Keycloak 26.3.4 doesn't support DB without XA transactions? #42731

v-kamerdinerov · 2025-09-18T09:50:07Z

v-kamerdinerov
Sep 18, 2025

Has anyone tried running the latest vanilla keycloak (anything above major version 26 - specifically 26.3.4) alongside Galera (mariadb) as the database?

We previously used this setup on version 20, specifying KC_TRANSACTION_XA_ENABLED: false, without any issues.

Now I'm trying to deploy the latest version side-by-side on a clean database for testing, and I'm clearly running into these XA transactions.

Failed with exception code XAException.XAER_RMERR: javax.transaction.xa.XAException: Error trying to transactionRollback local transaction: (conn=26671) Connection is closed

I double-checked — my Galera/MariaDB version does not support XA transactions:

MariaDB [keycloak]> XA START 'xatest'
    -> ;
ERROR 1235 (42000): This version of MariaDB doesn't yet support 'XA transactions with Galera replication'

I'm running a keycloak instance in Kubernetes - I connect to the Galera DB via proxysql - here's my ENV (more details):

JAVA_OPTS="-Xms128m -Xmx384m -XX:MetaspaceSize=256M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true"
JAVA_OPTS_APPEND="--add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.util.concurrent=ALL-UNNAMED -Djboss.as.management.blocking.timeout=300 -Djgroups.dns.query=keycloak-headless.keycloak.svc.kube"
JDBC_PARAMS="socketTimeout=0&connectTimeout=10000&autoReconnect=true"
KC_DB="mariadb"
KC_DB_POOL_MAX_SIZE="100"
KC_DB_POOL_MIN_SIZE="100"
KC_DB_SCHEMA="keycloak"
KC_DB_URL="jdbc:mariadb://proxysql.instance:3306/keycloak"
KC_DB_USERNAME="keycloak"
KC_LOG_LEVEL="INFO"
KC_SPI_ADMIN_REALM="master"
KC_TRANSACTION_XA_ENABLED="false"
QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY="false"
KC_HEALTH_ENABLED="true"
KC_PROXY_HEADERS="forwarded"
KC_METRICS_ENABLED="true"
KC_HOSTNAME_STRICT="false"
KC_HOSTNAME_STRICT_BACKCHANNEL="false"
KC_HOSTNAME_STRICT_HTTPS="false"
KC_HTTP_ENABLED="true"
KC_HTTP_RELATIVE_PATH="/auth"
KC_CACHE_STACK="kubernetes"
KC_CACHE="ispn"

As you can see, I explicitly set:

KC_TRANSACTION_XA_ENABLED="false"
QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY="false"

And I still get this error:

JAVA_OPTS already set in environment; overriding default settings
Appending additional Java properties to JAVA_OPTS
Changes detected in configuration. Updating the server image.
WARNING: The following used options or option values are DEPRECATED and will be removed or their behaviour changed in a future release:
	- cache-stack=kubernetes: Use 'jdbc-ping' instead by leaving it unset.
Consult the Release Notes for details.
Updating the configuration and installing your custom providers, if any. Please wait.
2025-09-18 11:09:57,052 INFO  [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 38941ms
Server configuration updated and persisted. Run the following command to review the configuration:

	kc.sh show-config

Next time you run the server, just run:

	kc.sh start --import-realm --optimized

WARNING: The following used options or option values are DEPRECATED and will be removed or their behaviour changed in a future release:
	- cache-stack=kubernetes: Use 'jdbc-ping' instead by leaving it unset.
Consult the Release Notes for details.
WARNING: Hostname v1 options [hostname-strict-backchannel, hostname-strict-https] are still in use, please review your configuration
2025-09-18 11:10:14,027 INFO  [org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator] (main) JGroups Encryption enabled (mTLS).
2025-09-18 11:10:14,340 INFO  [org.infinispan.CONTAINER] (main) Virtual threads support enabled
2025-09-18 11:10:14,653 INFO  [org.keycloak.jgroups.certificates.CertificateReloadManager] (main) Starting JGroups certificate reload manager
2025-09-18 11:10:14,900 INFO  [org.infinispan.CONTAINER] (main) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'
2025-09-18 11:10:15,489 INFO  [org.infinispan.CLUSTER] (main) ISPN000078: Starting JGroups channel `ISPN` with stack `kubernetes`
2025-09-18 11:10:15,493 INFO  [org.jgroups.JChannel] (main) local_addr: c9625f43-626c-466e-b7a1-48c23a734ac6, name: vk-keycloak-0-1040
2025-09-18 11:10:15,520 INFO  [org.jgroups.protocols.FD_SOCK2] (main) server listening on *:57800
2025-09-18 11:10:17,529 INFO  [org.jgroups.protocols.pbcast.GMS] (main) vk-keycloak-0-1040: no members discovered after 2004 ms: creating cluster as coordinator
2025-09-18 11:10:17,575 INFO  [org.infinispan.CLUSTER] (main) ISPN000094: Received new cluster view for channel ISPN: [vk-keycloak-0-1040|0] (1) [vk-keycloak-0-1040]
2025-09-18 11:10:17,582 INFO  [org.keycloak.jgroups.certificates.CertificateReloadManager] (main) Reloading JGroups Certificate
2025-09-18 11:10:17,732 INFO  [org.infinispan.CLUSTER] (main) ISPN000079: Channel `ISPN` local address is `vk-keycloak-0-1040`, physical addresses are `[10.220.1.212:7800]`
2025-09-18 11:10:18,925 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: vk-keycloak-0-1040, Site name: null
2025-09-18 11:10:20,287 INFO  [org.keycloak.services] (main) KC-SERVICES0050: Initializing master realm
2025-09-18 11:10:20,436 INFO  [org.hibernate.orm.jdbc.batch] (main) HHH100503: On release of batch it still contained JDBC statements
2025-09-18 11:10:20,453 WARN  [com.arjuna.ats.jta] (main) ARJUNA016045: attempted rollback of < formatId=131077, gtrid_length=35, bqual_length=36, tx_uid=0:ffff0adc01d4:a0bb:68cbbe64:33, node_name=quarkus, branch_uid=0:ffff0adc01d4:a0bb:68cbbe64:36, subordinatenodename=null, eis_name=0 > (io.agroal.narayana.LocalXAResource@3d07c7aa) failed with exception code XAException.XAER_RMERR: javax.transaction.xa.XAException: Error trying to transactionRollback local transaction: (conn=26671) Connection is closed
	at io.agroal.narayana.XAExceptionUtils.xaException(XAExceptionUtils.java:20)
	at io.agroal.narayana.XAExceptionUtils.xaException(XAExceptionUtils.java:8)
	at io.agroal.narayana.LocalXAResource.rollback(LocalXAResource.java:89)
	at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelAbort(XAResourceRecord.java:318)
	at com.arjuna.ats.arjuna.coordinator.BasicAction.doAbort(BasicAction.java:3162)
	at com.arjuna.ats.arjuna.coordinator.BasicAction.doAbort(BasicAction.java:3141)
	at com.arjuna.ats.arjuna.coordinator.BasicAction.Abort(BasicAction.java:1731)
	at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.cancel(TwoPhaseCoordinator.java:99)
	at com.arjuna.ats.arjuna.AtomicAction.abort(AtomicAction.java:159)
	at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.rollbackAndDisassociate(TransactionImple.java:1389)
	at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.rollback(BaseTransaction.java:121)
	at io.quarkus.narayana.jta.runtime.NotifyingTransactionManager.rollback(NotifyingTransactionManager.java:94)
	at org.keycloak.transaction.JtaTransactionWrapper.rollback(JtaTransactionWrapper.java:114)
	at org.keycloak.services.DefaultKeycloakTransactionManager.lambda$rollbackWithTracing$2(DefaultKeycloakTransactionManager.java:211)
	at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:59)
	at org.keycloak.tracing.NoopTracingProvider.trace(NoopTracingProvider.java:69)
	at org.keycloak.services.DefaultKeycloakTransactionManager.rollbackWithTracing(DefaultKeycloakTransactionManager.java:210)
	at org.keycloak.services.DefaultKeycloakTransactionManager.rollback(DefaultKeycloakTransactionManager.java:191)
	at org.keycloak.services.DefaultKeycloakTransactionManager.rollback(DefaultKeycloakTransactionManager.java:183)
	at org.keycloak.services.DefaultKeycloakSession.closeTransactionManager(DefaultKeycloakSession.java:390)
	at org.keycloak.services.DefaultKeycloakSession.close(DefaultKeycloakSession.java:357)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:454)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:345)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:335)
	at org.keycloak.services.resources.KeycloakApplication.bootstrap(KeycloakApplication.java:116)
	at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:86)
	at org.keycloak.models.utils.KeycloakModelUtils.lambda$runJobInTransaction$1(KeycloakModelUtils.java:346)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithResult(KeycloakModelUtils.java:460)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:345)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:335)
	at org.keycloak.services.resources.KeycloakApplication.startup(KeycloakApplication.java:78)
	at org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication.onStartupEvent(QuarkusKeycloakApplication.java:52)
	at org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication_Observer_onStartupEvent_GNZ8m5QenZ9h9VNelo7awjUZFDE.notify(Unknown Source)
	at io.quarkus.arc.impl.EventImpl$Notifier.notifyObservers(EventImpl.java:365)
	at io.quarkus.arc.impl.EventImpl$Notifier.notify(EventImpl.java:347)
	at io.quarkus.arc.impl.EventImpl.fire(EventImpl.java:81)
	at io.quarkus.arc.runtime.ArcRecorder.fireLifecycleEvent(ArcRecorder.java:163)
	at io.quarkus.arc.runtime.ArcRecorder.handleLifecycleEvents(ArcRecorder.java:114)
	at io.quarkus.runner.recorded.LifecycleEventsBuildStep$startupEvent1144526294.deploy_0(Unknown Source)
	at io.quarkus.runner.recorded.LifecycleEventsBuildStep$startupEvent1144526294.deploy(Unknown Source)
	at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
	at io.quarkus.runtime.Application.start(Application.java:101)
	at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:121)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:77)
	at org.keycloak.quarkus.runtime.KeycloakMain.start(KeycloakMain.java:133)
	at org.keycloak.quarkus.runtime.cli.Picocli.start(Picocli.java:1025)
	at org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.run(AbstractStartCommand.java:49)
	at picocli.CommandLine.executeUserObject(CommandLine.java:2030)
	at picocli.CommandLine.access$1500(CommandLine.java:148)
	at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2465)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2457)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2419)
	at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2277)
	at picocli.CommandLine$RunLast.execute(CommandLine.java:2421)
	at picocli.CommandLine.execute(CommandLine.java:2174)
	at org.keycloak.quarkus.runtime.cli.Picocli.parseAndRun(Picocli.java:133)
	at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:104)
	at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:78)
	at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:68)
	at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:36)
Caused by: java.sql.SQLNonTransientConnectionException: (conn=26671) Connection is closed
	at org.mariadb.jdbc.export.ExceptionFactory.createException(ExceptionFactory.java:300)
	at org.mariadb.jdbc.export.ExceptionFactory.create(ExceptionFactory.java:378)
	at org.mariadb.jdbc.Connection.checkNotClosed(Connection.java:700)
	at org.mariadb.jdbc.Connection.rollback(Connection.java:234)
	at io.agroal.pool.ConnectionHandler.transactionRollback(ConnectionHandler.java:377)
	at io.agroal.narayana.LocalXAResource.rollback(LocalXAResource.java:86)
	... 57 more

2025-09-18 11:10:20,458 WARN  [io.agroal.pool] (main) Datasource '<default>': (conn=26671) Connection is closed
2025-09-18 11:10:20,459 WARN  [io.agroal.pool] (main) Datasource '<default>': (conn=26671) Connection is closed
2025-09-18 11:10:20,642 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (production) mode
2025-09-18 11:10:20,643 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Database operation failed
2025-09-18 11:10:20,643 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: could not execute batch [java.sql.SQLNonTransientConnectionException: (conn=26671) Socket error] [insert into REALM_ATTRIBUTE (VALUE,NAME,REALM_ID) values (?,?,?)]
2025-09-18 11:10:20,643 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: java.sql.SQLNonTransientConnectionException: (conn=26671) Socket error
2025-09-18 11:10:20,644 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: (conn=26671) Socket error
2025-09-18 11:10:20,644 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Broken pipe
2025-09-18 11:10:20,644 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.

shawkins · 2025-09-18T12:42:59Z

shawkins
Sep 18, 2025
Collaborator

What you are seeing is not directly related to the XA enabled flag. XA enabled = false means to use a Connection via a DataSource, instead of an XADataSource. The stacktrace confirms the transaction manager is using a LocalXAResource which just wraps a Connection.

The batch operation being performed may not be well supported in your setup. We just need to figure out where the problem lies.

Can you try this scenario without the proxy? The broken pipe could be indicative of a problem there.

5 replies

v-kamerdinerov Sep 18, 2025
Author

Seems like you are right - i tried use direct connection to my mariadb instance - w/o galera or proxysql endpoints:

jdbc:mariadb://10.40.7.6:20000/keycloak

And it worked!

2025-09-18 16:08:25,983 INFO  [io.quarkus] (main) Keycloak 26.3.4 on JVM (powered by Quarkus 3.20.2.2) started in 16.250s. Listening on: http://0.0.0.0:8080. Management interface listening on http://0.0.0.0:9000.
2025-09-18 16:08:25,984 INFO  [io.quarkus] (main) Profile prod activated.
2025-09-18 16:08:25,984 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-mariadb, keycloak, micrometer, narayana-jta, opentelemetry, reactive-routes, rest, rest-jackson, smallrye-context-propagation, smallrye-health, vertx]

Now it remains to understand which specific barch request cannot be executed - or maybe i can tune proxysql somehow.

v-kamerdinerov Sep 18, 2025
Author

We just need to figure out where the problem lies.

Answering my own question:

I managed to start keycloak and proxysql by instructing the user not to modify any queries in the database.

This is done using the fast_forward flag in the proxysql configuration.

MariaDB [(none)]> select username,fast_forward from mysql_users where username is "keycloak";
+----------+--------------+
| username | fast_forward |
+----------+--------------+
| keycloak | 1            |
+----------+--------------+

v-kamerdinerov Sep 19, 2025
Author

We just need to figure out where the problem lies.

Answering my own question:

I managed to start keycloak and proxysql by instructing the user not to modify any queries in the database.

This is done using the fast_forward flag in the proxysql configuration.
MariaDB [(none)]> select username,fast_forward from mysql_users where username is "keycloak";
+----------+--------------+
| username | fast_forward |
+----------+--------
8000
------+
| keycloak | 1            |
+----------+--------------+

Looks like I was too hasty - fast_forward has only corrected my error so far. But at least I understood the direction.

Now i getting on clean DB and fresh start

2025-09-19 11:12:57,275 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: liquibase.exception.LiquibaseException: liquibase.exception.MigrationFailedException: Migration failed for changeset META-INF/jpa-changelog-1.0.0.Final.xml::1.0.0.Final-KEYCLOAK-5461::sthorger@redhat.com:
Enabling keys [Failed SQL: (-1) ALTER TABLE keycloak.CLIENT_SESSION_ROLE ADD CONSTRAINT FK_11B7SGQW18I532811V7O2DV76 FOREIGN KEY (CLIENT_SESSION) REFERENCES keycloak.CLIENT_SESSION (ID)]
2025-09-19 11:12:57,275 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: liquibase.exception.MigrationFailedException: Migration failed for changeset META-INF/jpa-changelog-1.0.0.Final.xml::1.0.0.Final-KEYCLOAK-5461::sthorger@redhat.com:
Enabling keys [Failed SQL: (-1) ALTER TABLE keycloak.CLIENT_SESSION_ROLE ADD CONSTRAINT FK_11B7SGQW18I532811V7O2DV76 FOREIGN KEY (CLIENT_SESSION) REFERENCES keycloak.CLIENT_SESSION (ID)]
2025-09-19 11:12:57,275 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Migration failed for changeset META-INF/jpa-changelog-1.0.0.Final.xml::1.0.0.Final-KEYCLOAK-5461::sthorger@redhat.com:
Enabling keys [Failed SQL: (-1) ALTER TABLE keycloak.CLIENT_SESSION_ROLE ADD CONSTRAINT FK_11B7SGQW18I532811V7O2DV76 FOREIGN KEY (CLIENT_SESSION) REFERENCES keycloak.CLIENT_SESSION (ID)]
Enabling keys [Failed SQL: (-1) ALTER TABLE keycloak.CLIENT_SESSION_ROLE ADD CONSTRAINT FK_11B7SGQW18I532811V7O2DV76 FOREIGN KEY (CLIENT_SESSION) REFERENCES keycloak.CLIENT_SESSION (ID)]

shawkins Sep 19, 2025
Collaborator

Now i getting on clean DB and fresh start

Are you starting more than 1 instance of Keycloak?

cc @ahus1 @mabartos can you have a look as well having dealt recently with db initialization issues.

v-kamerdinerov Sep 19, 2025
Author

more than 1 instance

nope - just one instance on clean and fresh DB via proxysql with enabled transaction_persistent and fast_forward for keycloak user.

Navigation Menu

Repository navigation

Keycloak 26.3.4 doesn't support DB without XA transactions? #42731

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak 26.3.4 doesn't support DB without XA transactions? #42731

Uh oh!

v-kamerdinerov Sep 18, 2025

Replies: 1 comment · 5 replies

Uh oh!

shawkins Sep 18, 2025 Collaborator

Uh oh!

v-kamerdinerov Sep 18, 2025 Author

Uh oh!

v-kamerdinerov Sep 18, 2025 Author

Uh oh!

Uh oh!

v-kamerdinerov Sep 19, 2025 Author

Uh oh!

shawkins Sep 19, 2025 Collaborator

Uh oh!

v-kamerdinerov Sep 19, 2025 Author

v-kamerdinerov
Sep 18, 2025

Replies: 1 comment 5 replies

shawkins
Sep 18, 2025
Collaborator

v-kamerdinerov Sep 18, 2025
Author

v-kamerdinerov Sep 18, 2025
Author

v-kamerdinerov Sep 19, 2025
Author

shawkins Sep 19, 2025
Collaborator

v-kamerdinerov Sep 19, 2025
Author