Retrieve UUID from LDAP in same context #29470
Conversation
This should avoid out-of-sync problems in distributed LDAP environments. Closes keycloak#29206 Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
|
@davidfrickert - I have tested this locally, but I'm missing an environment to test this against a clustered version of OpenLDAP where it could show the error you experienced. I wonder if you can test this change by building an image locally? Note that if you run an Keycloak with a version build from main, this version will do a database migration and you won't be able to upgrade that environment to a released version of Keycloak later. So please use it only in an ephemeral environment where you can reset the database afterwards. @sguilhen - I'd be happy if you could have a look at this change if you think this is a possible solution. Maybe we need to involve some other LDAP-literate people for this as well. |
Yeah no worries I can test this on a disposable local K3s cluster with clustered OpenLDAP, will let you know here what happens! |
|
Looking good! I was able to create multiple users in a row without errors and also Group assignment / leaving group multiple times in a row. |
|
@rmartinc would you be able to take a look when you have some time? |
|
@davidfrickert - thank you for your tests, the tests you describe sound sufficient to me. Let's wait for @rmartinc and then this should be ready to merge. @sguilhen, @rmartinc - would this be a candidate for a backport to KC24? |
|
@ahus1 I would think so, looks like a good candidate for backporting. |
This should avoid out-of-sync problems in distributed LDAP environments.
Closes #29206