Uploaded image for project: 'Red Hat build of Keycloak'
  1. Red Hat build of Keycloak
  2. RHBK-1028

[GHI#25912] LDAP federation reports "Creating new LDAP Store..." on every login

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      Before reporting an issue

      [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

      Area

      ldap

      Describe the bug

      After upgrading to version 23.0.3, on every user login Keyecloak logs an entry similar to the following (both are from the same server):
      ```
      INFO [org.keycloak.storage.ldap.LDAPIdentityStoreRegistry] (executor-thread-44) Creating new LDAP Store for the LDAP storage provider: 'ldap', LDAP Configuration:

      {fullSyncPeriod=[-1], pagination=[false], startTls=[false], connectionPooling=[true], usersDn=[ou=people,dc=test,dc=keycloak,dc=local], cachePolicy=[DEFAULT], useKerberosForPasswordAuthentication=[false], importEnabled=[true], enabled=[true], usernameLDAPAttribute=[uid], changedSyncPeriod=[-1], bindDn=[uid=keycloak,dc=test,dc=keycloak,dc=local], vendor=[rhds], uuidLDAPAttribute=[uid], connectionUrl=[ldap://quarkus-kc-cluster-1-ldap], allowKerberosAuthentication=[false], syncRegistrations=[true], authType=[simple], useTruststoreSpi=[ldapsOnly], usePasswordModifyExtendedOp=[false], trustEmail=[true], userObjectClasses=[inetOrgPerson, organizationalPerson], rdnLDAPAttribute=[uid], editMode=[READ_ONLY], validatePasswordPolicy=[false]}

      , binaryAttributes: []
      INFO [org.keycloak.storage.ldap.LDAPIdentityStoreRegistry] (executor-thread-44) Creating new LDAP Store for the LDAP storage provider: 'ldap', LDAP Configuration:

      {fullSyncPeriod=[-1], pagination=[false], startTls=[false], connectionPooling=[true], usersDn=[ou=people,dc=test,dc=keycloak,dc=local], cachePolicy=[DEFAULT], useKerberosForPasswordAuthentication=[false], importEnabled=[true], enabled=[true], usernameLDAPAttribute=[uid], changedSyncPeriod=[-1], bindDn=[uid=keycloak,dc=test,dc=keycloak,dc=local], vendor=[rhds], uuidLDAPAttribute=[uid], connectionUrl=[ldap://quarkus-kc-cluster-1-ldap], allowKerberosAuthentication=[false], syncRegistrations=[true], authType=[simple], useTruststoreSpi=[ldapsOnly], usePasswordModifyExtendedOp=[false], trustEmail=[true], userObjectClasses=[inetOrgPerson, organizationalPerson], rdnLDAPAttribute=[uid], editMode=[READ_ONLY], validatePasswordPolicy=[false]}

      , binaryAttributes: []
      ```

      As far as I can tell, in previous versions (up to 21), this message was logged only once.

      Version

      23.0.3

      Expected behavior

      The message is logged only once, when the configuration is set up the first time.

      Actual behavior

      The message is generated on every user login, greatly polluting the log output.

      How to Reproduce?

      Create a LDAP federation and monitor the log after every user login.

      Anything else?

      If other configuration details (e.g., Infinispan configurations) are relevant, I could link them (they are public), but from what I can tell from the code, the cache used for lookup is local to Keycloak.

              Unassigned Unassigned
              pvlha Pavel Vlha
              Keycloak Core IAM
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: