# Enabling Multicast for Keycloak Clustering

**URL:** <https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208>\
**Category:** Configuring the server\
**Tags:** authentication, clustering\
**Created:** [November 19, 2021, 12:17pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208 "2021-11-19T12:17:05Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Deeps](https://forum.keycloak.org/u/Deeps)\
**Post date:** [November 19, 2021, 12:17pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/1 "2021-11-19T12:17:05Z")

</div>

Hi,  
How to enable multicast for keycloak standalone clustering? Is it possible to do keycloak clustering without enabling multicast?

Thanks in advance,  
Deeps.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [November 19, 2021, 12:29pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/2 "2021-11-19T12:29:45Z")

</div>

If you use the default settings, multicast is already active, it’s the default.

---

<div class="post-metadata">

**Author:** ![Deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Deeps](https://forum.keycloak.org/u/Deeps)\
**Post date:** [November 20, 2021, 6:37am UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/3 "2021-11-20T06:37:30Z")

</div>

Yes, I am using the default settings. But I am not sure if my cluster is working properly. In one of your videos, it is mentioned that in the keycloak log, “cluster view” will be displayed if the cluster is working properly. But it is not showing up in my keycloak log.

For load balancing, I used haproxy and tried enabling the sticky session. But getting forbidden error after logging into the application.

---

<div class="post-metadata">

**Author:** ![rmoqpd5t](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rmoqpd5t/32/2208_2.png) [@rmoqpd5t](https://forum.keycloak.org/u/rmoqpd5t)\
**Post date:** [November 23, 2021, 3:56am UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/4 "2021-11-23T03:56:03Z")

</div>

Some helpful clustering information can be found here: [GitHub - fit2anything/keycloak-cluster-setup-and-configuration](https://github.com/fit2anything/keycloak-cluster-setup-and-configuration)

To disable multicast, disable modcluster in standalone[-ha].xml and enable one of the options (e.g. TCPPING) from the link above.

---

<div class="post-metadata">

**Author:** ![rmoqpd5t](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rmoqpd5t/32/2208_2.png) [@rmoqpd5t](https://forum.keycloak.org/u/rmoqpd5t)\
**Post date:** [November 24, 2021, 2:24pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/5 "2021-11-24T14:24:26Z")

</div>

Here are the lines to remove which disable modcluster:

```
 <extension module="org.jboss.as.modcluster"/>
 […]
    <subsystem xmlns="urn:jboss:domain:modcluster:5.0">
 […]
        <proxy name="default" advertise-socket="modcluster" listener="ajp">
            <dynamic-load-provider>
                <load-metric type="cpu"/>
            </dynamic-load-provider>
        </proxy>
    </subsystem>
 […]
            <ajp-listener name="ajp" socket-binding="ajp"/>
 […]
    <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
 […]
    <socket-binding name="modcluster" multicast-address="${jboss.modcluster.multicast.address:224.0.1.105}" multicast-port="23364"/>
```

---

<div class="post-metadata">

**Author:** ![Deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Deeps](https://forum.keycloak.org/u/Deeps)\
**Post date:** [November 24, 2021, 6:13pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/6 "2021-11-24T18:13:47Z")

</div>

Thank you for your help. I will check.

---

<div class="post-metadata">

**Author:** ![Deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Deeps](https://forum.keycloak.org/u/Deeps)\
**Post date:** [November 25, 2021, 6:23pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/7 "2021-11-25T18:23:44Z")

</div>

Hi,  
I followed the steps by commenting the modcluster segments which you mentioned. Also added :  
stack name=“tcp”  
transport type=“TCP” socket-binding=“jgroups-tcp”  
protocol type=“TCPPING”  
property name=“initial\_hosts”\>Keycloak1\_IP[7600],Keycloak2\_IP[7600]property  
property name=“ergonomics”\>false\</property  
/protocol

Included this in the startup command:  
-DJGROUPS\_DISCOVERY\_EXTERNAL\_IP= Keycloak1\_IP -DJGROUPS\_DISCOVERY\_PROTOCOL=TCPPING -DJGROUPS\_DISCOVERY\_PROPERTIES=initial\_hosts=“Keycloak1\_IP[7600],Keycloak2\_IP[7600]”

Still I am getting forbidden error. Is this the correct way to implement  
TCPPING protocol?

---

<div class="post-metadata">

**Author:** ![rmoqpd5t](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rmoqpd5t/32/2208_2.png) [@rmoqpd5t](https://forum.keycloak.org/u/rmoqpd5t)\
**Post date:** [November 26, 2021, 5:36am UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/8 "2021-11-26T05:36:32Z")

</div>

Here is a example working for me on how to configure TCPPING:

```auto
            <channels default="ee">
                <channel name="ee" stack="tcp" cluster="ejb"/>
            </channels>
[...]
                <stack name="tcp">
                    <transport type="TCP" socket-binding="jgroups-tcp">
                        <property name="external_addr">${jboss.bind.address.management:127.0.0.1}</property>
                    </transport>
                    <protocol type="org.jgroups.protocols.TCPPING">
                        <property name="initial_hosts">1.1.1.1[7600],1.1.1.2[7600],1.1.1.3[7600],1.1.1.4[7600]</property>
                        <property name="ergonomics">false</property>
                    </protocol>
			<socket-protocol type="MPING" socket-binding="jgroups-mping"/>
                    <protocol type="MERGE3"/>
                    <socket-protocol type="FD_SOCK" socket-binding="jgroups-tcp-fd"/>
                    <protocol type="FD_ALL"/>
                    <protocol type="VERIFY_SUSPECT"/>
                    <protocol type="pbcast.NAKACK2"/>
                    <protocol type="UNICAST3"/>
                    <protocol type="pbcast.STABLE"/>
                    <protocol type="pbcast.GMS"/>
                    <protocol type="MFC"/>
                    <protocol type="FRAG3"/>
                </stack>

```

JGroups is documented here: [Preface](http://www.jgroups.org/manual/html/Preface.html)

---

<div class="post-metadata">

**Author:** ![rmoqpd5t](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rmoqpd5t/32/2208_2.png) [@rmoqpd5t](https://forum.keycloak.org/u/rmoqpd5t)\
**Post date:** [November 26, 2021, 3:02pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/9 "2021-11-26T15:02:16Z")

</div>

Next, set the distributed cache number of copies which should typically be set to the number of servers in the cluster:

```auto
                <distributed-cache name="sessions" owners="4"/>
                <distributed-cache name="authenticationSessions" owners="4"/>
                <distributed-cache name="offlineSessions" owners="4"/>
                <distributed-cache name="clientSessions" owners="4"/>
                <distributed-cache name="offlineClientSessions" owners="4"/>
                <distributed-cache name="loginFailures" owners="4"/>
[...]
                <distributed-cache name="actionTokens" owners="4">

```

---

<div class="post-metadata">

**Author:** ![rmoqpd5t](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rmoqpd5t/32/2208_2.png) [@rmoqpd5t](https://forum.keycloak.org/u/rmoqpd5t)\
**Post date:** [November 26, 2021, 3:03pm UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/10 "2021-11-26T15:03:19Z")

</div>

Finally, remove these lines to disable UDP:

```auto
<stack name="udp">
    <transport type="UDP" socket-binding="jgroups-udp"/>
    <protocol type="PING"/>
    <protocol type="MERGE3"/>
    <socket-protocol type="FD_SOCK" socket-binding="jgroups-udp-fd"/>
    <protocol type="FD_ALL"/>
    <protocol type="VERIFY_SUSPECT"/>
    <protocol type="pbcast.NAKACK2"/>
    <protocol type="UNICAST3"/>
    <protocol type="pbcast.STABLE"/>
    <protocol type="pbcast.GMS"/>
    <protocol type="UFC"/>
    <protocol type="MFC"/>
    <protocol type="FRAG3"/>
</stack>
[…]
<socket-binding name="jgroups-udp" interface="private" port="55200" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45688"/>
<socket-binding name="jgroups-udp-fd" interface="private" port="54200"/>

```

---

<div class="post-metadata">

**Author:** ![Deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Deeps](https://forum.keycloak.org/u/Deeps)\
**Post date:** [November 30, 2021, 9:58am UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/12 "2021-11-30T09:58:43Z")

</div>

Thank you for the help.

---

<div class="post-metadata">

**Author:** ![abc](https://avatars.discourse-cdn.com/v4/letter/a/2bfe46/32.png) [@abc](https://forum.keycloak.org/u/abc)\
**Post date:** [April 20, 2023, 10:45am UTC](https://forum.keycloak.org/t/enabling-multicast-for-keycloak-clustering/12208/13 "2023-04-20T10:45:56Z")

</div>

Hi Deeps,

Did this work for you?

Thanks,