With Keycloak 17 running in a docker container, how can we now export/import a realm ?
This was documented for the docker image based on Wildfly but it is no more documented for the docker imaged base on Quarkus.
Previously it was possible to export a realm using this command :
There are import and export commands available for kc.sh.
From the command line:
$ ./kc.sh import --help
Import data from a directory or a file.
Usage:
kc.sh import [OPTIONS]
Import data from a directory or a file.
Options:
--dir <path> Set the path to a directory where files will be created with the exported data.
--file <path> Set the path to a file that will be created with the exported data.
-h, --help This help message.
--override <false> Set if existing data should be skipped or overridden. Default: true.
--realm <realm> Set the name of the realm to export
$ ./kc.sh export --help
Export data from realms to a file or directory.
Usage:
kc.sh export [OPTIONS]
Export data from realms to a file or directory.
Options:
--dir <path> Set the path to a directory where files will be created with the exported data.
--file <path> Set the path to a file that will be created with the exported data.
-h, --help This help message.
--realm <realm> Set the name of the realm to export
--users <strategy> Set how users should be exported. Possible values are: skip, realm_file,
same_file, different_files. Default: different_files.
--users-per-file <number>
Set the number of users per file. It?s used only if --users=different_files.
Default: 50.
I’m also wondering where (or why) the docs are gone and not being updated.
Hello,
thanks for the answer
I understand how it will be possible to do the export once the container is running by calling kc.sh export through docker exec.
But the import of the realm needs to be done automatically when the container is started (which was the case when passing KEYCLOAK_IMPORT environment variable to the docker run command), so calling manually kc.sh import through docker exec is not a solution
Since --import-realm skips import operation if realm already exists, what is the recommended way to do incremental updates to an existing realm (Specially using a container distribution mode)?
Hi, what about export, it seems that export is no more supported, we used to export data with a command-line similar to this:
docker run -it --rm
–name authenticate
–net keycloak-network
–entrypoint=’’
-v “${NEW_CONFIGURATION}”:/config.json
-e KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
-e KC_DB_USERNAME=keycloak
-e KC_DB_PASSWORD=password
Hi Dasniko, thank you for pointing out the documentation, unfortunately for me it is not working, in fact keycloak tries to connect to the database with user “sa” despite the KC_DB_USERNAME environment variable:
HHH000342: Could not obtain connection to query metadata: org.postgresql.util.PSQLException: FATAL: password authentication failed for user “sa”
Hi, the main issue I believe was that the admin account was needed to import and was not created (fresh install + import).
All you need to do is carefully review your script making sure that all variables don’t have any typo and that KEYCLOAK_ADMIN and KEYCLOAK_ADMIN_PASSWORD have correct values.
For example for import this can be:
docker run -it --rm \
–entrypoint=’’ \
-v “$KEYCLOAK_CONFIGURATION_JSON”:/config.json \
-e LOG_LEVEL=INFO \
-e HOST_IP=127.0.0.1 \
-e KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak \
-e KC_DB_USERNAME=sa \
-e KC_DB_PASSWORD=password \
-e KEYCLOAK_ADMIN=${ADMNIN} \
-e KEYCLOAK_ADMIN_PASSWORD=${ADMIN_PWD} \
myimageofkeycloak \
/busybox/sh /opt/keycloak/bin/kc.sh \
import --file /config.json
Sorry to come back and bother you, but the solution I found is not satisfying as it uses well-known login/password for the database connection.
I’m using keycloak in cluster environment, so I first build the docker image specifying --db=postgres option.
But when I want to run the “import” command, it does not allow me to specify the db command line option, it complains about unsupported options.
When I run the “import” command without db command line option it complains about:
‘Could not obtain connection to query metadata: org.postgresql.util.PSQLException: FATAL: password authentication failed for user “sa”’
Is this a bug in keycloak ?
I have to mention that i am using clustered keycloak in a distroless environment, so I can’t use shell commands, I have to launch java with its full list of arguments. Also the admin UI is not bundled in the application which leaves me with the only option to import realms from the command line.
I have been using the import feature with Keycloak 18.
You either:
prepare a custom image where you ran the kc.sh build as a dockerfile step and set ENTRYPOINT ["/opt/keycloak/bin/kc.sh","start", "--import-realm"]
Your realm files should be at /opt/keycloak/data/import/
Use the official image with a custom entrypoint script where you kc.sh build and them kc.sh start --import-realm
