负载均衡环境下Keycloak认证流程：跨节点身份验证机制咨询

Great question—this is a super common scenario when scaling Keycloak, so let’s break it down step by step, focusing exactly on the cross-node session consistency you’re asking about.

1. Initial Authentication with Node1 #

When a user first initiates an authentication request that gets routed to Keycloak Node1 via your load balancer:

• Node1 redirects the user to the login page (if they’re not already authenticated). After the user submits valid credentials, Node1 does three key things:
  • Creates a user session (storing details like user ID, granted roles, session expiration time, and auth context)
  • Issues an authorization code back to the client application
  • The client then exchanges this code for an access token (JWT), refresh token, and ID token
• Most importantly, Node1 instantly replicates this user session data to the entire Keycloak cluster using its built-in distributed cache (Infinispan, which is enabled by default for clustered setups).

2. Subsequent Request to Node2 #

Now when the user accesses another protected URL and their request lands on Node2:

• The client application sends the access token (either via the Authorization header or session cookie, depending on your setup) along with the request to Node2.
• Node2 confirms the user’s authenticated status in two reliable ways:
  • Local JWT Validation: Since the access token is a signed JWT, Node2 can verify its signature locally using the realm’s public key. This doesn’t require communicating with other nodes—it’s fast and avoids cluster overhead for routine requests.
  • Cluster Session Lookup: If Node2 needs to validate the actual user session (e.g., for refresh token requests, checking if the session was invalidated, or verifying granular permissions), it pulls the session data directly from the shared Infinispan cache. Since Node1 already replicated the session to the cluster, this data is immediately available.
• If both checks pass, Node2 recognizes the user is already authenticated and grants access to the resource (or issues a new token if using refresh tokens)—no login prompt required.

3. Critical Configs to Ensure This Works Smoothly #

• Sticky Sessions? Optional, Not Required: Unlike some legacy auth systems, Keycloak doesn’t depend on sticky sessions because of the shared cluster cache. That said, enabling sticky sessions can reduce cache lookup overhead, but it’s not mandatory for functionality.
• Load Balancer Header Preservation: Make sure your load balancer forwards essential headers like Authorization (for token-based auth) and Cookie (for browser-based session cookies).
• Cluster Setup: All Keycloak nodes must be part of the same cluster. By default, Keycloak uses UDP multicast for cluster discovery, but for production, use TCP (e.g., Kubernetes DNS or static node IPs) for reliability.
• Replication Mode: Infinispan can be set to SYNC (synchronous replication) or ASYNC (asynchronous). SYNC ensures session data is replicated before Node1 responds to the user, which is safer for critical auth flows to avoid race conditions.

Quick Scenario Recap #

User → Load Balancer → Keycloak Node1 → Login → Session replicated to cluster → User receives tokens → Next request → Load Balancer → Keycloak Node2 → Node2 validates token locally or looks up session in shared cache → Grants access without re-login.

The shared distributed cache is the "magic" that makes cross-node auth consistency work seamlessly in Keycloak.

内容的提问来源于stack exchange，提问作者Sukesh