Once we modified org.keycloak.adapters.HttpClientBuilder as described above, these connection reset errors went away.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
It appears that the Java adapter configuration
connection-ttl-millis, specified in the keycloak.json file, is being harvested, but not actually being used.https://www.keycloak.org/docs/latest/securing_apps/index.html#_java_adapter_config
That configuration option is being harvested in
org.keycloak.adapters.HttpClientBuilderaround line # 454.After that, the
connectionTTLmember variable is not used anywhere.It seems the locations where it's meant to be used is in
org.keycloak.adapters.HttpClientBuilderaround line # 308.should be changed to
in order to use the setting.
Our use case is that we have keycloak servers behind a load balancer, and that load balancer will close connections after a certain amount of time. We set the
connection-ttl-millisconfiguration option to a value lower than that, but we were still seeing connection reset exceptionsOnce we modified
org.keycloak.adapters.HttpClientBuilderas described above, these connection reset errors went away.All reactions