# Keycloak Cluster AWS ECS using JDBC\_PING

**URL:** <https://forum.keycloak.org/t/keycloak-cluster-aws-ecs-using-jdbc-ping/12670>\
**Category:** Getting advice\
**Tags:** clustering\
**Created:** [December 17, 2021, 11:48am UTC](https://forum.keycloak.org/t/keycloak-cluster-aws-ecs-using-jdbc-ping/12670 "2021-12-17T11:48:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![musabqamri](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@musabqamri](https://forum.keycloak.org/u/musabqamri)\
**Post date:** [December 17, 2021, 11:48am UTC](https://forum.keycloak.org/t/keycloak-cluster-aws-ecs-using-jdbc-ping/12670/1 "2021-12-17T11:48:26Z")

</div>

Hi

I am trying to upgrade keycloak from 4.5.0.Final to 15.0.0. We have a cluster setup with standalone-ha using JDBC\_PING sharing common datasource and having aws elb infront(same on 4.5.0 as well as 15.0.0).

Cluster is up as per logs also verified through jgroupping table in db. which has entry for both nodes

But unable to access UI with error similar to

```auto
2017-11-27 14:50:31,587 WARN [org.keycloak.events] (default task-17) type=LOGIN_ERROR, realmId=master, clientId=null, userId=null, ipAddress=aa.bb.cc.dd, error=expired_code, restart_after_timeout=true

```

Hostname provider is default in standalone-ha.xml(frontendUrl,adminUrl is not set)  
[org.keycloak.url.DefaultHostnameProviderFactory] (ServerService Thread Pool – 68) Frontend: , Admin: , Backend:

Single instance is working fine, issue only with cluster

Question : is it necessary to enable sticky session for cluster setup in versions later than 4.5.0.Final as above version is running without sticky sessions?

If not, how would i make my cluster accessible through UI ?

If sticky sessions are necessary,

1. i tried to enable on aws elb with load balancer cookie, but applications using keycloak-admin-client library facing issues, getting invalid bearer token

2. If i enable sticky sessions through AUTH\_SESSION\_ID application cookie, getting infinite redirect with CODE\_TO\_TOKEN\_ERROR - api whoami is failing with 401

i have not set jboss.node.name or stcikySession spi with route as false in config.

Any help is appreciated

---

<div class="post-metadata">

**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\
**Post date:** [December 17, 2021, 5:30pm UTC](https://forum.keycloak.org/t/keycloak-cluster-aws-ecs-using-jdbc-ping/12670/2 "2021-12-17T17:30:18Z")

</div>

You can try setting env var `CACHE_OWNERS` and `CACHE_OWNERS_AUTH_SESSIONS_COUNT` to the number of instances you have.

By default, Infinispan will not maintain a copy of the cache at every node. When a node needs to access the cache, infinispan will query the node with the cache store.

You can check communication between nodes.

Can containers inside ECS freely communicate with one another? If not, how to configure access policies? You can investigate that.

---

<div class="post-metadata">

**Author:** ![musabqamri](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@musabqamri](https://forum.keycloak.org/u/musabqamri)\
**Post date:** [December 20, 2021, 6:59am UTC](https://forum.keycloak.org/t/keycloak-cluster-aws-ecs-using-jdbc-ping/12670/3 "2021-12-20T06:59:32Z")

</div>

Thanks. It started working after setting FRONTEND URL. Also i added the env variable related to cache owners.