Race Condition Between Keycloak Events and Entity Availability #40047

stephane-segning · 2025-05-28T22:37:26Z

stephane-segning
May 28, 2025

Issue Description

We're experiencing a race condition between Keycloak event triggers and entity availability in our webhook handling system. This affects both user creation and entity updates.

Original Issue with User Creation

As documented in issue #29, we discovered that Keycloak sometimes fires a USER-CREATE event before the user is actually available via the Admin API. When our webhook handler receives this event and attempts to query Keycloak for the user details, it results in a 404 error.

Expanded Issue with Entity Updates

We've now identified a similar race condition pattern during entity updates:

Update event is triggered in Keycloak
Two processes happen in parallel:
- 2.a. Our webhook handling system receives the event and queries for the entity
- 2.b. Keycloak completes the entity update in its database
Our system processes outdated entity data because it retrieved the entity before the update was complete

Visual Representation

sequenceDiagram
    participant Client
    participant Keycloak
    participant EventSystem
    participant WebhookHandler
    
    Client->>Keycloak: Update entity
    Keycloak->>EventSystem: Trigger event (begins processing)
    
    par Parallel Processes
        EventSystem->>WebhookHandler: Deliver event
        WebhookHandler->>Keycloak: Query for entity details
        and
        Keycloak->>Keycloak: Complete entity update in database
    end
    
    Note over WebhookHandler: Receives outdated data or 404 error
    WebhookHandler->>WebhookHandler: Process potentially stale data

Technical Questions

Is this a known behavior in Keycloak's event system? Are events intentionally triggered before database transactions are complete?
Are we implementing the webhook handling incorrectly? Should we be implementing some form of retry mechanism or delay?
Is there a recommended pattern for ensuring data consistency when working with Keycloak's event system?

Current Environment

Keycloak Version: 25, 26
Webhook Implementation: vymalo/keycloak-webhook
Deployment Architecture: Docker, Kubernetes

Potential Solutions We've Considered

Retry Mechanism: Implement exponential backoff retries when entity retrieval fails or returns unexpected data.
Event Queuing: Buffer events and process them with a slight delay to allow database operations to complete.
Optimistic Locking: Version check entities to detect if they've been updated between event trigger and processing.
Event Enrichment: Modify our Keycloak extensions to include full entity data in the event payload instead of just IDs.

Has anyone else encountered this issue or have recommendations for addressing this race condition?

I've checked the issues but couldn't get help (#33194).

Thanks in advance for your insights!

Navigation Menu

Repository navigation

Race Condition Between Keycloak Events and Entity Availability #40047

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Race Condition Between Keycloak Events and Entity Availability #40047

Uh oh!

stephane-segning May 28, 2025

Issue Description

Original Issue with User Creation

Expanded Issue with Entity Updates

Visual Representation

Technical Questions

Current Environment

Potential Solutions We've Considered

Replies: 0 comments

stephane-segning
May 28, 2025