Skip to content

Commit 3c62adb

Browse files
ahus1ahus1
committed
Deploying to main from @ 3487e30061da6f50d1c0341e7535c4ba82821383 🚀
1 parent 18ae045 commit 3c62adb

7 files changed

Lines changed: 597 additions & 25 deletions

File tree

‎2025/05/hitachi-case-study.html‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@
7272
<h1>Hitachi Keycloak case study published</h1>
7373
<p class="blog-date text-muted">May 19 2025 by Alexander Schwartz</p>
7474

75+
<div class="alert alert-warning" role="alert" data-nosnippet>
76+
This post is more than one year old. The content within the blog post is likely to be out of date.
77+
</div>
7578

7679
<div class="paragraph">
7780
<p>Hitachi Ltd. uses Keycloak to make financial grade security easier.</p>

‎extensions.html‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ <h5 class="card-title">Adaptive Authentication</h5>
9292
<div class="d-flex align-items-center">
9393
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
9494
class="me-2"/>
95-
<span data-nosnippet>85 stars</span>
95+
<span data-nosnippet>86 stars</span>
9696
</div>
9797
</div>
9898
</div>
@@ -126,7 +126,7 @@ <h5 class="card-title">Apple Identity Provider</h5>
126126
<div class="d-flex align-items-center">
127127
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
128128
class="me-2"/>
129-
<span data-nosnippet>284 stars</span>
129+
<span data-nosnippet>285 stars</span>
130130
</div>
131131
</div>
132132
</div>
@@ -245,7 +245,7 @@ <h5 class="card-title">EDP Keycloak Operator</h5>
245245
<div class="d-flex align-items-center">
246246
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
247247
class="me-2"/>
248-
<span data-nosnippet>86 stars</span>
248+
<span data-nosnippet>87 stars</span>
249249
</div>
250250
</div>
251251
</div>
@@ -262,7 +262,7 @@ <h5 class="card-title">Event Listener Utilities</h5>
262262
<div class="d-flex align-items-center">
263263
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
264264
class="me-2"/>
265-
<span data-nosnippet>297 stars</span>
265+
<span data-nosnippet>298 stars</span>
266266
</div>
267267
</div>
268268
</div>
@@ -340,7 +340,7 @@ <h5 class="card-title">kcwarden - Keycloak Config Auditor</h5>
340340
<div class="d-flex align-items-center">
341341
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
342342
class="me-2"/>
343-
<span data-nosnippet>117 stars</span>
343+
<span data-nosnippet>118 stars</span>
344344
</div>
345345
</div>
346346
</div>
@@ -775,7 +775,7 @@ <h5 class="card-title">Terraform provider for Keycloak</h5>
775775
<div class="d-flex align-items-center">
776776
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
777777
class="me-2"/>
778-
<span data-nosnippet>924 stars</span>
778+
<span data-nosnippet>925 stars</span>
779779
</div>
780780
</div>
781781
</div>

‎nightly/server/haproxy-passthrough.html‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ <h1>HAProxy with TLS passthrough</h1>
118118
</div>
119119
</div>
120120
<div class="sect1">
121-
<h2 id="_haproxy_configuration"><a class="anchor" href="#_haproxy_configuration"></a>HAProxy configuration</h2>
121+
<h2 id="haproxy-configuration-passthrough"><a class="anchor" href="#haproxy-configuration-passthrough"></a>HAProxy configuration</h2>
122122
<div class="sectionbody">
123123
<div class="paragraph">
124124
<p>The following <code>haproxy.cfg</code> shows a configuration for TLS passthrough with two Keycloak backend servers.</p>
@@ -197,7 +197,7 @@ <h2 id="_haproxy_configuration"><a class="anchor" href="#_haproxy_configuration"
197197
<dd>
198198
<p>Enables the <a href="https://docs.haproxy.org/3.2/configuration.html#5.2-send-proxy-v2">PROXY protocol v2</a>.
199199
HAProxy prepends the original client IP address to the TCP connection so that Keycloak sees the real source IP instead of HAProxy&#8217;s address.
200-
This requires Keycloak to be configured with <code>--proxy-protocol-enabled=true</code> (see <a href="#keycloak-configuration">Keycloak configuration</a>).
200+
This requires Keycloak to be configured with <code>--proxy-protocol-enabled=true</code> (see <a href="#keycloak-configuration-haproxy-passthrough">Keycloak configuration</a>).
201201
Version 1 (<code>send-proxy</code>) is also supported.</p>
202202
</dd>
203203
<dt class="hdlist1"><code>check port 9000 check-ssl verify none</code></dt>
@@ -210,14 +210,14 @@ <h2 id="_haproxy_configuration"><a class="anchor" href="#_haproxy_configuration"
210210
<dd>
211211
<p>Configures the <a href="https://docs.haproxy.org/3.2/configuration.html#5.2-inter">health check frequency</a>:
212212
poll every 5 seconds, mark a server as down after 3 consecutive failures, and mark it as up again after 2 consecutive successes.
213-
These values affect how quickly HAProxy detects that a Keycloak instance is shutting down (see <a href="#graceful-shutdown-considerations">Graceful shutdown considerations</a>).</p>
213+
These values affect how quickly HAProxy detects that a Keycloak instance is shutting down (see <a href="#graceful-shutdown-considerations-haproxy-passthrough">Graceful shutdown considerations</a>).</p>
214214
</dd>
215215
</dl>
216216
</div>
217217
</div>
218218
</div>
219219
<div class="sect1">
220-
<h2 id="keycloak-configuration"><a class="anchor" href="#keycloak-configuration"></a>Keycloak configuration</h2>
220+
<h2 id="keycloak-configuration-haproxy-passthrough"><a class="anchor" href="#keycloak-configuration-haproxy-passthrough"></a>Keycloak configuration</h2>
221221
<div class="sectionbody">
222222
<div class="paragraph">
223223
<p>With TLS passthrough, Keycloak requires the following configuration:</p>
@@ -250,16 +250,16 @@ <h2 id="keycloak-configuration"><a class="anchor" href="#keycloak-configuration"
250250
</div>
251251
</div>
252252
<div class="sect1">
253-
<h2 id="graceful-shutdown-considerations"><a class="anchor" href="#graceful-shutdown-considerations"></a>Graceful shutdown considerations</h2>
253+
<h2 id="graceful-shutdown-considerations-haproxy-passthrough"><a class="anchor" href="#graceful-shutdown-considerations-haproxy-passthrough"></a>Graceful shutdown considerations</h2>
254254
<div class="sectionbody">
255255
<div class="paragraph">
256256
<p>With TLS passthrough, HAProxy cannot signal a connection close at the HTTP level.
257-
The health check timing directly determines how long it takes HAProxy to detect that a Keycloak instance is shutting down and stop routing new connections to it.</p>
257+
The HAProxy health check settings determine how long it takes for the proxy to detect that a Keycloak instance is shutting down and that connections should no longer be routed to it.</p>
258258
</div>
259259
<div class="paragraph">
260260
<p>With the health check settings from the configuration above (<code>inter 5s fall 3</code>), it takes up to 15 seconds (3 failures x 5-second interval) for HAProxy to mark a Keycloak instance as down.
261261
During this period, Keycloak must remain running to serve in-flight requests.
262-
Therefore, configure the <code>--shutdown-delay</code> to be at least as long as the detection time:</p>
262+
Therefore, you need to configure the <code>--shutdown-delay</code> to be at least as long as the detection time:</p>
263263
</div>
264264
<div class="listingblock">
265265
<div class="content">
@@ -290,6 +290,27 @@ <h2 id="_relevant_options"><a class="anchor" href="#_relevant_options"></a>Relev
290290
<tbody>
291291
<tr>
292292
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
293+
<p><span class="options-key"><code>shutdown-delay</code></span></p>
294+
</div>
295+
<div class="paragraph">
296+
<p><span class="options-description">Length of the pre-shutdown phase during which the server prepares for shutdown.</span></p>
297+
</div>
298+
<div class="openblock options-extended">
299+
<div class="content">
300+
<div class="paragraph">
301+
<p><span class="options-description-extended">May be an ISO 8601 duration value, an integer number of seconds, or an integer followed by one of [ms, h, m, s, d]. This period allows for loadbalancer reconfiguration and draining of TLS/HTTP keepalive connections.</span></p>
302+
</div>
303+
<div class="paragraph">
304+
<p><strong>CLI:</strong> <code>--shutdown-delay</code><br>
305+
<strong>Env:</strong> <code>KC_SHUTDOWN_DELAY</code></p>
306+
</div>
307+
</div>
308+
</div></div></td>
309+
<td class="tableblock halign-left valign-top"><p class="tableblock"><em>String</em></p></td>
310+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>1s</code></p></td>
311+
</tr>
312+
<tr>
313+
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
293314
<p><span class="options-key"><code>health-enabled</code></span> <span class="none"><span class="icon options-build"><i class="fa fa-tools"></i></span></span></p>
294315
</div>
295316
<div class="paragraph">

0 commit comments

Comments
 (0)