Repository navigation
Replies: 1 comment 2 replies
It is a decision we made. It does not make sense to keep sessions in two external systems due to the cost of updating them on each access (you have to keep track of the last access time for expiration reasons). It would also complicate the logic and be tricky to keep them in sync. So we decided to keep the session only in one system: when |
|
Thanks for the confirmation and the background info, Pedro. So in this case when both features are enabled, given we no longer have the embedded Infinispan cache in place, all the read requests for the user session will now be served from the Database? I traced the code down to the I am trying to understand it better so we know what to watch out for. We are currently on 26.4.11, using the default persist-user-sessions feature with embedded Infinispan cache. We are trying to migrate from embedded cache to remote infinispan server, so our keycloak deployment can become stateless. As far as I know, disabling the persist-user-sessions feature in this transition will introduce a mass logout event for our users during the cutover. That has potentially significant negative impacts on business revenue. So I am looking into the effect of keeping the feature enabled. |
That is correct.
Not in Keycloak, but expect an increase in CPU usage for the database. If my memory does not fail me, we had a CPU usage increase from 20% ( We don't have any comparison between embedded vs clusterless; I advise you to do a small test in a dev/stage environment. The difference won't be as big as above - in theory.
Nice, I like the stateless architecture better than an embedded Infinispan. Although I admit the network access (remote cache) won't be as fast as memory access (embedded cache).
Unfortunately, that's correct. The alternative is to develop a tool to migrate the database data to the external Infinispan cluster, but it will require downtime during the migration. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I am currently running Keycloak
26.4.11with thepersist-user-sessionsfeature enabled by default. With this setup, the user session is persisted in the database as the source of truth, while some of them are also stored in the embedded infinispan cache for faster access.I am now testing with both the
persist-user-sessionsandclusterlessfeatures enabled. In this case, I can see the session gets persisted in the database, but no session records appear in the "sessions" cache on the remote infinispan server.So here is my question, in this case, does Keycloak still maintain a cache of the user sessions on each node, although the cache is no longer a distributed one like before? Assume yes, then how does it keep the caches in sync?
I know having both feature enabled is not in the well-quoted blog post, but based on my own test and the previous discussions of this subject like here and here, I also see evidence the combination is working. But seeing the "sessions" cache in the remote infinispan server being empty, I worry about the performance impact (on database load) without knowing anything about the caches on the Keycloak side.
All reactions