ADORSYS-GIS / ADORSYS-GIS/keycloak-ops

[EPIC]: Implement Transactional User Creation via UserStorageProvider Decorator

Ouverte
#32 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
Smarty
Étoiles
0
Forks
4
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

### Analysis
Keycloak's event listener SPI is intentionally designed to be post-transaction. Events are fired only after a database transaction is successfully committed. This prevents event listeners from interfering with core Keycloak operations, but it makes it impossible to roll back a transaction due to a listener's failure.

### Necessity
**High (for specific use cases).** For systems requiring strong data consistency with Keycloak, this is a critical feature. For example, if creating a user in an external billing system fails, the user should not be created in Keycloak either. However, for many users, the current "fire-and-forget" behavior is sufficient and safer.

### Proposed changes
- **Phase 1: Create a New `TransactionalUserStorageProvider`**
- This provider will act as a **decorator**, wrapping Keycloak's default user storage provider.
- It will override the `addUser` method to intercept user creation.
- Inside `addUser`, it will first create the user, then send the webhook.
If the webhook fails, the Keycloak transaction will be forced to **roll back**.

- **Phase 2: Add Configuration**
- Add a constant for the `WEBHOOK_ENABLE_TRANSACTIONAL_BEHAVIOR` environment variable to act as a feature flag.

- **Phase 3: Register the New Provider**
- Modify the `META-INF/services/org.keycloak.storage.UserStorageProviderFactory` file.
- Add the name of the new provider's factory to this file so Keycloak can discover and load it.

### Backward Compatibility & Safety
Any implementation of this **must be disabled by default** and enabled with an explicit environment variable, e.g., `WEBHOOK_ENABLE_TRANSACTIONAL_BEHAVIOR=true`. Enabling this would fundamentally change the provider's behavior and could risk impacting Keycloak's stability if not implemented perfectly.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.