|
49 | 49 | </para> |
50 | 50 | <para> |
51 | 51 | For realm and users Keycloak uses a invalidation cache. An invalidation cache doesn't share any data, but simply |
52 | | - removes stale data from remote caches. This reduces network traffic, as well as preventing sensitive data (such as |
| 52 | + removes stale data from remote caches and makes sure all nodes re-load data from the database when it is changed. This reduces network traffic, as well as preventing sensitive data (such as |
53 | 53 | realm keys and password hashes) from being sent between the nodes. |
54 | 54 | </para> |
55 | 55 | <para> |
56 | 56 | User sessions and login failures supports either distributed caches or fully replicated caches. We recommend using a distributed |
57 | | - cache. |
| 57 | + cache. A distributed |
| 58 | + cache splits user sessions into segments where each node holds one or more segment. It is possible |
| 59 | + to replicate each segment to multiple nodes, but this is not strictly necessary since the failure of a node |
| 60 | + will only result in users having to log in again. If you need to prevent node failures from requiring users to |
| 61 | + log in again, set the <literal>owners</literal> attribute to 2 or more for the <literal>sessions</literal> cache |
| 62 | + of <literal>infinispan/Keycloak</literal> container as described below. |
58 | 63 | </para> |
59 | 64 | <para> |
60 | | - To enable clustering in Keycloak open <literal>standalone/configuration/keycloak-server.json</literal> and add: |
| 65 | + The infinispan container is set by default in <literal>standalone/configuration/keycloak-server.json</literal>: |
61 | 66 | <programlisting> |
62 | 67 | "connectionsInfinispan": { |
63 | 68 | "default" : { |
|
66 | 71 | } |
67 | 72 | </programlisting> |
68 | 73 | </para> |
69 | | - </section> |
70 | | - |
71 | | - <section> |
72 | | - <title>Enable realm and user cache invalidation</title> |
| 74 | + <para>As you can see in this file, the realmCache, userCache and userSession providers are configured to use infinispan by default, which applies for both cluster and non-cluster environment.</para> |
73 | 75 | <para> |
74 | | - To reduce number of requests to the database Keycloak caches realm and user data. In cluster mode |
75 | | - Keycloak uses an Infinispan invalidation cache to make sure all nodes re-load data from the database |
76 | | - when it is changed. Using an invalidation cache instead of a replicated cache reduces the network traffic |
77 | | - generated by the cluster, but more importantly prevents sensitive data from being sent. |
| 76 | + For non-cluster configuration (server executed with <literal>standalone.xml</literal> ) is the infinispan container <literal>infinispan/Keycloak</literal> just uses local infinispan caches for realms, users and userSessions. |
78 | 77 | </para> |
79 | 78 | <para> |
80 | | - To enable realm and user cache invalidation open <literal>keycloak-server.json</literal> and change |
81 | | - the <literal>realmCache</literal> and <literal>userCache</literal> providers to <literal>infinispan</literal>: |
82 | | -<programlisting> |
83 | | -"realmCache": { |
84 | | - "provider": "infinispan" |
85 | | -}, |
86 | | - |
87 | | -"userCache": { |
88 | | - "provider": "infinispan" |
89 | | -} |
90 | | -</programlisting> |
91 | | - </para> |
92 | | - </section> |
93 | | - |
94 | | - <section> |
95 | | - <title>Enable distributed user sessions</title> |
96 | | - <para> |
97 | | - To help distribute the load of user sessions Keycloak uses an Infinispan distributed cache. A distributed |
98 | | - cache splits user sessions into segments where each node holds one or more segment. It is possible |
99 | | - to replicate each segment to multiple nodes, but this is not strictly necessary since the failure of a node |
100 | | - will only result in users having to log in again. If you need to prevent node failures from requiring users to |
101 | | - log in again, set the <literal>owners</literal> attribute to 2 or more for the <literal>sessions</literal> cache |
102 | | - (see <link linkend='cluster-configure-infinispan'>Configure Infinispan</link>). |
103 | | - </para> |
104 | | - <para> |
105 | | - To enable the Infinispan user sessions provider open <literal>keycloak-server.json</literal> and change the |
106 | | - userSessions provider to <literal>infinispan</literal>: |
107 | | -<programlisting> |
108 | | -"userSessions": { |
109 | | - "provider": "infinispan" |
110 | | -} |
111 | | -</programlisting> |
| 79 | + For cluster configuration, you can edit the configuration of <literal>infinispan/Keycloak</literal> container in <literal>standalone/configuration/standalone-ha.xml</literal> (or <literal>standalone-keycloak-ha.xml</literal> |
| 80 | + if you are using overlay or demo distribution) . |
112 | 81 | </para> |
113 | 82 | </section> |
114 | 83 |
|
|
117 | 86 | <para> |
118 | 87 | To start the server in HA mode, start it with: |
119 | 88 | <programlisting># bin/standalone --server-config=standalone-ha.xml</programlisting> |
| 89 | + or if you are using overlay or demo distribution with: |
| 90 | + <programlisting># bin/standalone --server-config=standalone-keycloak-ha.xml</programlisting> |
120 | 91 | </para> |
121 | 92 | <para> |
122 | 93 | Alternatively you can copy <literal>standalone/config/standalone-ha.xml</literal> to <literal>standalone/config/standalone.xml</literal> |
|
0 commit comments