Exporting realms & users from Dev Services Keycloak container

[franck102]

Hi,
First of all congratulations for the outstanding documentation around OIDC support in Quarkus!

I am using OIDC Dev Services and one issue I have is that my entire Keycloak configuration (public realm, users with specific roles...) is lost every time I restart quarkus:dev.

I have been able to partially export the configuration from the admin console, however exporting everything including users requires running kc.sh export from the container.

I have tried to do that using the -Djboss.socket.binding.port-offset mentioned elsewhere to avoid the port conflict with the running Keycloak, but this doesn't seem to work in the quay.io container, I am still getting a io.quarkus.runtime.QuarkusBindException and the export fails.

I can start the container manually with the docker label expected by Dev Services.. but I eventually run into the same issue when the container is eventually stopped: does anyone have a good suggestion to successfully export the whole configuration from that Keycloak container?

Thanks!

[franck102]

Answering my own question I guess... simply stopping the container will do the trick:

$ docker ps
...
b0279392d83c   quay.io/keycloak/keycloak:19.0.3   "/opt/keycloak/bin/k…"   

$ docker stop b0279392d83c
$ docker commit b0279392d83c debug/keycloak
$ docker run -it --rm --entrypoint sh debug/keycloak
<in the container>$ /opt/keycloak/bin/kc.sh export --users realm_file --dir /tmp/export

... then use docker cp (before exiting the container :)) to retrieve the exported files.

[sberyozkin]

@franck102 Hi,

I am using OIDC Dev Services and one issue I have is that my entire Keycloak configuration (public realm, users with specific roles...) is lost every time I restart quarkus:dev.

Do you mean that you modify the realm properties directly in Keycloak Admin console after starting quarkus:dev and then when you try to retain those changes via a realm export, the users/roles are not exported ?

Re your docker command sequence. I wonder if we can add a new property like a quarkus.keycloak.devservices.export-realm-path and if it is set, then KeycloakDevServicesProcessor, in its TestContainers Container instance, will execute the export command in its stop (or similar method) override and copy the file to the configured path ?

Would you be interested in opening a PR ?
thanks

[franck102]

Hi, I was using the admin console to update the configuration yes (e.g. new users).
Not sure a PR is worth it, the goal was to migrate to a stable container that is not managed by Quarkus so this is a one off export. There are quite a few configuration options already, in the end starting an external container and configuring it through its admin console is simpler than having to sort out too many config properties.

[sberyozkin]

@franck102 Thanks, I'll consider supporting such an export as it is not the first user request, it should work well with DevServices for Keycloak on its own as well.