Keycloak API returns 401 unauthorized sometimes

Viewed 458

I have keycloak installed on kubernetes by oficial helm chart. I have 2 replicas on a statefulset. I have created a realm and configure the admin-cli client to go by confidential. When I ask for a token by this client (with the correct client secret), I get the token, and when I try to create a user, sometimes the curl works, and sometimes I get an unauthorized error. I tried to set only 1 replica and always works fine, but with more than 1 replica, curl sometimes works, sometimes doesn't. I think the problem is between the pods, the sync between pods or something like this. Can anyone helps me?

Thanks

1 Answers

Just setting 2 replicas doesn't mean that Keycloak runs in a cluster, it's just a K8s cluster, but not a Keycloak cluster. How should Keycloak know, if you don't tell it?

You'll have to configure Infinispan and JGroups properly, using some *_PING method for node discovery. Try using JDBC_PING, DNS_PING or KUBE_PING. See JGroups docs for more details.

See also for example my YouTube video on Keycloak clustering: https://youtu.be/P96VQkBBNxU

Related