tony _008
tony _008

Reputation: 727

A Keycloak User Storage SPI presents problem when changing the Cache policy

In using the Keycloak Identity provider server (v 21.0.1), I implemented a User Storage Provider as typically described on their documentation. This UserStorageProvider basically queries users from an external system via API calls. The core working of the provider seems to be satisfactory, but there seems to be a problem that happens when changing the cache policy of said provider to any other than the "default" one.

Namely, when changing the cache policy of the provider to for example "evict daily" (the idea being saving unnecessary backend request-hits to the server where the user data is being pulled from, by caching users), the custom KC user storage provider seems to stop working (or at least some aspects of it). For instance, the admin console view of the remote users (achieved through implementing the interface UserQueryProvider in said UserStorageProvider), no longer displays any remote user, and only the locally persisted ones are visible. Another indication that the User provider no longer works, is that the api endpoint for issuing tokens, no longer recognizes the remote users, but only the locally stored ones.

Moreover, reverting the cache policy back to the original "default" one, is not sufficient to re-establish the proper working of the User Storage Provider, and only deleting it and reinstalling it again has proven to be effective.

This behaviour is quite puzzling, have any of you experienced such a situation with custom SPIs when changing cache policies? and if so, could you please refer me to relevant material/documentation pointing to possible workarounds?

Thank you very much, any info would be greatly appreciated.

Cheers

Upvotes: 1

Views: 337

Answers (0)

Related Questions