Durable sessions across restarts

[ahus1]

Description

This epic tracks the progress of having durable sessions across Keycloak restarts

Discussion

• Persistent user sessions (preview) #28271

Motivation

No response

Tasks

Beta Give feedback

1. Persist online sessions to the database #27976
   kind/enhancement release/25.0.0 team/cross-dc +3
   
2. Create a discussion for track community feedback
3. Use the same new code for persistent sessions for offline sessions #28318
   area/core kind/enhancement release/25.0.0 team/core-shared team/cross-dc +5
   
4. Batch updates to the database to avoid using too many IOPS #28501
   kind/enhancement release/25.0.0 team/cross-dc +3
   
5. Improve persistent sessions DB throughput for logins/logouts by batching #28862
   kind/enhancement release/25.0.0 +2
   
6. Fix waiting for change to take effect in SessionTimeoutsTest #29141
   kind/bug release/25.0.0 +2
   
7. Merge online and offline session transactions #29139
   release/25.0.0 +1
   
8. Do not use offline session lifespan adjuster for persistent sessions #29140
   release/25.0.0 +1
   
9. Do not use PersisterLastSessionRefreshStore when persistent sessions are enabled #29144
   release/25.0.0 +1
   
10. Remove persistent-user-sessions-no-cache #29264
    kind/task release/25.0.0 +2
    
11. Don't sort persistent sessions when retrieving a list #29319
    kind/enhancement release/25.0.0 team/cross-dc +3
    
12. Write documentation for persistent sessions #29218
    area/docs release/25.0.0 team/cross-dc +3
    
13. Avoid conflicts when writing make store keys #29392
    kind/enhancement release/25.0.0 team/cross-dc +3
    
14. Describe how to enable and disable persistent sessions for an installation #29489
    area/docs kind/enhancement release/25.0.0 team/cross-dc +4
    
15. Allow migration of non-persistent sessions to persistent sessions #29375
    kind/enhancement release/25.0.0 team/cross-dc +3
    
16. Revisit rolling configuration upgrades for persistent-sessions feature #29561
    kind/enhancement release/25.0.0 team/cross-dc +3
17. Migration of sessions in KC25 should run only on migration, not on imports #30351
    kind/bug priority/important release/25.0.1 release/26.0.0 team/cross-dc +5
    
18. Make persistent user sessions and external Infinispan co-exist #30855
    kind/enhancement status/triage team/cross-dc +3
    
19. Decide if it is enabled by default or not once it is fully supported - let's assume "yes"
20. Release note once it is fully supported
21. Migrate HA guide to use persistent sessions feature #29505
    +0
22. Deprecate old remote store if persistent sessions performs good enough for A/P

Optional Tasks

Beta Give feedback

1. Simplify offline_client_session table client id storing for external clients
2. Clean up table names for offline sessions in the database and remove tables user_session, user_session_note and client_session
3. Review the number indexes (can some be dropped, for example from persistent sessions preloading?)
4. Bundling session updates in on database transaction (user+client session, offline+online sessions)
5. Future idea: Use only one JPA transaction for both the main resource changes during login/logout/refresh and then writing the change to the database (current writing is done in afterCompletion phase)
6. Rework caching and make the DB the source of truth (invalidation caches) + revisit idle and maxlifetime when doing so (only refresh should prolong session?)
7. When migrating sessions, print an estimated number of sessions to migrate at the start
8. When searching for a list of sessions, don’t put them into the cache to avoid eviction of too many other session
9. SSO Session Idle: session is still active after session idle time expired #28418
   area/infinispan area/oidc help wanted kind/bug priority/normal status/auto-bump team/core-clients team/cross-dc +8
10. Add possibility to configure max-count for sessions caches via CLI when persistent sessions are used #30407
    kind/enhancement team/cross-dc +2

[ahus1]

For all those watching this: There is now a GitHub discussion to capture user feedback, and provide additional information on how to try it out using the nightly releases: #28271

[ahus1]

As part of #28862 we're bundling JPA activities for user and client sessions, as well as for online and offline sessions when running under high load. Therefore I'm moving "Bundling session updates in on database transaction (user+client session, offline+online sessions)" to optional tasks.

[istvano]

Hi @ahus1
I am not sure if this was requested but if we are moving the sessions to the DB, I am also sure we need to build some sort of clean up as well. Would it be possible to add an Keycloak EVENT as well to keep track of which sessions have been removed so that we can keep track of them using external CIAM or scripts?

[ahus1]

@istvano - it hasn't been requested to create events for this. A cleanup that deletes those entries already exists, but it is a simple delete from the database.

The events would be an enhancement.

Please search the existing issues, and if none exists create an enhancement issue. The issue should contain a list of all the details the new event should contain, and you also might suggest a name for it.

To prioritize the issue, it would be good to describe the scenarios where this is helpful. Just sending those events to another system is IMHO only means to an end that you didn't describe in your comment above, yet. With that end in mind, prioritization is then a simpler task, and is more likely to get the results you want to see.

Then post the issue number here. I'll then add it to the tasks above.

It might not be part of the first implementation, but let's see.

[ahus1]

The now default and only configuration is run this with caching only, so I removed the comparison of with and without from the optional tasks.