Repository navigation
Conversation
…ession is still in cache. * remove deprecated `getClientSession` implementation * add new query to `OFFLINE_CLIENT_SESSION`
|
Thanks for the fix. However I think that it is rather a problem with your configuration as I pointed in the JIRA comment https://issues.redhat.com/browse/KEYCLOAK-19701 . Right now, Keycloak doesn't support to limit size in "offlineSessions" and "offlineClientSessions" caches. I think if we ever want to support download of the "evicted" sessions from the DB, it would need to be done more properly as lookup of the session by ID is just one scenario, but there are others (For example when user or administrator displays all sessions in account mgmt or admin console and he needs to query sessions rather than simply lookup them by ID). @hmlnarik @martin-kanis @sguilhen My vote is to close this PR, but leaving this to you as well as JIRA. |
|
I've the same problem with 500k offline sessions on two nodes in production. Any tips for offlineClientSessions and offlineSessions caches tuning? |
|
I got the same issue ("Session doesn't have required client") but have no clue about how it happened. I don't know either how to reproduce. I am not in production, I have not a lot of sessions, I have one Keycloak node, and I use the default infinite span cache settings. I am using Kecyloak 18.x.x. |
|
We are also experiencing this issue with |
|
I've seen this problem quite often in practice as well. The problem that this PR addresses often arises in scenarios where keycloak is used as an IdP / OpenID provider for mobile apps which quite often use large quantities (~100k - ~10Mio) of offline-sessions. If all offline-sessions are kept in memory, then the resource consumption of a single Keycloak instance can grow to 10s of GBs, even if most offline-sessions aren't accessed! To reduce memory consumption (and cost!) developers often try to limit the amount of cache entries while relying on the lazy offline-session fetching mechanism. Unfortunately, due to the lack of lazy-loading of offline-client sessions users are effectively logged from their apps of the offline-session gets evicted from memory, although there are still valid offline-sessions in the database. I think it would be very beneficial for a lot of users if offline-session /offline-client-session retrieval would be more robust and would allow a more resource-conserving approach. Regarding the possibility to list offline-sessions in the admin-console: Actually I've rarely seen admins using this functionality, especially if the number of offline sessions goes beyond a certain limit. As a current workaround users could create their own |
|
We are also experiencing this issue. |
|
Closing in favour of #17490 |
https://issues.redhat.com/browse/KEYCLOAK-19701