Hello,
Currently i am building a Keycloak IDP with ~180 connected clients for which i’m using Metadata Descriptor URL. I am looking for a way to refresh/trigger the metadata. Because if something changes in the metadata URL and Keycloak doesn’t pick it up correctly (or not at all), you want a clean way to refresh the key-cache. For instance, during a certificate rotation where the new certificate isn’t immediately recognized. And if the key in the Keycloak store does not match the one specified in the URL, the application will not work.
Now i have found a way to clear the keys cache through a kcadm command (./kcadm.sh create clear-keys-cache --realm master -s realm=master), but this is for the whole realm instead of a specific client.
This leaves me with the following solutions i have found:
- Overlay: configure the IDP to publish both the old and new certificates during the rotation.
- Toggle the metadata URL setting and save—in practice, this often triggers a refetch.
- Reduce the max-idle setting for the keys cache in cache-ispn.xml.
- PublicKeyStorageProvider SPI: a custom SPI for reloadKeys. This calls session.keys().reloadKeys(model) for the specific provider ID. (This provides a new API call)
The current refresh interval is 1 hour and we don’t want any inconveniences with the clients.
None of these solutions seems to be elegant, therefore i am wondering if there are any solutions i havent seen or found yet.