Server Cache Configuration
Keycloak has two types of caches. One type of cache sits in front of the database to decrease load on the DB
and to increase overall response times by keeping data in memory. Realm, client, role, and user metadata is kept in this type of cache.
This cache is a local cache. Local caches do not use replication even if you are in the cluster with more Keycloak servers.
Instead, they only keep copies locally and if the entry is updated an invalidation message is sent to the rest of the cluster
and the entry is evicted. There is separate replicated cache
work, which task is to send the invalidation messages to the whole cluster about what entries
should be evicted from local caches. This greatly reduces network traffic, makes things efficient, and avoids transmitting sensitive
metadata over the wire.
The second type of cache handles managing user sessions, offline tokens, and keeping track of login failures so that the server can detect password phishing and other attacks. The data held in these caches is temporary, in memory only, but is possibly replicated across the cluster.
This chapter discusses some configuration options for these caches for both clustered a non-clustered deployments.
|More advanced configuration of these caches can be found in the Infinispan section of the WildFly 10 Documentation.|