Support/Guidance Needed: Aurora DSQL Active-Active Setup with Keycloak

[Aravindhan Alagesan]

Hi Team,

I’m currently exploring the use of AWS Aurora DSQL in an active-active (multi-region) configuration with Keycloak and wanted to check if anyone in the community has experience with this setup or can provide guidance.

Specifically, I’m looking for input on:

• Compatibility of Keycloak with Aurora DSQL (distributed SQL / active-active)
• Any known limitations or concerns (e.g., consistency, transactions, session handling)
• Recommended architecture or deployment patterns for multi-region active-active setups
• Whether any configuration changes or customizations are required in Keycloak
• Real-world experiences or best practices, if available

My goal is to achieve a highly available, multi-region Keycloak deployment with minimal latency and strong consistency.

If this setup is not currently supported or recommended, I’d also appreciate any suggestions for alternative approaches.

Thanks in advance for your help!

Best regards,
Aravindh

[Alexander Schwartz]

Hello Aravindhan,

I've never tried it. I asked Google Gemini about the limitations, and it stated among others: 

"Certain native relational features, such as foreign key constraints, database sequences, and SELECT ... FOR UPDATE blocking mechanisms, are omitted in favor of distributed speed and scale."

Keycloak uses SELECT ... FOR UPDATE for pessimistic locking in some places where we didn't want to use optimistic locking to avoid retries or deadlocks. In some places Keycloak also relies on foreign keys. 

With that, I wouldn't recommend using it. 

Best,

Alexander

--
You received this message because you are subscribed to the Google Groups "Keycloak User" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-use...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/keycloak-user/45bd7f55-1db7-4ccf-9048-e0724b651dd1n%40googlegroups.com.

--

Alexander Schwartz, RHCE

He/Him

Principal Software Engineer, Keycloak Maintainer

alexander...@ibm.com

IBM Data Privacy Statement 

IBM Deutschland Research & Development GmbH

Vorsitzender des Aufsichtsrats: Wolfgang Wendt

Geschäftsführung: David Faller

Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294