libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

Introduce new CLI config options for Infinispan remote store

Browse source 
Closes #25676

Signed-off-by: vramik <vramik@redhat.com>
Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Pedro Ruivo <pruivo@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
This commit is contained in:
Vlasta Ramik 2024-02-28 16:49:19 +01:00 committed by GitHub
parent a3b3ee4b87
commit ade3b31a91
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
18 changed files with 429 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
docs/guides/server/caching.adoc
View file

@ -146,6 +146,12 @@ To specify your own cache configuration file, enter this command:
The configuration file is relative to the `conf/` directory.
=== CLI options for remote server
For configuration of {project_name} server for high availability and multi-node clustered setup there was introduced following CLI options `cache-remote-host`, `cache-remote-port`, `cache-remote-username` and `cache-remote-password` simplifying configuration within the XML file.
Once any of declared CLI parameters are present, it is expected there is no configuration related to remote store present in the XML file.
== Transport stacks
Transport stacks ensure that distributed cache nodes in a cluster communicate in a reliable fashion.
{project_name} supports a wide range of transport stacks:

12
model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProvider.java
View file

@ -17,6 +17,7 @@
package org.keycloak.connections.infinispan;
import java.util.List;
import org.infinispan.Cache;
import org.infinispan.client.hotrod.RemoteCache;
import org.keycloak.provider.Provider;
@ -84,6 +85,17 @@ public interface InfinispanConnectionProvider extends Provider {
KEYS_CACHE_NAME
};
// list of cache name which could be defined as distributed or replicated
public static List<String> DISTRIBUTED_REPLICATED_CACHE_NAMES = List.of(
USER_SESSION_CACHE_NAME,
CLIENT_SESSION_CACHE_NAME,
OFFLINE_USER_SESSION_CACHE_NAME,
OFFLINE_CLIENT_SESSION_CACHE_NAME,
LOGIN_FAILURE_CACHE_NAME,
AUTHENTICATION_SESSIONS_CACHE_NAME,
ACTION_TOKEN_CACHE,
WORK_CACHE_NAME);
/**
*
* Effectively the same as {@link InfinispanConnectionProvider#getCache(String, boolean)} with createIfAbsent set to {@code true}

42
quarkus/config-api/src/main/java/org/keycloak/config/CachingOptions.java
View file

@ -4,6 +4,8 @@ import java.io.File;
public class CachingOptions {
public static final String CACHE_CONFIG_FILE_PROPERTY = "cache-config-file";
private static final String CACHE_EMBEDDED_MTLS_PREFIX = "cache-embedded-mtls";
public static final String CACHE_EMBEDDED_MTLS_ENABLED_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-enabled";
public static final String CACHE_EMBEDDED_MTLS_KEYSTORE_FILE_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-key-store-file";
@ -11,6 +13,12 @@ public class CachingOptions {
public static final String CACHE_EMBEDDED_MTLS_TRUSTSTORE_FILE_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-trust-store-file";
public static final String CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-trust-store-password";
private static final String CACHE_REMOTE_PREFIX = "cache-remote";
public static final String CACHE_REMOTE_HOST_PROPERTY = CACHE_REMOTE_PREFIX + "-host";
public static final String CACHE_REMOTE_PORT_PROPERTY = CACHE_REMOTE_PREFIX + "-port";
public static final String CACHE_REMOTE_USERNAME_PROPERTY = CACHE_REMOTE_PREFIX + "-username";
public static final String CACHE_REMOTE_PASSWORD_PROPERTY = CACHE_REMOTE_PREFIX + "-password";
public enum Mechanism {
ispn,
local
@ -41,7 +49,7 @@ public class CachingOptions {
.buildTime(true)
.build();
public static final Option<File> CACHE_CONFIG_FILE = new OptionBuilder<>("cache-config-file", File.class)
public static final Option<File> CACHE_CONFIG_FILE = new OptionBuilder<>(CACHE_CONFIG_FILE_PROPERTY, File.class)
.category(OptionCategory.CACHE)
.description("Defines the file from which cache configuration should be loaded from. "
+ "The configuration file is relative to the 'conf/' directory.")
@ -82,4 +90,36 @@ public class CachingOptions {
.buildTime(true)
.build();
public static final Option<String> CACHE_REMOTE_HOST = new OptionBuilder<>(CACHE_REMOTE_HOST_PROPERTY, String.class)
.category(OptionCategory.CACHE)
.description(String.format("The hostname of the remote server for the remote store configuration. "
+ "It replaces the 'host' attribute of 'remote-server' tag of the configuration specified via XML file (see '%s' option.). "
+ "If the option is specified, '%s' and '%s' are required as well and the related configuration in XML file should not be present.",
CACHE_CONFIG_FILE_PROPERTY, CACHE_REMOTE_USERNAME_PROPERTY, CACHE_REMOTE_PASSWORD_PROPERTY))
.build();
public static final Option<Integer> CACHE_REMOTE_PORT = new OptionBuilder<>(CACHE_REMOTE_PORT_PROPERTY, Integer.class)
.category(OptionCategory.CACHE)
.description(String.format("The port of the remote server for the remote store configuration. "
+ "It replaces the 'port' attribute of 'remote-server' tag of the configuration specified via XML file (see '%s' option.).",
CACHE_CONFIG_FILE_PROPERTY))
.defaultValue(11222)
.build();
public static final Option<String> CACHE_REMOTE_USERNAME = new OptionBuilder<>(CACHE_REMOTE_USERNAME_PROPERTY, String.class)
.category(OptionCategory.CACHE)
.description(String.format("The username for the authentication to the remote server for the remote store. "
+ "It replaces the 'username' attribute of 'digest' tag of the configuration specified via XML file (see '%s' option.). "
+ "If the option is specified, '%s' and '%s' are required as well and the related configuration in XML file should not be present.",
CACHE_CONFIG_FILE_PROPERTY, CACHE_REMOTE_HOST_PROPERTY, CACHE_REMOTE_PASSWORD_PROPERTY))
.build();
public static final Option<String> CACHE_REMOTE_PASSWORD = new OptionBuilder<>(CACHE_REMOTE_PASSWORD_PROPERTY, String.class)
.category(OptionCategory.CACHE)
.description(String.format("The password for the authentication to the remote server for the remote store. "
+ "It replaces the 'password' attribute of 'digest' tag of the configuration specified via XML file (see '%s' option.). "
+ "If the option is specified, '%s' and '%s' are required as well and the related configuration in XML file should not be present.",
CACHE_CONFIG_FILE_PROPERTY, CACHE_REMOTE_HOST_PROPERTY, CACHE_REMOTE_USERNAME_PROPERTY))
.build();
}

13
quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/CachingPropertyMappers.java
View file

@ -48,6 +48,19 @@ final class CachingPropertyMappers {
.paramLabel("password")
.isMasked(true)
.build(),
fromOption(CachingOptions.CACHE_REMOTE_HOST)
.paramLabel("hostname")
.build(),
fromOption(CachingOptions.CACHE_REMOTE_PORT)
.paramLabel("port")
.build(),
fromOption(CachingOptions.CACHE_REMOTE_USERNAME)
.paramLabel("username")
.build(),
fromOption(CachingOptions.CACHE_REMOTE_PASSWORD)
.paramLabel("password")
.isMasked(true)
.build(),
};
}

74
quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/infinispan/CacheManagerFactory.java
View file

@ -17,18 +17,24 @@
package org.keycloak.quarkus.runtime.storage.legacy.infinispan;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
import java.util.concurrent.TimeUnit;
import io.micrometer.core.instrument.Metrics;
import org.infinispan.client.hotrod.impl.ConfigurationProperties;
import org.infinispan.configuration.cache.PersistenceConfigurationBuilder;
import org.infinispan.configuration.global.GlobalConfiguration;
import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
import org.infinispan.configuration.parsing.ParserRegistry;
import org.infinispan.jboss.marshalling.core.JBossUserMarshaller;
import org.infinispan.manager.DefaultCacheManager;
import org.infinispan.metrics.config.MicrometerMeterRegisterConfigurationBuilder;
import org.infinispan.persistence.remote.configuration.ExhaustedAction;
import org.infinispan.persistence.remote.configuration.RemoteStoreConfigurationBuilder;
import org.infinispan.remoting.transport.jgroups.JGroupsTransport;
import org.jboss.logging.Logger;
import org.jgroups.protocols.TCP_NIO2;
@ -37,11 +43,20 @@ import org.jgroups.util.TLS;
import org.jgroups.util.TLSClientAuth;
import org.keycloak.quarkus.runtime.configuration.Configuration;
import javax.net.ssl.SSLContext;
import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_FILE_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_FILE_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_REMOTE_HOST_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_REMOTE_PASSWORD_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_REMOTE_PORT_PROPERTY;
import static org.keycloak.config.CachingOptions.CACHE_REMOTE_USERNAME_PROPERTY;
import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.DISTRIBUTED_REPLICATED_CACHE_NAMES;
import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
import static org.wildfly.security.sasl.util.SaslMechanismInformation.Names.SCRAM_SHA_512;
public class CacheManagerFactory {
@ -87,8 +102,9 @@ public class CacheManagerFactory {
private DefaultCacheManager startCacheManager() {
ConfigurationBuilderHolder builder = new ParserRegistry().parse(config);
if (builder.getNamedConfigurationBuilders().get("sessions").clustering().cacheMode().isClustered()) {
if (builder.getNamedConfigurationBuilders().get(USER_SESSION_CACHE_NAME).clustering().cacheMode().isClustered()) {
configureTransportStack(builder);
configureRemoteStores(builder);
}
if (metricsEnabled) {
@ -177,6 +193,62 @@ public class CacheManagerFactory {
}
private void configureRemoteStores(ConfigurationBuilderHolder builder) {
//if one of remote store command line parameters is defined, some other are required, otherwise assume it'd configured via xml only
if (Configuration.getOptionalKcValue(CACHE_REMOTE_HOST_PROPERTY).isPresent() ||
Configuration.getOptionalKcValue(CACHE_REMOTE_USERNAME_PROPERTY).isPresent() ||
Configuration.getOptionalKcValue(CACHE_REMOTE_PASSWORD_PROPERTY).isPresent()) {
String cacheRemoteHost = requiredStringProperty(CACHE_REMOTE_HOST_PROPERTY);
Integer cacheRemotePort = Configuration.getOptionalKcValue(CACHE_REMOTE_PORT_PROPERTY)
.map(Integer::parseInt)
.orElse(ConfigurationProperties.DEFAULT_HOTROD_PORT);
String cacheRemoteUsername = requiredStringProperty(CACHE_REMOTE_USERNAME_PROPERTY);
String cacheRemotePassword = requiredStringProperty(CACHE_REMOTE_PASSWORD_PROPERTY);
SSLContext sslContext;
try {
// uses the default Java Runtime TrustStore, or the one generated by Keycloak (see org.keycloak.truststore.TruststoreBuilder)
sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, null, null);
} catch (NoSuchAlgorithmException | KeyManagementException e) {
throw new RuntimeException(e);
}
DISTRIBUTED_REPLICATED_CACHE_NAMES.forEach(cacheName -> {
PersistenceConfigurationBuilder persistenceCB = builder.getNamedConfigurationBuilders().get(cacheName).persistence();
//if specified via command line -> cannot be defined in the xml file
if (!persistenceCB.stores().isEmpty()) {
throw new RuntimeException(String.format("Remote store for cache '%s' is already configured via CLI parameters. It should not be present in the XML file.", cacheName));
}
persistenceCB.addStore(RemoteStoreConfigurationBuilder.class)
.rawValues(true)
.shared(true)
.segmented(false)
.remoteCacheName(cacheName)
.connectionPool()
.maxActive(16)
.exhaustedAction(ExhaustedAction.CREATE_NEW)
.remoteSecurity()
.ssl()
.enable()
.sslContext(sslContext)
.sniHostName(cacheRemoteHost)
.authentication()
.enable()
.username(cacheRemoteUsername)
.password(cacheRemotePassword)
.realm("default")
.saslMechanism(SCRAM_SHA_512)
.addServer()
.host(cacheRemoteHost)
.port(cacheRemotePort);
});
}
}
private static boolean booleanProperty(String propertyName) {
return Configuration.getOptionalKcValue(propertyName).map(Boolean::parseBoolean).orElse(Boolean.FALSE);
}

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.unix.approved.txt vendored
View file

@ -39,6 +39,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.windows.approved.txt vendored
View file

@ -39,6 +39,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.unix.approved.txt vendored
View file

@ -39,6 +39,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.windows.approved.txt vendored
View file

@ -39,6 +39,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.unix.approved.txt vendored
View file

@ -40,6 +40,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.windows.approved.txt vendored
View file

@ -40,6 +40,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.unix.approved.txt vendored
View file

@ -40,6 +40,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

22
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.windows.approved.txt vendored
View file

@ -40,6 +40,28 @@ Cache:
'cache-mtls-truststore.p12' under conf/ directory.
--cache-embedded-mtls-trust-store-password <password>
The password to access the Truststore.
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
--cache-stack <stack>
Define the default stack to use for cluster communication and node discovery.
This option only takes effect if 'cache' is set to 'ispn'. Default: udp.

25
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.unix.approved.txt vendored
View file

@ -16,6 +16,31 @@ Options:
built a server image using the 'build' command.
-v, --verbose Print out error details when running this command.
Cache:
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
Database:
--db-password <password>

25
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.windows.approved.txt vendored
View file

@ -16,6 +16,31 @@ Options:
built a server image using the 'build' command.
-v, --verbose Print out error details when running this command.
Cache:
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
Database:
--db-password <password>

25
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.unix.approved.txt vendored
View file

@ -16,6 +16,31 @@ Options:
built a server image using the 'build' command.
-v, --verbose Print out error details when running this command.
Cache:
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
Database:
--db-password <password>

25
quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.windows.approved.txt vendored
View file

@ -16,6 +16,31 @@ Options:
built a server image using the 'build' command.
-v, --verbose Print out error details when running this command.
Cache:
--cache-remote-host <hostname>
The hostname of the remote server for the remote store configuration. It
replaces the 'host' attribute of 'remote-server' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-username' and 'cache-remote-password' are required
as well and the related configuration in XML file should not be present.
--cache-remote-password <password>
The password for the authentication to the remote server for the remote store.
It replaces the 'password' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-username' are required as
well and the related configuration in XML file should not be present.
--cache-remote-port <port>
The port of the remote server for the remote store configuration. It replaces
the 'port' attribute of 'remote-server' tag of the configuration specified
via XML file (see 'cache-config-file' option.). Default: 11222.
--cache-remote-username <username>
The username for the authentication to the remote server for the remote store.
It replaces the 'username' attribute of 'digest' tag of the configuration
specified via XML file (see 'cache-config-file' option.). If the option is
specified, 'cache-remote-host' and 'cache-remote-password' are required as
well and the related configuration in XML file should not be present.
Database:
--db-password <password>

2
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/AbstractQuarkusDeployableContainer.java
View file

@ -185,6 +185,8 @@ public abstract class AbstractQuarkusDeployableContainer implements DeployableCo
if ("local".equals(cacheMode)) {
// Save ~2s for each Quarkus startup, when we know ISPN cluster is empty. See https://github.com/keycloak/keycloak/issues/21033
commands.add("-Djgroups.join_timeout=10");
} else {
commands.add("--cache=ispn");
}
log.debugf("FIPS Mode: %s", configuration.getFipsMode());