Sync user data between services that uses same Keycloak

UAA
1

Hi all, I have:

  • Different services that use the same Keycloak for authentication and authorization,
  • An A12 UAA that is used as a friendly UI for Keycloak,
  • On each service, I might store extra user information for the user,
  • On some services, there might be extra resources that are associated with the user,
  • Some of the services are being developed by mgm, some not.

My problem is if the user is updated on A12 UAA, goes to Keycloak by Keycloak RestAPI, then the new user info should be reflected in all services.

I read about Keycloak SPI events that can put a message queue in between; imho, this is overengineering in my case.

My current approach is to use A12 UAA as a ,central orchestration" to manage users in Keycloak, and manage users and some user-related resources in all services.

Do you have the same-same problems, and how do you solve them?

2

Hello @trinh-wintry-peat, thanks for your post within A12 discourse! We’ve forwarded your request to our UAAteam. As they are currently very busy, there may be delays in processing. We apologize for this and hope to be able to provide an answer in a timely manner.

Your discourse team

3

Hi @trinh-wintry-peat ,

UAA provides an independent component called User Management (UM) which is responsible for managing user and related resources. There is a beneficial feature that might meet your scenario, is that it supports bidirectional synchronization with Keycloak. To achieve that, we implemented a module working as a Keycloak provider to listen the Keycloak events and make the synchronization to UM application accordingly (as you mentioned). Moreover, we can use UM as either standalone or embedded mode.

  • standalone: an independent runnable application.
  • embedded: define as project’s dependency then be able to inherit all functionalities.

In the context of your case, I could come up with a rough solution (based on your current approach) that takes advantage of UM features:

  • Build up the “central orchestration“ application using UM in embedded mode. The application is configured to enable bidirectional synchronization with Keycloak.
  • UM-users are stored in DB as documents and kept synchronous with Keycloak users - already done by UM feature.
  • Develop functionalities to manage user-related resources of other services.
  • The most important thing is to make the synchronization between UM-users and other services users. It could be leveraged by using document events of Dataservices (DocumentAfterUpdateEvent, DocumentAfterCreateEvent,…).

Hope it would help and give you some valuable ideas.

4

Hello @trinh-wintry-peat, I am a member of the Discourse team. I can see that there was a new response to your question on Sync user data between services that uses same Keycloak. Do you find it helpful, or should the question remain open?

Thanks ahead for your feedback and have a nice rest of the day!