114 lines
No EOL
6.5 KiB
XML
Executable file
114 lines
No EOL
6.5 KiB
XML
Executable file
<chapter id="export-import">
|
|
<title>Export and Import</title>
|
|
<para>
|
|
Export/import is useful especially if you want to migrate your whole Keycloak database from one environment to another or migrate to different database (For example from MySQL to Oracle).
|
|
You can trigger export/import at startup of Keycloak server and it's configurable with System properties right now. The fact it's done at server startup means that no-one can access Keycloak UI or REST endpoints
|
|
and edit Keycloak database on the fly when export or import is in progress. Otherwise it could lead to inconsistent results.
|
|
</para>
|
|
<para>
|
|
You can export/import your database either to:
|
|
<itemizedlist>
|
|
<listitem>Directory on local filesystem</listitem>
|
|
<listitem>Single JSON file on your filesystem</listitem>
|
|
</itemizedlist>
|
|
|
|
When importing using the "dir" strategy, note that the files need to follow the naming convention specified below.
|
|
If you are importing files which were previously exported, the files already follow this convention.
|
|
<itemizedlist>
|
|
<listitem>{REALM_NAME}-realm.json, such as "acme-roadrunner-affairs-realm.json" for the realm named "acme-roadrunner-affairs"</listitem>
|
|
<listitem>{REALM_NAME}-users-{INDEX}.json, such as "acme-roadrunner-affairs-users-0.json" for the first users file of the realm named "acme-roadrunner-affairs"</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
<para>
|
|
If you import to Directory, you can specify also the number of users to be stored in each JSON file. So if you have
|
|
very large amount of users in your database, you likely don't want to import them into single file as the file might be very big.
|
|
Processing of each file is done in separate transaction as exporting/importing all users at once could also lead to memory issues.
|
|
</para>
|
|
<para>
|
|
To export into unencrypted directory you can use:
|
|
<programlisting><![CDATA[
|
|
bin/standalone.sh -Dkeycloak.migration.action=export
|
|
-Dkeycloak.migration.provider=dir -Dkeycloak.migration.dir=<DIR TO EXPORT TO>
|
|
]]></programlisting>
|
|
And similarly for import just use <literal>-Dkeycloak.migration.action=import</literal> instead of <literal>export</literal> .
|
|
</para>
|
|
<para>
|
|
To export into single JSON file you can use:
|
|
<programlisting><![CDATA[
|
|
bin/standalone.sh -Dkeycloak.migration.action=export
|
|
-Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=<FILE TO EXPORT TO>
|
|
]]></programlisting>
|
|
</para>
|
|
<para>
|
|
Here's an example of importing:
|
|
<programlisting><![CDATA[
|
|
bin/standalone.sh -Dkeycloak.migration.action=import
|
|
-Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=<FILE TO IMPORT>
|
|
-Dkeycloak.migration.strategy=OVERWRITE_EXISTING
|
|
]]></programlisting>
|
|
</para>
|
|
<para>
|
|
Other available options are:
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>-Dkeycloak.migration.realmName</term>
|
|
<listitem>
|
|
<para>
|
|
can be used if you want to export just one specified realm instead of all.
|
|
If not specified, then all realms will be exported.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>-Dkeycloak.migration.usersExportStrategy</term>
|
|
<listitem>
|
|
<para>
|
|
can be used to specify for Directory providers to specify where to import users.
|
|
Possible values are:
|
|
<itemizedlist>
|
|
<listitem>DIFFERENT_FILES - Users will be exported into more different files according to maximum number of users per file. This is default value</listitem>
|
|
<listitem>SKIP - exporting of users will be skipped completely</listitem>
|
|
<listitem>REALM_FILE - All users will be exported to same file with realm (So file like "foo-realm.json" with both realm data and users)</listitem>
|
|
<listitem>SAME_FILE - All users will be exported to same file but different than realm (So file like "foo-realm.json" with realm data and "foo-users.json" with users)</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>-Dkeycloak.migration.usersPerFile</term>
|
|
<listitem>
|
|
<para>
|
|
can be used to specify number of users per file (and also per DB transaction).
|
|
It's 5000 by default. It's used only if usersExportStrategy is DIFFERENT_FILES
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>-Dkeycloak.migration.strategy</term>
|
|
<listitem>
|
|
<para>
|
|
is used during import. It can be used to specify how to proceed if realm with same name
|
|
already exists in the database where you are going to import data. Possible values are:
|
|
<itemizedlist>
|
|
<listitem>IGNORE_EXISTING - Ignore importing if realm of this name already exists</listitem>
|
|
<listitem>OVERWRITE_EXISTING - Remove existing realm and import it again with new data from JSON file.
|
|
If you want to fully migrate one environment to another and ensure that the new environment will contain same data
|
|
like the old one, you can specify this.
|
|
</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</para>
|
|
<para>
|
|
When importing realm files that weren't exported before, the option <literal>keycloak.import</literal> can be used. If more than one realm
|
|
file needs to be imported, a comma separated list of file names can be specified. This is more appropriate than the cases before, as this
|
|
will happen only after the master realm has been initialized. Examples:
|
|
<itemizedlist>
|
|
<listitem>-Dkeycloak.import=/tmp/realm1.json</listitem>
|
|
<listitem>-Dkeycloak.import=/tmp/realm1.json,/tmp/realm2.json</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
|
|
</chapter> |