如何为Keycloak Java适配器维护的连接池配置keep-alive策略？

Absolutely, you can enforce keep-alive for connections in the Keycloak Java adapter's connection pool—either via straightforward configuration tweaks or custom code modifications if you need more granular control. Let’s walk through your options step by step:

Most Keycloak Java adapters rely on Apache HttpClient under the hood, which supports HTTP keep-alive out of the box—but explicitly configuring it ensures the behavior is enforced for all connections in the pool.

• For Servlet/JEE Adapters:
  Edit your keycloak.json file to add an httpClient section with keep-alive and connection pool settings:

  {
    "realm": "your-realm",
    "auth-server-url": "https://your-keycloak-server/auth",
    "resource": "your-client-id",
    "credentials": {
      "secret": "your-client-secret"
    },
    "httpClient": {
      "connectionPoolSize": 20,
      "connectionTimeout": 5000,
      "socketTimeout": 30000,
      "keepAlive": true,
      "maxConnectionIdleTime": 300000,
      "timeToLive": 600000
    }
  }
  

  The keepAlive: true flag ensures the HttpClient sends Connection: Keep-Alive headers, while maxConnectionIdleTime and timeToLive prevent stale connections from lingering in the pool.

• For Spring Boot Adapters:
  Use your application.properties or application.yml to set these properties directly:

  keycloak.http-client.connection-pool-size=20
  keycloak.http-client.connection-timeout=5000
  keycloak.http-client.socket-timeout=30000
  keycloak.http-client.keep-alive=true
  keycloak.http-client.max-connection-idle-time=300000
  keycloak.http-client.time-to-live=600000
  

If you need fine-grained control over connection pool behavior (like custom eviction policies or validation rules), you can build a custom HttpClient and inject it into the Keycloak adapter.

• For Servlet Adapters:
  Implement a custom KeycloakConfigResolver to override the default HttpClient:

  import org.keycloak.adapters.KeycloakConfigResolver;
  import org.keycloak.adapters.KeycloakDeployment;
  import org.keycloak.adapters.KeycloakDeploymentBuilder;
  import org.keycloak.adapters.HttpClientBuilder;
  import org.apache.http.impl.client.CloseableHttpClient;
  import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
  import org.apache.http.client.config.RequestConfig;
  import org.apache.http.config.ConnectionConfig;
  import javax.servlet.http.HttpServletRequest;
  import java.util.concurrent.TimeUnit;
  
  public class CustomKeycloakConfigResolver implements KeycloakConfigResolver {
  
      @Override
      public KeycloakDeployment resolve(HttpServletRequest request) {
          KeycloakDeployment deployment = KeycloakDeploymentBuilder.build("keycloak.json");
          
          // Set up connection manager with keep-alive validation
          PoolingHttpClientConnectionManager connManager = new PoolingHttpClientConnectionManager();
          connManager.setMaxTotal(20);
          connManager.setDefaultMaxPerRoute(20);
          // Validate connections after 5 seconds of inactivity to avoid stale keep-alive links
          connManager.setValidateAfterInactivity(5000);
          
          // Enforce keep-alive in connection settings
          ConnectionConfig connectionConfig = ConnectionConfig.custom()
              .setKeepAliveEnabled(true)
              .build();
          
          // Configure request timeouts
          RequestConfig requestConfig = RequestConfig.custom()
              .setConnectTimeout(5000)
              .setSocketTimeout(30000)
              .setConnectionRequestTimeout(5000)
              .build();
          
          // Build the custom HttpClient with eviction policies
          CloseableHttpClient httpClient = HttpClientBuilder.create()
              .setConnectionManager(connManager)
              .setDefaultConnectionConfig(connectionConfig)
              .setDefaultRequestConfig(requestConfig)
              // Evict idle connections every 30 seconds
              .evictIdleConnections(30, TimeUnit.SECONDS)
              .evictExpiredConnections()
              .build();
          
          deployment.setHttpClient(httpClient);
          return deployment;
      }
  }
  

  Register this resolver in your web.xml:

  <context-param>
      <param-name>keycloak.config.resolver</param-name>
      <param-value>com.your.package.CustomKeycloakConfigResolver</param-value>
  </context-param>
  

• For Spring Boot:
  Define a custom KeycloakSpringBootConfigResolver bean to replace the default HttpClient:

  import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
  import org.keycloak.adapters.springboot.KeycloakSpringBootProperties;
  import org.apache.http.impl.client.CloseableHttpClient;
  import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import java.util.concurrent.TimeUnit;
  
  @Configuration
  public class KeycloakHttpClientConfig {
  
      @Bean
      public KeycloakSpringBootConfigResolver keycloakConfigResolver(KeycloakSpringBootProperties properties) {
          return new KeycloakSpringBootConfigResolver() {
              @Override
              protected CloseableHttpClient createHttpClient() {
                  PoolingHttpClientConnectionManager connManager = new PoolingHttpClientConnectionManager();
                  connManager.setMaxTotal(properties.getHttpClient().getConnectionPoolSize());
                  connManager.setDefaultMaxPerRoute(properties.getHttpClient().getConnectionPoolSize());
                  connManager.setValidateAfterInactivity(5000);
                  
                  return org.keycloak.adapters.HttpClientBuilder.create()
                      .setConnectionManager(connManager)
                      .evictIdleConnections(30, TimeUnit.SECONDS)
                      .evictExpiredConnections()
                      .setDefaultRequestConfig(
                          org.apache.http.client.config.RequestConfig.custom()
                              .setConnectTimeout(properties.getHttpClient().getConnectionTimeout())
                              .setSocketTimeout(properties.getHttpClient().getSocketTimeout())
                              .build()
                      )
                      .setDefaultConnectionConfig(
                          org.apache.http.config.ConnectionConfig.custom()
                              .setKeepAliveEnabled(true)
                              .build()
                      )
                      .build();
              }
          };
      }
  }
  

To confirm your setup is working:

• Enable debug logging for Apache HttpClient: Add log4j.logger.org.apache.http=DEBUG to your logging config. Look for logs like Connection kept alive or Reusing connection to confirm connection reuse.
• Inspect network traffic with tools like Wireshark: Check for Connection: Keep-Alive in outgoing requests and Keep-Alive: timeout=... in responses.
• For Spring Boot apps, use Actuator endpoints (like /actuator/metrics/apache.http.client.connections) to monitor connection pool reuse rates.

内容的提问来源于stack exchange，提问作者Amir Keibi