org.keycloak.models.cache.infinispan

Class RealmCacheSession

java.lang.Object

org.keycloak.models.cache.infinispan.RealmCacheSession

All Implemented Interfaces:

CacheRealmProvider, ClientProvider, RealmProvider, Provider, ClientLookupProvider

public class RealmCacheSession
extends Object
implements CacheRealmProvider

- the high level architecture of this cache is an invalidation cache. - the cache is manual/custom versioned. When a model is updated, we remove it from the cache which causes an invalidation message to be sent across the cluster. - We had to do it this way because Infinispan REPEATABLE_READ wouldn't cut it in invalidation mode. Also, REPEATABLE_READ doesn't work very well on relationships and items that are not in the cache. - There are two Infinispan caches. One clustered that holds actual objects and a another local one that holds revision numbers of cached objects. Whenever a cached object is removed (invalidated), the local revision cache number or that key is bumped higher based on a local version counter. Whenever a cache entry is fetched, this revision number is also fetched and compared against the revision number in the cache entry to see if the cache entry is stale. Whenever a cache entry is added, this revision number is also checked against the revision cache. - Revision entries are actually never removed (although they could be evicted by cache eviction policies). The reason for this is that it is possible for a stale object to be inserted if one thread loads and the data is updated in the database before it is added to the cache. So, we keep the version number around for this. - In a transaction, objects are registered to be invalidated. If an object is marked for invalidation within a transaction a cached object should never be returned. An DB adapter should always be returned. - After DB commits, the objects marked for invalidation are invalidated, or rather removed from the cache. At this time the revision cache entry for this object has its version number bumped. - Whenever an object is marked for invalidation, the cache is also searched for any objects that are related to this object and need to also be evicted/removed. We use the Infinispan Stream SPI for this. ClientList caches: - lists of clients are cached in a specific cache entry i.e. realm clients, find client by clientId - realm client lists need to be invalidated and evited whenever a client is added or removed from a realm. RealmProvider now has addClient/removeClient at its top level. All adapaters should use these methods so that the appropriate invalidations can be registered. - whenever a client is added/removed the realm of the client is added to a listInvalidations set this set must be checked before sending back or caching a cached query. This check is required to avoid caching an uncommitted removal/add in a query cache. - when a client is removed, any queries that contain that client must also be removed. - a client removal will also cause anything that is contained and cached within that client to be removed Clustered caches: - There is a Infinispan @Listener registered. If an invalidation event happens, this is treated like the object was removed from the database and will perform evictions based on that assumption. - Eviction events will also cascade other evictions, but not assume this is a db removal. - With an invalidation cache, if you remove an entry on node 1 and this entry does not exist on node 2, node 2 will not receive a @Listener invalidation event. so, hat we have to put a marker entry in the invalidation cache before we read from the DB, so if the DB changes in between reading and adding a cache entry, the cache will be notified and bump the version information. DBs with Repeatable Read: - DBs like MySQL are Repeatable Read by default. So, if you query a Client for instance, it will always return the same result in the same transaction even if the DB was updated in between these queries. This makes it possible to store stale cache entries. To avoid this problem, this class stores the current local version counter at the beginningof the transaction. Whenever an entry is added to the cache, the current coutner is compared against the counter at the beginning of the tx. If the current is greater, then don't cache. Groups and Roles: - roles are tricky because of composites. Composite lists are cached too. So, when a role is removed we also iterate and invalidate any role or group that contains that role being removed. - any relationship should be resolved from session.realms(). For example if JPA.getClientByClientId() is invoked, JPA should find the id of the client and then call session.realms().getClientById(). THis is to ensure that the cached object is invoked and all proper invalidation are being invoked.

Version:

$Revision: 1 $

Author:

Bill Burke

Field Summary

Fields

Modifier and Type	Field and Description
protected RealmCacheManager	cache
protected boolean	clearAll
protected ClientProvider	clientDelegate
protected Set<InvalidationEvent>	invalidationEvents
protected Set<String>	invalidations
protected Set<String>	listInvalidations
protected static org.jboss.logging.Logger	logger
protected Map<String,ClientModel>	managedApplications
protected Map<String,ClientScopeAdapter>	managedClientScopes
protected Map<String,GroupAdapter>	managedGroups
protected Map<String,RealmAdapter>	managedRealms
protected Map<String,RoleAdapter>	managedRoles
static String	REALM_CLIENTS_QUERY_SUFFIX
protected RealmProvider	realmDelegate
static String	ROLES_QUERY_SUFFIX
protected KeycloakSession	session
protected boolean	setRollbackOnly
protected long	startupRevision
protected boolean	transactionActive

Constructor Summary

Constructors

Constructor and Description
RealmCacheSession(RealmCacheManager cache, KeycloakSession session)

Method Summary

Modifier and Type	Method and Description
ClientModel	addClient(RealmModel realm, String clientId)
ClientModel	addClient(RealmModel realm, String id, String clientId)
RoleModel	addClientRole(RealmModel realm, ClientModel client, String name)
RoleModel	addClientRole(RealmModel realm, ClientModel client, String id, String name)
RoleModel	addRealmRole(RealmModel realm, String name)
RoleModel	addRealmRole(RealmModel realm, String id, String name)
void	addTopLevelGroup(RealmModel realm, GroupModel subGroup)
protected ClientModel	cacheClient(RealmModel realm, ClientModel delegate, Long revision)
void	clear()
void	close()
ClientInitialAccessModel	createClientInitialAccessModel(RealmModel realm, int expiration, int count)
GroupModel	createGroup(RealmModel realm, String id, String name, GroupModel toParent)
RealmModel	createRealm(String name)
RealmModel	createRealm(String id, String name)
void	decreaseRemainingCount(RealmModel realm, ClientInitialAccessModel clientInitialAccess)
void	evictRealmOnRemoval(RealmModel realm)
List<ClientModel>	getAlwaysDisplayInConsoleClients(RealmModel realm)
ClientModel	getClientByClientId(String clientId, RealmModel realm)
ClientModel	getClientById(String id, RealmModel realm)
ClientProvider	getClientDelegate()
ClientInitialAccessModel	getClientInitialAccessModel(RealmModel realm, String id)
RoleModel	getClientRole(RealmModel realm, ClientModel client, String name)
Set<RoleModel>	getClientRoles(RealmModel realm, ClientModel client)
Set<RoleModel>	getClientRoles(RealmModel realm, ClientModel client, Integer first, Integer max)
List<ClientModel>	getClients(RealmModel realm)
List<ClientModel>	getClients(RealmModel realm, Integer firstResult, Integer maxResults)
ClientScopeModel	getClientScopeById(String id, RealmModel realm)
Long	getClientsCount(RealmModel realm)
GroupModel	getGroupById(String id, RealmModel realm)
List<GroupModel>	getGroups(RealmModel realm)
List<GroupModel>	getGroupsByRole(RealmModel realm, RoleModel role, int firstResult, int maxResults)
Long	getGroupsCount(RealmModel realm, Boolean onlyTopGroups)
Long	getGroupsCountByNameContaining(RealmModel realm, String search)
MigrationModel	getMigrationModel()
RealmModel	getRealm(String id)
RealmModel	getRealmByName(String name)
RealmProvider	getRealmDelegate()
RoleModel	getRealmRole(RealmModel realm, String name)
Set<RoleModel>	getRealmRoles(RealmModel realm)
Set<RoleModel>	getRealmRoles(RealmModel realm, Integer first, Integer max)
List<RealmModel>	getRealms()
List<RealmModel>	getRealmsWithProviderType(Class<?> type)
RoleModel	getRoleById(String id, RealmModel realm)
long	getStartupRevision()
List<GroupModel>	getTopLevelGroups(RealmModel realm)
List<GroupModel>	getTopLevelGroups(RealmModel realm, Integer first, Integer max)
boolean	isInvalid(String id)
List<ClientInitialAccessModel>	listClientInitialAccess(RealmModel realm)
void	moveGroup(RealmModel realm, GroupModel group, GroupModel toParent)
void	registerClientInvalidation(String id, String clientId, String realmId)
void	registerClientScopeInvalidation(String id)
void	registerGroupInvalidation(String id)
void	registerRealmInvalidation(String id, String name)
void	registerRoleInvalidation(String id, String roleName, String roleContainerId)
boolean	removeClient(String id, RealmModel realm)
void	removeClientInitialAccessModel(RealmModel realm, String id)
void	removeExpiredClientInitialAccess()
boolean	removeGroup(RealmModel realm, GroupModel group)
boolean	removeRealm(String id)
boolean	removeRole(RealmModel realm, RoleModel role)
protected void	runInvalidations()
List<ClientModel>	searchClientsByClientId(String clientId, Integer firstResult, Integer maxResults, RealmModel realm)
Set<RoleModel>	searchForClientRoles(RealmModel realm, ClientModel client, String search, Integer first, Integer max)
List<GroupModel>	searchForGroupByName(RealmModel realm, String search, Integer first, Integer max)
Set<RoleModel>	searchForRoles(RealmModel realm, String search, Integer first, Integer max)
protected ClientModel	validateCache(RealmModel realm, CachedClient cached)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.models.RealmProvider

createGroup, createGroup, createGroup

Field Detail

logger

protected static final org.jboss.logging.Logger logger

REALM_CLIENTS_QUERY_SUFFIX

public static final String REALM_CLIENTS_QUERY_SUFFIX

See Also:

Constant Field Values

ROLES_QUERY_SUFFIX

public static final String ROLES_QUERY_SUFFIX

See Also:

Constant Field Values

cache

protected RealmCacheManager cache

session

protected KeycloakSession session

realmDelegate

protected RealmProvider realmDelegate

clientDelegate

protected ClientProvider clientDelegate

transactionActive

protected boolean transactionActive

setRollbackOnly

protected boolean setRollbackOnly

managedRealms

protected Map<String,RealmAdapter> managedRealms

managedApplications

protected Map<String,ClientModel> managedApplications

managedClientScopes

protected Map<String,ClientScopeAdapter> managedClientScopes

managedRoles

protected Map<String,RoleAdapter> managedRoles

managedGroups

protected Map<String,GroupAdapter> managedGroups

listInvalidations

protected Set<String> listInvalidations

invalidations

protected Set<String> invalidations

invalidationEvents

protected Set<InvalidationEvent> invalidationEvents

clearAll

protected boolean clearAll

startupRevision

protected final long startupRevision

Constructor Detail

RealmCacheSession

public RealmCacheSession(RealmCacheManager cache,
                         KeycloakSession session)

Method Detail

getStartupRevision

public long getStartupRevision()

isInvalid

public boolean isInvalid(String id)

clear

public void clear()

Specified by:

clear in interface CacheRealmProvider

getMigrationModel

public MigrationModel getMigrationModel()

Specified by:

getMigrationModel in interface RealmProvider

getRealmDelegate

public RealmProvider getRealmDelegate()

Specified by:

getRealmDelegate in interface CacheRealmProvider

getClientDelegate

public ClientProvider getClientDelegate()

registerRealmInvalidation

public void registerRealmInvalidation(String id,
                                      String name)

Specified by:

registerRealmInvalidation in interface CacheRealmProvider

registerClientInvalidation

public void registerClientInvalidation(String id,
                                       String clientId,
                                       String realmId)

Specified by:

registerClientInvalidation in interface CacheRealmProvider

registerClientScopeInvalidation

public void registerClientScopeInvalidation(String id)

Specified by:

registerClientScopeInvalidation in interface CacheRealmProvider

registerRoleInvalidation

public void registerRoleInvalidation(String id,
                                     String roleName,
                                     String roleContainerId)

Specified by:

registerRoleInvalidation in interface CacheRealmProvider

registerGroupInvalidation

public void registerGroupInvalidation(String id)

Specified by:

registerGroupInvalidation in interface CacheRealmProvider

runInvalidations

protected void runInvalidations()

createRealm

public RealmModel createRealm(String name)

Specified by:

createRealm in interface RealmProvider

createRealm

public RealmModel createRealm(String id,
                              String name)

Specified by:

createRealm in interface RealmProvider

getRealm

public RealmModel getRealm(String id)

Specified by:

getRealm in interface RealmProvider

getRealmByName

public RealmModel getRealmByName(String name)

Specified by:

getRealmByName in interface RealmProvider

getRealmsWithProviderType

public List<RealmModel> getRealmsWithProviderType(Class<?> type)

Specified by:

getRealmsWithProviderType in interface RealmProvider

getRealms

public List<RealmModel> getRealms()

Specified by:

getRealms in interface RealmProvider

removeRealm

public boolean removeRealm(String id)

Specified by:

removeRealm in interface RealmProvider

evictRealmOnRemoval

public void evictRealmOnRemoval(RealmModel realm)

addClient

public ClientModel addClient(RealmModel realm,
                             String clientId)

Specified by:

addClient in interface ClientProvider

addClient

public ClientModel addClient(RealmModel realm,
                             String id,
                             String clientId)

Specified by:

addClient in interface ClientProvider

getClients

public List<ClientModel> getClients(RealmModel realm,
                                    Integer firstResult,
                                    Integer maxResults)

Specified by:

getClients in interface ClientProvider

getClients

public List<ClientModel> getClients(RealmModel realm)

Specified by:

getClients in interface ClientProvider

getAlwaysDisplayInConsoleClients

public List<ClientModel> getAlwaysDisplayInConsoleClients(RealmModel realm)

Specified by:

getAlwaysDisplayInConsoleClients in interface ClientProvider

removeClient

public boolean removeClient(String id,
                            RealmModel realm)

Specified by:

removeClient in interface ClientProvider

close

public void close()

Specified by:

close in interface RealmProvider

Specified by:

close in interface Provider

addRealmRole

public RoleModel addRealmRole(RealmModel realm,
                              String name)

Specified by:

addRealmRole in interface RealmProvider

addRealmRole

public RoleModel addRealmRole(RealmModel realm,
                              String id,
                              String name)

Specified by:

addRealmRole in interface RealmProvider

getRealmRoles

public Set<RoleModel> getRealmRoles(RealmModel realm)

Specified by:

getRealmRoles in interface RealmProvider

getClientRoles

public Set<RoleModel> getClientRoles(RealmModel realm,
                                     ClientModel client)

Specified by:

getClientRoles in interface ClientProvider

getRealmRoles

public Set<RoleModel> getRealmRoles(RealmModel realm,
                                    Integer first,
                                    Integer max)

Specified by:

getRealmRoles in interface RealmProvider

getClientRoles

public Set<RoleModel> getClientRoles(RealmModel realm,
                                     ClientModel client,
                                     Integer first,
                                     Integer max)

Specified by:

getClientRoles in interface RealmProvider

searchForClientRoles

public Set<RoleModel> searchForClientRoles(RealmModel realm,
                                           ClientModel client,
                                           String search,
                                           Integer first,
                                           Integer max)

Specified by:

searchForClientRoles in interface RealmProvider

searchForRoles

public Set<RoleModel> searchForRoles(RealmModel realm,
                                     String search,
                                     Integer first,
                                     Integer max)

Specified by:

searchForRoles in interface RealmProvider

addClientRole

public RoleModel addClientRole(RealmModel realm,
                               ClientModel client,
                               String name)

Specified by:

addClientRole in interface ClientProvider

addClientRole

public RoleModel addClientRole(RealmModel realm,
                               ClientModel client,
                               String id,
                               String name)

Specified by:

addClientRole in interface ClientProvider

getRealmRole

public RoleModel getRealmRole(RealmModel realm,
                              String name)

Specified by:

getRealmRole in interface RealmProvider

getClientRole

public RoleModel getClientRole(RealmModel realm,
                               ClientModel client,
                               String name)

Specified by:

getClientRole in interface ClientProvider

removeRole

public boolean removeRole(RealmModel realm,
                          RoleModel role)

Specified by:

removeRole in interface RealmProvider

getRoleById

public RoleModel getRoleById(String id,
                             RealmModel realm)

Specified by:

getRoleById in interface RealmProvider

getGroupById

public GroupModel getGroupById(String id,
                               RealmModel realm)

Specified by:

getGroupById in interface RealmProvider

moveGroup

public void moveGroup(RealmModel realm,
                      GroupModel group,
                      GroupModel toParent)

Specified by:

moveGroup in interface RealmProvider

getGroups

public List<GroupModel> getGroups(RealmModel realm)

Specified by:

getGroups in interface RealmProvider

getGroupsCount

public Long getGroupsCount(RealmModel realm,
                           Boolean onlyTopGroups)

Specified by:

getGroupsCount in interface RealmProvider

getClientsCount

public Long getClientsCount(RealmModel realm)

Specified by:

getClientsCount in interface RealmProvider

getGroupsCountByNameContaining

public Long getGroupsCountByNameContaining(RealmModel realm,
                                           String search)

Specified by:

getGroupsCountByNameContaining in interface RealmProvider

getGroupsByRole

public List<GroupModel> getGroupsByRole(RealmModel realm,
                                        RoleModel role,
                                        int firstResult,
                                        int maxResults)

Specified by:

getGroupsByRole in interface RealmProvider

getTopLevelGroups

public List<GroupModel> getTopLevelGroups(RealmModel realm)

Specified by:

getTopLevelGroups in interface RealmProvider

getTopLevelGroups

public List<GroupModel> getTopLevelGroups(RealmModel realm,
                                          Integer first,
                                          Integer max)

Specified by:

getTopLevelGroups in interface RealmProvider

searchForGroupByName

public List<GroupModel> searchForGroupByName(RealmModel realm,
                                             String search,
                                             Integer first,
                                             Integer max)

Specified by:

searchForGroupByName in interface RealmProvider

removeGroup

public boolean removeGroup(RealmModel realm,
                           GroupModel group)

Specified by:

removeGroup in interface RealmProvider

createGroup

public GroupModel createGroup(RealmModel realm,
                              String id,
                              String name,
                              GroupModel toParent)

Specified by:

createGroup in interface RealmProvider

addTopLevelGroup

public void addTopLevelGroup(RealmModel realm,
                             GroupModel subGroup)

Specified by:

addTopLevelGroup in interface RealmProvider

getClientById

public ClientModel getClientById(String id,
                                 RealmModel realm)

Specified by:

getClientById in interface ClientLookupProvider

cacheClient

protected ClientModel cacheClient(RealmModel realm,
                                  ClientModel delegate,
                                  Long revision)

validateCache

protected ClientModel validateCache(RealmModel realm,
                                    CachedClient cached)

searchClientsByClientId

public List<ClientModel> searchClientsByClientId(String clientId,
                                                 Integer firstResult,
                                                 Integer maxResults,
                                                 RealmModel realm)

Specified by:

searchClientsByClientId in interface ClientLookupProvider

getClientByClientId

public ClientModel getClientByClientId(String clientId,
                                       RealmModel realm)

Specified by:

getClientByClientId in interface ClientLookupProvider

getClientScopeById

public ClientScopeModel getClientScopeById(String id,
                                           RealmModel realm)

Specified by:

getClientScopeById in interface RealmProvider

createClientInitialAccessModel

public ClientInitialAccessModel createClientInitialAccessModel(RealmModel realm,
                                                               int expiration,
                                                               int count)

Specified by:

createClientInitialAccessModel in interface RealmProvider

getClientInitialAccessModel

public ClientInitialAccessModel getClientInitialAccessModel(RealmModel realm,
                                                            String id)

Specified by:

getClientInitialAccessModel in interface RealmProvider

removeClientInitialAccessModel

public void removeClientInitialAccessModel(RealmModel realm,
                                           String id)

Specified by:

removeClientInitialAccessModel in interface RealmProvider

listClientInitialAccess

public List<ClientInitialAccessModel> listClientInitialAccess(RealmModel realm)

Specified by:

listClientInitialAccess in interface RealmProvider

removeExpiredClientInitialAccess

public void removeExpiredClientInitialAccess()

Specified by:

removeExpiredClientInitialAccess in interface RealmProvider

decreaseRemainingCount

public void decreaseRemainingCount(RealmModel realm,
                                   ClientInitialAccessModel clientInitialAccess)

Specified by:

decreaseRemainingCount in interface RealmProvider