Upgrade Keycloak to v26.4.0

[slominskir]

Upgrade to Keycloak 26.0.7 is stalled in production because the Oracle database is too old. Keycloak won't start with error:

ERROR: Persistence unit 'keycloak-default' was configured to run with a database version of at least '19.0.0', but the actual version is '18.0.0'.

The Oracle container used for testing is erroneously a newer version than actually exists in production and onsite test.

The options include:

1. Wait until our ACE production Oracle instance is updated (could be a long while)
2. Spin up a custom database just for Keycloak (doesn't even have to be Oracle)
3. Try to use our central ACE MySQL database instead (drop Oracle config scripts and knowledge and create all new)
4. Hack Keycloak to ignore Oracle version check (might not work if newer Oracle features are actually used)

Note: Oracle 18 is EOL

[theojlab]

As soon as I get a block of time, I'll start looking at feasibility of upgrading proddb01 from Oracle 18 to 19 in advance of the hardware move. It might turn out to be the best path. Since it is the LTS release preceding 23 LTS it looks like Oracle would give the option of upgrading in lieu of export/import. Option 1 Export Oracle 18 Databases on RHEL7 Shutdown Database on RHEL7 Copy exported data to RHEL9 Import into Oracle 23 Option 2. Sooner: Upgrade databases 18 -> 19 on RHEL7 Later: Shutdown Oracle DB on RHEL7 Rsync files to RHEL9 Run Database Upgrade Tool to go from 19 -> 23 Done. Option 3 Mix-and-match. Proddb01 using Option 1 and *ED databases using Option 2. From: Ryan Slominski ***@***.***> Sent: Thursday, January 9, 2025 10:53 AM To: JeffersonLab/keycloak ***@***.***> Cc: Subscribed ***@***.***> Subject: [EXTERNAL] [JeffersonLab/keycloak] Keycloak v26.0.7 requires Oracle > 18 (Issue #6) Upgrade to Keycloak 26.0.7 is stalled in production because the Oracle database is too old. Keycloak won't start with error: ERROR: Persistence unit 'keycloak-default' was configured to run with a database version of at least '19.0.0', but the actual version is '18.0.0'. The Oracle container used for testing is erroneously a newer version than actually exists in production. The options include: 1. Wait until our ACE production Oracle instance is updated (could be a long while) 2. Spin up a custom database just for Keycloak (doesn't even have to be Oracle) 3. Hack Keycloak to ignore Oracle version check<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_keycloak_keycloak_discussions_35279-23discussioncomment-2D11619520&d=DwMCaQ&c=CJqEzB1piLOyyvZjb8YUQw&r=Fs-jr7drgXeN3no4STnYSA&m=E3mtpKHlEyN3wXUgTxVGgATipuAE4xr77VkgaIFMGAVnFNF5S4vRn3aXvWQkbKoI&s=CbPsv8yWMVp3nfY8CSbG6qDKYJjp-SMF9HZoA29Wak4&e=> (might not work if newer Oracle features are actually used) — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_JeffersonLab_keycloak_issues_6&d=DwMCaQ&c=CJqEzB1piLOyyvZjb8YUQw&r=Fs-jr7drgXeN3no4STnYSA&m=E3mtpKHlEyN3wXUgTxVGgATipuAE4xr77VkgaIFMGAVnFNF5S4vRn3aXvWQkbKoI&s=_xiY4y_NMHncFWtJnG396xA2uJv3KrE077RospYlhUM&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AEKHGO277SO5HA5BUZAPKJ32J2LOHAVCNFSM6AAAAABU4PC5ZKVHI2DSMVQWIX3LMV43ASLTON2WKOZSG43TQMJZGAYTINY&d=DwMCaQ&c=CJqEzB1piLOyyvZjb8YUQw&r=Fs-jr7drgXeN3no4STnYSA&m=E3mtpKHlEyN3wXUgTxVGgATipuAE4xr77VkgaIFMGAVnFNF5S4vRn3aXvWQkbKoI&s=-XHeVDoUJ75YtKuc8DPIQ-TILA4OGkn7Vlj-oDqZS5o&e=>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[slominskir]

Probably unrelated, but it's possible CloudFlare has decided Keycloak 21 is too old to try to protect. See: INC0549702