Upgrade to the Quarkus-based Keycloak distribution

[XcrigX]

The current project is fixed to Keycloak 16.1.1.
It appears starting with Keycloak 17, significant changes have been made to how keycloak configuration works:
https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-17-0-0

"The default Keycloak distribution is now based on Quarkus. The new distribution is faster, leaner, and a lot easier to configure!
We appreciate migrating from the WildFly distribution is not going to be straightforward for everyone, since how you start and configure Keycloak has radically changed. With that in mind we will continue to support the WildFly distribution until June 2022."

Note also the end support date of June 2022.

Are the maintainers here planning an update, or should your (very appreciative) users plan this on their own?
Thanks!

NOTE: I haven't tried or looked deeply into the changes or upgrading as of yet, but will share back anything I learn or do here.

[lmsurpre]

I've now bumped the version to keycloak 18.0.0, but I have not looked into making it compatible with the quarkus distribution. If you don't mind, I'll update the title of this one to indicate the desire to move to that.

[lmsurpre]

I don't have immediate plans for looking into the Quarkus distribution...any insights you (or others) can provide on the changes required for that would be most welcome.

[lmsurpre]

For cases where a user has access to more than one patient and a launch/patient scope is requested, the current implementation makes use IBM FHIR Server client libs (packaged as a jboss module)...I don't think any of that will work in Quarkus. I'd probably start by looking at version 2.x of the testcontainers-keycloak project which supports the Quarkus-based keycloak distribution...hopefully that could provide a nice environment to iterate on the Patient selection form.

Also, if its needed, feel free to open an issue at IBM/FHIR to request quarkus support from the main libs (fhir-model and fhir-provider) there.

[XcrigX]

@lmsurpre - We had some luck getting this to work on the Quarkus version. We used the HAPI client libs rather than Jboss to query the FHIR server and packaged the custom authenticator as a shaded/uber jar which can then be deployed with Keycloak at a specific path.
One difference to be aware of is this guidance in the 17.x release notes:
"With the new distribution there is no longer a separate classpath for custom providers, so you may need to be more careful with what additional dependencies you include. In addition, the EAR packaging format, and jboss-deployment-structure.xml files, is no longer supported."

There are of course a lot of differences in how to configure and run Keycloak in the latest version as well.

I hope to share this back when we get to a stable point, but wanted to update that it's possible and not too difficult or different really from what you had.

[jigneshmpatel]

@XcrigX do you able to make any progress of using keycloak based on quarkus? I am seeing there are many branches created from @lmsurpre. Is there any branch we can pick up and start working on it, if required we can also work towards completing pending task.

[XcrigX]

@jigneshmpatel - I have my working copy here: https://github.com/XcrigX/keycloak-extensions-for-fhir/tree/quarkus-update

I'm still working through some issues with the unit tests so I haven't pushed it to this repo yet. There is also some work to do to update the readme. I'll update here when I get it fully functioning - I think it's 95% there.
@lmsurpre - Let me know how you'd like to handle it when it's working - a separate branch here?

[jigneshmpatel]

@XcrigX thank you for response. Since the window of certification of g10 is very close, how do we jump in and start working. Is it only test cases are not working?

[XcrigX]

Some context: I have everything working in a different/private repo we had started from scratch using this project as a guide.
I am now trying to port what we did back to this project. So I know it can work.
I have not tested this version out 'live' yet though. I just started porting it back here today.

I'm down to one strange test failure. The KeyCloakConfig.PropertyGroupTest fails when running from command line, but works in Eclipse. I'm out of time to figure it out today though..

Feel free to grab it and build it. Keycloak does come up.

Be warned - I found Keycloak to be tricky to get configured to run in real environment (behind a reverse-proxy, admin console not publicly available, TLS, etc.).
The Dockerfile here is starting the server in dev mode. You'll need to change all that to run it "for real".
See: https://www.keycloak.org/guides for more info.

[jigneshmpatel]

ok see if there is a progress being made towards the end of week, we will start exploring about sometime early next week.

[XcrigX]

fyi, unit test errors all fixed now - was just an issue with the surefire plugin version and junit5

[XcrigX]

NOTE: I deleted and recreated the branch also so I could squash everything into 1 commit: https://github.com/XcrigX/keycloak-extensions-for-fhir/tree/feature/quarkus-update

[lmsurpre]

Thats awesome @XcrigX ... please open a PR if you're interested in contributing that.
We do follow DCO here and so you'd need to amend your commit to add a single-line signoff.

[jigneshmpatel]

That is awesome so @XcrigX <https://github.com/XcrigX> this branch code does not require any mocifcations? https://github.com/XcrigX/keycloak-extensions-for-fhir/tree/quarkus-update

…

On Fri, Oct 7, 2022 at 11:43 AM Lee Surprenant ***@***.***> wrote: Thats awesome @XcrigX <https://github.com/XcrigX> ... please open a PR if you're interested in contributing that. We do follow DCO <https://github.com/Alvearie/keycloak-extensions-for-fhir/blob/main/CONTRIBUTING.md#developers-certificate-of-origin> here and so you'd need to amend your commit to add a single-line signoff. — Reply to this email directly, view it on GitHub <#64 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAF6OEBGSW5KKMMM3IC3I3LWCBAIVANCNFSM5U4MDYYQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>