Keycloak High Availability: Standalone-HA vs Domain Clustered mode

user_4510444 0
Viewed 2656

Based on the documentation:

Domain Clustered Mode:

Domain mode is a way to centrally manage and publish the configuration for your servers.

Running a cluster in standard mode can quickly become aggravating as the cluster grows in size. Every time you need to make a configuration change, you have to perform it on each node in the cluster. Domain mode solves this problem by providing a central place to store and publish configurations. It can be quite complex to set up, but it is worth it in the end. This capability is built into the WildFly Application Server which Keycloak derives from.

I tried the example setup from the user manual and it really the maintenance of multiple configuration.

However, as High Availability is concerned, this is not quite resilient. When the master node goes down, the Auth Server will stop functioning since all the slave nodes listen to the domain controller.

Is my understanding correct here? Or am I missing something?

If this is the case, to ensure High Availability then Standalone-HA is the way to go, right?

keycloak
1 Answers

Wildfly nodes management and clustering is ortogonal features.

Clustering in keycloak in fact is just a cache replication (all kinds of sessions, login failures etc...). So if you want to enable fault tolerance for your sessions you just have to properly configure cache replication (and usually nodes discovery), and to do that you can simply just make owners param be greater that 1:

<distributed-cache name="sessions" owners="2"/>
<distributed-cache name="authenticationSessions" owners="2"/>
<distributed-cache name="offlineSessions" owners="2"/>
<distributed-cache name="clientSessions" owners="2"/>
<distributed-cache name="offlineClientSessions" owners="2"/>
<distributed-cache name="loginFailures" owners="1"/>
<distributed-cache name="actionTokens" owners="2">

Now all new sessions that was initiated on first node will be replicated to another node, so if first node goes down end-user can be served by another node. For example you can have 3 node total, and require at least 2 sessions replica distributed among those 3 nodes.

Now if we look to domain vs ha mode, we can say that it just all about how those jboss/wildfly server configs will be delivered to target node. In HA mode all configs supplied with server runtime, in domain mode this configs will be fetched from domain controller.

I suggest you to achieve replication with HA mode, and then if required move to Domain mode. Also if we take to account modern approach to containerize everything, HA mode is more appropriate for containerization. Parametrized clustering settings could be injected during container build, with ability to alter them in runtime via environment (e.g. owners param could be drained from container enviroment variable)

There was some articles in Keycloak blog about clustering like: this

Also i suggest to check out Keycloak docker container image repository: here

user_30730270
Related