I do have a question regarding the inner workings of Keycloak when using an external database/datastore through the implementation of the different interfaces defined on Keycloak's User SPI documentation section.
On that section, it is mentioned that when Keycloak "runs" User related flows (like when login in), first the runtime will look for the User on the local cache, if not found then the runtime looks for the User on the local database, and finally if still not found, then the runtime looks for the User by iterating over the available custom User Providers.
Considering this, I do have the following doubts:
Considering a User was found on a remote datastore/db (through a custom User SPI implementation). Does Keycloak automatically or by default stores/copies that User in the local cache and/or the local datastore?
If the answer to the first question is affirmative, then what is the standard/accepted pattern (if such thing exists) to avoid data replication inconsistencies with the remote datastore/db state? For example, if a User was "invalidated" on the remote datastore/db, this is not immediately evident on the Keycloak's "version" of that User stored on the local cache and/or local store, so the User may successfully log himself in, even though on the remote datastore he shouldn't have had that access.
Kind of related to 1 & 2, is it possible when using a custom User SPI/ User Provider to completely ignore/bypass the local cache and the local datastore (when referring to User representations), so that we always (and only) use the external User data state and no replication to Keycloak cache/localstore happens at all?
Any feedback on this topic will be highly appreciated, as well as suggestions pointing to relevant documentation.