Keycloak从v16迁移到v21不会导入领域和用户。

huangapple
go评论123阅读模式
英文:

Migrations of Keycloak from v16 to v21 doesn't import realms and users

问题

We have dockerized Keycloak v16 and now we would like to migrate to a version v21.

We uses Postgres database and we have inside this database already created realms and users.

When we upgraded to v21, everything works except that Keycloak shows that realms are empty and users as well.

If I inspect the database, all users and realms are still there...

How to tell Keycloak to read old realms and users?

New docker file

  1. FROM quay.io/keycloak/keycloak:21.0.2
  3. COPY themes/ /opt/jboss/keycloak/themes/
  4. ADD ./standalone-ha.xml /opt/jboss/keycloak/standalone/configuration/standalone-ha.xml

standalone-ha.xml

  1. <spi name="connectionsJpa">
  2.     <provider name="default" enabled="true">
  3.         <properties>
  4.             <property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
  5.             <property name="initializeEmpty" value="true"/>
  6.             <property name="migrationStrategy" value="update"/>
  7.             <property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
  8.             <property name="schema" value="${env.DB_SCHEMA:public}"/>
  9.         </properties>
  10.     </provider>
  11. </spi>

docker-compose file

  1. keycloak:
  2.   image: mykeycloak
  3.   environment:
  4.     DB_VENDOR: POSTGRES
  5.     DB_ADDR: xxxx
  6.     DB_DATABASE: keycloak
  7.     DB_USER: postgres
  8.     DB_SCHEMA: public
  9.     DB_PASSWORD: xxxx
  10.     KEYCLOAK_ADMIN: xxxx
  11.     KEYCLOAK_ADMIN_PASSWORD: xxxx
  12.     KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  13.   volumes:
  14.     - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  15.   command: start-dev --http-relative-path /auth --spi-connections-jpa-legacy-migration-strategy=update
  16.   ports:
  17.     - 8080:8080
  19. EDIT:
  20. -----------
  22. I figure out that Keycloak is not connecting to a database. I always insert the same realms so I thought that new and old are in the same database.
  24. So the question is how to connect correctly to a Postgres container.
  26. I changed the docker-compose file to:
  28. ```plaintext
  29. db:
  30.   image: postgres:13.2
  31.   ports:
  32.     - "5432:5432"
  33.   environment:
  34.     POSTGRES_PASSWORD: 'xxx'
  35.   # volumes:
  36.   # - /Volumes/DATA/docker_volume/pgdata:/var/lib/postgresql/data
  38. keycloak:
  39.   depends_on:
  40.     - db
  41.   image: mykeycloak
  42.   environment:
  43.     KC_DB: postgres
  44.     KC_DB_ADDR: db
  45.     KC_DB_DATABASE: keycloak
  46.     KC_DB_USER: postgres
  47.     KC_DB_SCHEMA: public
  48.     KC_DB_PASSWORD: xxx
  49.     KEYCLOAK_ADMIN: keycloak_admin
  50.     KEYCLOAK_ADMIN_PASSWORD: xxx
  51.     KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  52.   volumes:
  53.     - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  54.   command: start-dev --http-relative-path /auth
  55.   ports:
  56.     - 8080:8080

Now I get the error:

  1. 2023-06-22 10:18:30 2023-06-22 08:18:30,593 WARN  [org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator] (JPA Startup Thread: keycloak-default) HHH000342: Could not obtain connection to query metadata: org.postgresql.util.PSQLException: Connection to localhost:5432 refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.
  2. 2023-06-22 10:18:30     at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:319)
  3. ...

我們已經將Keycloak v16容器化，現在我們想要遷移到版本v21。

我們使用的是Postgres數據庫，並且在這個數據庫中已經創建了領域和用戶。

當我們升級到v21時，一切都正常，只是Keycloak顯示領域和用戶是空的。

如果我檢查數據庫，所有的用戶和領域仍然存在...

如何告訴Keycloak讀取舊的領域和用戶？

新的Docker文件

  1. FROM quay.io/keycloak/keycloak:21.0.2
  3. COPY themes/ /opt/jboss/keycloak/themes/
  4. ADD ./standalone-ha.xml /opt/jboss/keycloak/standalone/configuration/standalone-ha.xml

standalone-ha.xml

  1. <spi name="connectionsJpa">
  2.     <provider name="default" enabled="true">
  3.         <properties>
  4.             <property name="dataSource" value="java:jboss/datasources/KeycloakDS"/>
  5.             <property name="initializeEmpty" value="true"/>
  6.             <property name="migrationStrategy" value="update"/>
  7.             <property name="migrationExport" value="${jboss.home.dir}/keycloak-database-update.sql"/>
  8.             <property name="schema" value="${env.DB_SCHEMA:public}"/>
  9.         </properties>
  10.     </provider>
  11. </spi>

docker-compose文件

  1. keycloak:
  2.   image: mykeycloak
  3.   environment:
  4.     DB_VENDOR: POSTGRES
  5.     DB_ADDR: xxxx
  6.     DB_DATABASE: keycloak
  7.     DB_USER: postgres
  8.     DB_SCHEMA: public
  9.     DB_PASSWORD: xxxx
  10.     KEYCLOAK_ADMIN: xxxx
  11.     KEYCLOAK_ADMIN_PASSWORD: xxxx
  12.     KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  13.   volumes:
  14.     - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  15.   command: start-dev --http-relative-path /auth --spi-connections-jpa-legacy-migration-strategy=update
  16.   ports:
  17.     - 8080:8080
  19. 編輯：
  20. -----------
  22. 我發現Keycloak無法連接到數據庫。我總是插入相同的領域，所以我認為新的和舊的都在同一個數據庫中。
  24. 所以問題是如何正確連接到Postgres容器。
  26. 我將docker-compose文件更改為：
  28. ```plaintext
  29. db:
  30.   image: postgres:13.2
  31.   ports:
  32.     - "5432:5432"
  33.   environment:
  34.     POSTGRES_PASSWORD: 'xxx'
  35.   # volumes:
  36.   # - /Volumes/DATA/docker_volume/pgdata:/var/lib/postgresql/data
  38. keycloak:
  39.   depends_on:
  40.     - db
  41.   image:
  43. <details>
  44. <summary>英文:</summary>
  46. We have dockerized Keycloak v16 and now we would like to migrate to a version v21.
  48. We uses Postgres database and we have inside this database already created realms and users. 
  50. When we upgraded to a v21 everything works except that Keycloak shows that realms are empty and users as well. 
  52. If I inspect database, all users and realms are still there... 
  54. How to tell Keycloak to read old realms and users?
  57. New docker file 
  60.     FROM quay.io/keycloak/keycloak:21.0.2
  61.     
  62.     COPY themes/ /opt/jboss/keycloak/themes/
  63.     ADD ./standalone-ha.xml /opt/jboss/keycloak/standalone/configuration/standalone-ha.xm
  68. standalone-ha.xml
  70.     &lt;spi name=&quot;connectionsJpa&quot;&gt;
  71.                     &lt;provider name=&quot;default&quot; enabled=&quot;true&quot;&gt;
  72.                         &lt;properties&gt;
  73.                             &lt;property name=&quot;dataSource&quot; value=&quot;java:jboss/datasources/KeycloakDS&quot;/&gt;
  74.                             &lt;property name=&quot;initializeEmpty&quot; value=&quot;true&quot;/&gt;
  75.                             &lt;property name=&quot;migrationStrategy&quot; value=&quot;update&quot;/&gt;
  76.                             &lt;property name=&quot;migrationExport&quot; value=&quot;${jboss.home.dir}/keycloak-database-update.sql&quot;/&gt;
  77.                             &lt;property name=&quot;schema&quot; value=&quot;${env.DB_SCHEMA:public}&quot;/&gt;
  78.                         &lt;/properties&gt;
  79.                     &lt;/provider&gt;
  80.                 &lt;/spi&gt;
  84. docker-compose file
  86.       keycloak:
  87.         image: mykeycloak
  88.         environment:
  89.           DB_VENDOR: POSTGRES
  90.           DB_ADDR: xxxx
  91.           DB_DATABASE: keycloak
  92.           DB_USER: postgres
  93.           DB_SCHEMA: public
  94.           DB_PASSWORD: xxxx
  95.           KEYCLOAK_ADMIN: xxxx
  96.           KEYCLOAK_ADMIN_PASSWORD: xxxx
  97.           KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  98.         volumes:
  99.           - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  100.         command: start-dev --http-relative-path /auth --spi-connections-jpa-legacy-migration-strategy=update
  101.         ports:
  102.           - 8080:8080
  104. EDIT:
  105. -----------
  107. I figure out that Keycloak is not connecting to a database. I always insert the same realms so I though that new and old are in same database. 
  109. So the question is how to connect correctly to a Postgres container.
  112. I change the docker-compose file to a 
  117.       db:
  118.         image: postgres:13.2
  119.         ports:
  120.         - &quot;5432:5432&quot;
  121.         environment:
  122.           POSTGRES_PASSWORD: &#39;xxx&#39;
  123.         # volumes:
  124.         # - /Volumes/DATA/docker_volume/pgdata:/var/lib/postgresql/data
  125.     
  126.     
  127.     
  128.     
  129.       keycloak:
  130.         depends_on:
  131.           - db
  132.         image: mykeycloak
  133.         environment:
  134.           KC_DB: postgres
  135.           KC_DB_ADDR: db
  136.           KC_DB_DATABASE: keycloak
  137.           KC_DB_USER: postgres
  138.           KC_DB_SCHEMA: public
  139.           KC_DB_PASSWORD: xxx
  140.           KEYCLOAK_ADMIN: keycloak_admin
  141.           KEYCLOAK_ADMIN_PASSWORD: xxx
  142.           KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  143.         volumes:
  144.           - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  145.         command: start-dev --http-relative-path /auth
  146.         ports:
  147.           - 8080:8080
  151. now I get the error 
  155.     2023-06-22 10:18:30 2023-06-22 08:18:30,593 WARN  [org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator] (JPA Startup Thread: keycloak-default) HHH000342: Could not obtain connection to query metadata: org.postgresql.util.PSQLException: Connection to localhost:5432 refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.
  156.     2023-06-22 10:18:30     at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:319)
  157.     2023-06-22 10:18:30     at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
  158.     2023-06-22 10:18:30     at org.postgresql.jdbc.PgConnection.&lt;init&gt;(PgConnection.java:247)
  159.     2023-06-22 10:18:30     at org.postgresql.Driver.makeConnection(Driver.java:434)
  160.     2023-06-22 10:18:30     at org.postgresql.Driver.connect(Driver.java:291)
  161.     2023-06-22 10:18:30     at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:681)
  162.     2023-06-22 10:18:30     at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:229)
  163.     2023-06-22 10:18:30     at org.postgresql.ds.common.BaseDataSource.getConnection(BaseDataSource.java:103)
  164.     2023-06-22 10:18:30     at org.postgresql.xa.PGXADataSource.getXAConnection(PGXADataSource.java:49)
  165.     2023-06-22 10:18:30     at org.postgresql.xa.PGXADataSource.getXAConnection(PGXADataSource.java:35)
  166.     2023-06-22 10:18:30     at io.agroal.pool.ConnectionFactory.createConnection(ConnectionFactory.java:232)
  167.     2023-06-22 10:18:30     at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:536)
  168.     2023-06-22 10:18:30     at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:517)
  169.     2023-06-22 10:18:30     at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
  170.     2023-06-22 10:18:30     at io.agroal.pool.util.PriorityScheduledExecutor.beforeExecute(PriorityScheduledExecutor.java:75)
  171.     2023-06-22 10:18:30     at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1134)
  172.     2023-06-22 10:18:30     at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
  173.     2023-06-22 10:18:30     at java.base/java.lang.Thread.run(Thread.java:833)
  174.     2023-06-22 10:18:30 Caused by: java.net.ConnectException: Connection refused
  175.     2023-06-22 10:18:30     at java.base/sun.nio.ch.Net.pollConnect(Native Method)
  176.     2023-06-22 10:18:30     at java.base/sun.nio.ch.Net.pollConnectNow(Net.java:672)
  177.     2023-06-22 10:18:30     at java.base/sun.nio.ch.NioSocketImpl.timedFinishConnect(NioSocketImpl.java:542)
  178.     2023-06-22 10:18:30     at java.base/sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:597)
  179.     2023-06-22 10:18:30     at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327)
  180.     2023-06-22 10:18:30     at java.base/java.net.Socket.connect(Socket.java:633)
  181.     2023-06-22 10:18:30     at org.postgresql.core.PGStream.createSocket(PGStream.java:241)
  182.     2023-06-22 10:18:30     at org.postgresql.core.PGStream.&lt;init&gt;(PGStream.java:98)
  183.     2023-06-22 10:18:30     at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:109)
  184.     2023-06-22 10:18:30     at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:235)
  185.     2023-06-22 10:18:30     ... 17 more
  186.     2023-06-22 10:18:30 
  192. </details>
  195. # 答案1
  196. **得分**: 0
  198. # 对于仍然遇到这个问题的人：
  200. 我发现这个 Docker 镜像在连接到外部的 Postgres 数据库时没有报错，而是默默地失败了。
  202. 因为没有错误，我以为连接已经建立，但我错了。
  204. ### 在新版本中，添加了新的环境参数
  206. 连接 Postgres 数据库到 Keycloak Docker 镜像的正确参数是：
  208. ```yaml
  209. keycloak:
  210.   depends_on:
  211.     - db
  212.   image: quay.io/keycloak/keycloak:21.0.2
  213.   environment:
  214.     KC_DB: postgres
  215.     KC_DB_ADDR: db
  216.     KC_DB_URL_DATABASE: keycloak
  217.     KC_DB_URL_HOST: db
  218.     KC_DB_URL_PORT: 5432
  219.     KC_DB_SCHEMA: public
  220.     KC_DB_USERNAME: XXX
  221.     KC_DB_PASSWORD: XXX
  222.     KEYCLOAK_ADMIN: XXX
  223.     KEYCLOAK_ADMIN_PASSWORD: XXX
  224.     KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  225.   volumes:
  226.     - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  227.   command: start-dev --http-relative-path /auth
  228.   ports:
  229.     - 8080:8080
英文:

For anyone still having this problem:

I discovered that this docker image silently failed to connect to an external Postgres database.

Because there was no error I assumed that the connection was established but I was wrong.

In the new version, new environment parameters was added

The correct parameters for connecting the postgres database to a Keycloak docker image are:

  1.   keycloak:
  2. depends_on:
  3. - db
  4. image: quay.io/keycloak/keycloak:21.0.2
  5. environment:
  6. KC_DB: postgres
  7. KC_DB_ADDR: db
  8. KC_DB_URL_DATABASE: keycloak
  9. KC_DB_URL_HOST: db
  10. KC_DB_URL_PORT: 5432
  11. KC_DB_SCHEMA: public
  12. KC_DB_USERNAME: XXX
  13. KC_DB_PASSWORD: XXX
  14. KEYCLOAK_ADMIN: XXX
  15. KEYCLOAK_ADMIN_PASSWORD: XXX
  16. KEYCLOAK_FRONTEND_URL: http://localhost:8080/auth/
  17. volumes:
  18. - ./common/keycloak/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli
  19. command: start-dev --http-relative-path /auth
  20. ports:
  21. - 8080:8080

huangapple
  • 本文由 发表于 2023年6月22日 13:41:13
  • 转载请务必保留本文链接：https://go.coder-hub.com/76528871.html
  • docker
  • keycloak
  • postgresql
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定