'kc.sh export' throws some errors during the export process

[psachmann]

Hello everyone,

during the process of exporting the Keycloak database with the Keycloak-CLI and the /opt/keycloak/bin/kc.sh export --dir /tmp/realms
command. I stumbled across a little problem during the export. The export itself works and all data will be exported as expected, but
some errors occurred (see full log in the attachments). It looks like Keycloak wants to use ports that are already in use. I found in
https://github.com/keycloak/keycloak-containers/blob/main/server/README.md to use the -Djboss.socket.binding.port-offset=100
option, but nothing equivalent for Quarkus. I'd like to provide a "clean" way for my team and appreciate any help.

Kind regards,
Patrick

Environment:

• Keycloak Version: 17
• Runtime/OS: Docker for Windows

Attachments:

• bash_log.txt

[DGuhr]

Hey. Normally it should work (just reviewed the changes and the guide in #10754 and it worked fine for me). That said, keycloak needs to start quarkus in "import export mode", and as part of that spins up the http server, so when that port is blocked (e.g. keycloak runs or another app has a binding) this could cause the error you are observing. Could you please check if that is the case? See the adoc file in #10754 for reference.

@pedroigor not sure if possible, but maybe we want to stop the http server completely/not spin it up at all when importing/exporting using the commands? wdyt?

[pedroigor]

Ideally, we should be doing import/export by just bootstrapping the Keycloak Session Factory. But that is something we did not manage yet to achieve because some providers rely on the underlying stack (e.g.: wildfly/quarkus) when at the init phase.

So yeah, for now you should be using quarkus properties because the export command does not exposes the http-port option.

[yeroc]

@pedroigor I see there's ticket #10815 regarding an http server being spun up during import/export. We just got bitten by port conflicts as well. Does it look feasible at all to disable the http server? Failing that, could the import/export commands at least honour the usual config parameters via command line (ie. --http-port=...) and environment variable (KC_HTTP_PORT=...). Right now these commands don't operate the same way as the usual start command with respect to configuration. If an http server must be spun up we'd really like to override the port number on the command line because our standard Keycloak config really shouldn't contain a http port config because we have https enabled only.

[yeroc]

I should point out I tried working around this via a Quarkus system property:

JAVA_OPTS_APPEND="-Dquarkus.http.port=0" ./bin/kc.sh import --file /tmp/data-keycloakx-dev.json

But that didn't work either.

[DGuhr]

@pedroigor just a hint: Out of curiosity and after a short google search, I just tried building latest main and running the unpacked zip twice in dev-mode (kc.sh start-dev) locally.

It works when I use quarkus.http.host-enabled=false (ref )in a quarkus.properties file. May be the solution to this problem. Haven't looked much further, but if you think it's worth exploring I can take a look the next days.

[kkrisz1]

hi @psachmann, @pedroigor,
enviroment variable could be used also:

QUARKUS_HTTP_HOST_ENABLED=false ./bin/kc.sh import --file /tmp/data-keycloakx-dev.json

also works with export:

QUARKUS_HTTP_HOST_ENABLED=false ./bin/kc.sh export --dir /tmp/data-keycloakx-realms

[pedroigor]

@DGuhr Sorry for the delay. Sounds like a good idea. If we can avoid creating an internal option to enable this, even better. But I'm not sure if it would be possible without it.

I'm glad to see what you have in mind.

[DGuhr]

@pedroigor see #15056 for a start / PoC i implemented quickly this morning. see description for details