macma/macma-keycloak-mssql

Resource Requests and Limits

Resource	Request	Limit
CPU (in millicpu)	500	2000
Memory (in MiB)	2048	4096
Local File Storage (in MB)	900	1500

Required infrastructure services

Databases

Either of

Oracle DB / 19c / Enterprise Edition

Supported Versions: 19c
Extensions: Character set (strongly recommended) (AL32UTF8)
National Character set (required) AL16UTF16)
DBs / Schemas / Users: schema and user are configurable (schema needs to be default for user)
Required Privileges: An oracle user with the privileges "NEXEED_BASIC_ROLE" and "NEXEED_EXTENDED_ROLE" as described in the Nexeed IAS Operations Manual is required
Relative Capacity: depending on amount of tenants, users, applications and resources managed

Microsoft SQL Server 2016/2017/2019, Azure SQL

(only with MS JDBC driver, not jtds)

Supported Versions

2016
2017
2019

Database Settings

To reduce the amount of potential deadlocks the following settings must be enabled for keycloak database to have Read Committed Snapshot Isolation (RCSI):

ALTER DATABASE [keycloak] SET ALLOW_SNAPSHOT_ISOLATION ON
ALTER DATABASE [keycloak] SET READ_COMMITTED_SNAPSHOT ON WITH NO_WAIT

Azure SQL already has these settings enabled by default.

The READ_COMMITTED_SNAPSHOT setting can only be applied if not other connections to the database exist. There are various options to enforce that:

limit database to mode RESTRICTED_USER (rather than SINGLE_USER) temporarily before reverting to MULTI_USER using:
```
ALTER DATABASE [master-data-database] SET <mode> WITH ROLLBACK AFTER 30 SECONDS
```
shut down all applications;
add WITH ROLLBACK IMMEDIATE instead of WITH NO_WAIT to force a rollback of all active transactions;
use database failover to replicas to reconfigure them one by one.

Database Collation: SQL_Latin1_General_CP1_CI_AS
DBs / Schemas / Users: schema and user are configurable (schema needs to be default for user)
Required Privileges: Full access to manage objects and data within the schema DDL + DML.
Relative Capacity: depending on amount of tenants, users, applications and resources managed

Messaging

None needed.

Required resources

Resources	Comments
Certificates	Certificates required for outgoing connections can be configured via the environment variable USE_SYSTEM_CA_CERTS (see macma/macma-keycloak-mssql Configuration for more information)

Resources

Comments

Certificates

Certificates required for outgoing connections can be configured via the environment variable USE_SYSTEM_CA_CERTS (see macma/macma-keycloak-mssql Configuration for more information)