kokuwaio/keycloak-event-metrics
kokuwaio/keycloak-event-metrics
1
0
Fork 0
Code Issues 1 Pull requests Releases 7 Activity

First draft of implementation

Browse source 
Readme will follow
This commit is contained in:
Stephan Schnabel 2023-03-03 00:08:20 +01:00
parent dc38b3715e
commit 932ca84352
Signed by: stephan.schnabel
GPG key ID: E07AF5BA239FE543
23 changed files with 1322 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/main/java/io/kokuwa/keycloak/metrics/MicrometerEventListener.java Normal file
View file

@ -0,0 +1,32 @@
package io.kokuwa.keycloak.metrics;
import org.keycloak.events.Event;
import org.keycloak.events.EventListenerProvider;
import org.keycloak.events.admin.AdminEvent;
/**
* Listener for {@link Event} and {@link AdminEvent}.
*
* @author Stephan Schnabel
*/
public class MicrometerEventListener implements EventListenerProvider, AutoCloseable {
private final MicrometerEventRecorder recorder;
MicrometerEventListener(MicrometerEventRecorder recorder) {
this.recorder = recorder;
}
@Override
public void onEvent(Event event) {
recorder.userEvent(event);
}
@Override
public void onEvent(AdminEvent event, boolean includeRepresentation) {
recorder.adminEvent(event);
}
@Override
public void close() {}
}

42
src/main/java/io/kokuwa/keycloak/metrics/MicrometerEventListenerFactory.java Normal file
View file

@ -0,0 +1,42 @@
package io.kokuwa.keycloak.metrics;
import javax.enterprise.inject.spi.CDI;
import org.keycloak.Config.Scope;
import org.keycloak.events.EventListenerProvider;
import org.keycloak.events.EventListenerProviderFactory;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import io.micrometer.core.instrument.MeterRegistry;
/**
* Factory for {@link MicrometerEventListener}, uses {@link MeterRegistry} from CDI.
*
* @author Stephan Schnabel
*/
public class MicrometerEventListenerFactory implements EventListenerProviderFactory {
private MicrometerEventRecorder recorder;
@Override
public String getId() {
return "micrometer-event-listener";
}
@Override
public void init(Scope config) {}
@Override
public void postInit(KeycloakSessionFactory factory) {
recorder = new MicrometerEventRecorder(CDI.current().select(MeterRegistry.class).get());
}
@Override
public EventListenerProvider create(KeycloakSession session) {
return new MicrometerEventListener(recorder);
}
@Override
public void close() {}
}

32
src/main/java/io/kokuwa/keycloak/metrics/MicrometerEventListenerSpi.java Normal file
View file

@ -0,0 +1,32 @@
package io.kokuwa.keycloak.metrics;
import org.keycloak.events.EventListenerSpi;
import org.keycloak.provider.Provider;
/**
* Factory for {@link MicrometerEventListener}.
*
* @author Stephan Schnabel
*/
public class MicrometerEventListenerSpi extends EventListenerSpi {
@Override
public boolean isInternal() {
return false;
}
@Override
public String getName() {
return "Micrometer Metrics Provider";
}
@Override
public Class<? extends Provider> getProviderClass() {
return MicrometerEventListener.class;
}
@Override
public Class<MicrometerEventListenerFactory> getProviderFactoryClass() {
return MicrometerEventListenerFactory.class;
}
}

102
src/main/java/io/kokuwa/keycloak/metrics/MicrometerEventRecorder.java Normal file
View file

@ -0,0 +1,102 @@
package io.kokuwa.keycloak.metrics;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.Optional;
import org.keycloak.events.Event;
import org.keycloak.events.admin.AdminEvent;
import io.micrometer.core.instrument.Counter;
import io.micrometer.core.instrument.MeterRegistry;
/**
* Micrometer based recorder for events.
*
* @author Stephan Schnabel
*/
public class MicrometerEventRecorder {
private static final String PREFIX = "keycloak_";
private static final String USER_EVENT_PREFIX = PREFIX + "user_event_";
private static final String ADMIN_EVENT_PREFIX = PREFIX + "admin_event_";
private static final String LOGIN_ATTEMPTS = PREFIX + "login_attempts";
private static final String LOGIN_SUCCESS = PREFIX + "logins";
private static final String LOGIN_FAILURE = PREFIX + "failed_login_attempts";
private static final String CLIENT_LOGIN_SUCCESS = PREFIX + "client_logins";
private static final String CLIENT_LOGIN_FAILURE = PREFIX + "failed_client_login_attempts";
private static final String REGISTER_SUCCESS = PREFIX + "registrations";
private static final String REGISTER_FAILURE = PREFIX + "registrations_errors";
private static final String REFRESH_TOKEN_SUCCESS = PREFIX + "refresh_tokens";
private static final String REFRESH_TOKEN_FAILURE = PREFIX + "refresh_tokens_errors";
private static final String CODE_TO_TOKEN_SUCCESS = PREFIX + "code_to_tokens";
private static final String CODE_TO_TOKEN_FAILURE = PREFIX + "code_to_tokens_errors";
private final Map<String, Counter> counters = new HashMap<>();
private final MeterRegistry registry;
MicrometerEventRecorder(MeterRegistry registry) {
this.registry = registry;
}
void adminEvent(AdminEvent event) {
counter(ADMIN_EVENT_PREFIX + event.getOperationType().name(),
"realm", event.getRealmId(),
"resource", event.getResourceType() == null ? "" : event.getResourceType().name());
}
void userEvent(Event event) {
var tags = new String[] {
"provider", Optional
.ofNullable(event.getDetails()).orElseGet(Map::of)
.getOrDefault("identity_provider", "keycloak"),
"realm", event.getRealmId() == null ? "" : event.getRealmId(),
"client_id", event.getClientId() == null ? "" : event.getClientId(),
"error", event.getError() == null ? "" : event.getError() };
switch (event.getType()) {
case LOGIN:
counter(LOGIN_ATTEMPTS, tags);
counter(LOGIN_SUCCESS, tags);
break;
case LOGIN_ERROR:
counter(LOGIN_ATTEMPTS, tags);
counter(LOGIN_FAILURE, tags);
break;
case CLIENT_LOGIN:
counter(CLIENT_LOGIN_SUCCESS, tags);
break;
case CLIENT_LOGIN_ERROR:
counter(CLIENT_LOGIN_FAILURE, tags);
break;
case REGISTER:
counter(REGISTER_SUCCESS, tags);
break;
case REGISTER_ERROR:
counter(REGISTER_FAILURE, tags);
break;
case REFRESH_TOKEN:
counter(REFRESH_TOKEN_SUCCESS, tags);
break;
case REFRESH_TOKEN_ERROR:
counter(REFRESH_TOKEN_FAILURE, tags);
break;
case CODE_TO_TOKEN:
counter(CODE_TO_TOKEN_SUCCESS, tags);
break;
case CODE_TO_TOKEN_ERROR:
counter(CODE_TO_TOKEN_FAILURE, tags);
break;
default:
counter(USER_EVENT_PREFIX + event.getType().name(), tags);
}
}
private void counter(String counter, String... tags) {
counters.computeIfAbsent(counter + Arrays.toString(tags), string -> registry.counter(counter, tags))
.increment();
}
}

1
src/main/resources/META-INF/services/org.keycloak.events.EventListenerProviderFactory Normal file
View file

@ -0,0 +1 @@
io.kokuwa.keycloak.metrics.MicrometerEventListenerFactory

1
src/main/resources/META-INF/services/org.keycloak.events.EventListenerSpi Normal file
View file

@ -0,0 +1 @@
io.kokuwa.keycloak.metrics.MicrometerEventListenerSpi

74
src/test/java/io/kokuwa/keycloak/metrics/KeycloakIT.java Normal file
View file

@ -0,0 +1,74 @@
package io.kokuwa.keycloak.metrics;
import static org.junit.jupiter.api.Assertions.assertAll;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import java.util.UUID;
import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import io.kokuwa.keycloak.metrics.junit.KeycloakClient;
import io.kokuwa.keycloak.metrics.junit.KeycloakExtension;
import io.kokuwa.keycloak.metrics.prometheus.Prometheus;
@ExtendWith(KeycloakExtension.class)
public class KeycloakIT {
@DisplayName("login and attempts")
@Test
void loginAndAttempts(KeycloakClient keycloak, Prometheus prometheus) {
var realmName1 = UUID.randomUUID().toString();
var username1 = UUID.randomUUID().toString();
var password1 = UUID.randomUUID().toString();
var realmName2 = UUID.randomUUID().toString();
var username2 = UUID.randomUUID().toString();
var password2 = UUID.randomUUID().toString();
var realmId1 = keycloak.createRealm(realmName1);
var realmId2 = keycloak.createRealm(realmName2);
keycloak.createUser(realmName1, username1, password1);
keycloak.createUser(realmName2, username2, password2);
prometheus.scrap();
var loginAttemptsBefore = prometheus.loginAttempts();
var loginAttemptsBefore1 = prometheus.loginAttempts(realmId1);
var loginAttemptsBefore2 = prometheus.loginAttempts(realmId2);
var loginSuccessBefore = prometheus.loginSuccess();
var loginSuccessBefore1 = prometheus.loginSuccess(realmId1);
var loginSuccessBefore2 = prometheus.loginSuccess(realmId2);
var loginFailureBefore = prometheus.loginFailure();
var loginFailureBefore1 = prometheus.loginFailure(realmId1);
var loginFailureBefore2 = prometheus.loginFailure(realmId2);
assertTrue(keycloak.login(realmName1, username1, password1));
assertTrue(keycloak.login(realmName1, username1, password1));
assertTrue(keycloak.login(realmName2, username2, password2));
assertFalse(keycloak.login(realmName2, username2, "nope"));
prometheus.scrap();
var loginAttemptsAfter = prometheus.loginAttempts();
var loginAttemptsAfter1 = prometheus.loginAttempts(realmId1);
var loginAttemptsAfter2 = prometheus.loginAttempts(realmId2);
var loginSuccessAfter = prometheus.loginSuccess();
var loginSuccessAfter1 = prometheus.loginSuccess(realmId1);
var loginSuccessAfter2 = prometheus.loginSuccess(realmId2);
var loginFailureAfter = prometheus.loginFailure();
var loginFailureAfter1 = prometheus.loginFailure(realmId1);
var loginFailureAfter2 = prometheus.loginFailure(realmId2);
assertAll("promethus",
() -> assertEquals(loginAttemptsBefore + 4, loginAttemptsAfter, "login attempts total"),
() -> assertEquals(loginAttemptsBefore1 + 2, loginAttemptsAfter1, "login attempts #1"),
() -> assertEquals(loginAttemptsBefore2 + 2, loginAttemptsAfter2, "login attempts #2"),
() -> assertEquals(loginSuccessBefore + 3, loginSuccessAfter, "login success total"),
() -> assertEquals(loginSuccessBefore1 + 2, loginSuccessAfter1, "login success #1"),
() -> assertEquals(loginSuccessBefore2 + 1, loginSuccessAfter2, "login success #2"),
() -> assertEquals(loginFailureBefore + 1, loginFailureAfter, "login failure total"),
() -> assertEquals(loginFailureBefore1 + 0, loginFailureAfter1, "login failure #1"),
() -> assertEquals(loginFailureBefore2 + 1, loginFailureAfter2, "login failure #2"));
}
}

72
src/test/java/io/kokuwa/keycloak/metrics/junit/KeycloakClient.java Normal file
View file

@ -0,0 +1,72 @@
package io.kokuwa.keycloak.metrics.junit;
import java.util.List;
import java.util.Map;
import javax.ws.rs.NotAuthorizedException;
import javax.ws.rs.core.MultivaluedHashMap;
import org.keycloak.OAuth2Constants;
import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.token.TokenService;
import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.representations.idm.CredentialRepresentation;
import org.keycloak.representations.idm.RealmRepresentation;
import org.keycloak.representations.idm.UserRepresentation;
/**
* Client for keycloak.
*
* @author Stephan Schnabel
*/
public class KeycloakClient {
private final Keycloak keycloak;
private final TokenService token;
KeycloakClient(Keycloak keycloak, TokenService token) {
this.keycloak = keycloak;
this.token = token;
}
public String createRealm(String realmName) {
var client = new ClientRepresentation();
client.setClientId("test");
client.setPublicClient(true);
client.setDirectAccessGrantsEnabled(true);
var realm = new RealmRepresentation();
realm.setEnabled(true);
realm.setRealm(realmName);
realm.setEventsListeners(List.of("micrometer-event-listener"));
realm.setClients(List.of(client));
keycloak.realms().create(realm);
return keycloak.realms().realm(realmName).toRepresentation().getId();
}
public void createUser(String realmName, String username, String password) {
var credential = new CredentialRepresentation();
credential.setType(CredentialRepresentation.PASSWORD);
credential.setValue(password);
credential.setTemporary(false);
var user = new UserRepresentation();
user.setEnabled(true);
user.setEmail(username + "@example.org");
user.setEmailVerified(true);
user.setUsername(username);
user.setCredentials(List.of(credential));
keycloak.realms().realm(realmName).users().create(user);
}
public boolean login(String realmName, String username, String password) {
try {
token.grantToken(realmName, new MultivaluedHashMap<>(Map.of(
OAuth2Constants.CLIENT_ID, "test",
OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD,
OAuth2Constants.USERNAME, username,
OAuth2Constants.PASSWORD, password)));
return true;
} catch (NotAuthorizedException e) {
return false;
}
}
}

95
src/test/java/io/kokuwa/keycloak/metrics/junit/KeycloakExtension.java Normal file
View file

@ -0,0 +1,95 @@
package io.kokuwa.keycloak.metrics.junit;
import static org.junit.jupiter.api.Assertions.assertEquals;
import java.io.IOException;
import java.time.Duration;
import java.util.Properties;
import java.util.Set;
import javax.ws.rs.client.ClientBuilder;
import org.junit.jupiter.api.extension.BeforeAllCallback;
import org.junit.jupiter.api.extension.ExtensionContext;
import org.junit.jupiter.api.extension.ParameterContext;
import org.junit.jupiter.api.extension.ParameterResolver;
import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.token.TokenService;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.utility.MountableFile;
import io.kokuwa.keycloak.metrics.prometheus.Prometheus;
import io.kokuwa.keycloak.metrics.prometheus.PrometheusClient;
/**
* JUnit extension to start keycloak.
*
* @author Stephan Schnabel
*/
public class KeycloakExtension implements BeforeAllCallback, ParameterResolver {
private static KeycloakClient client;
private static Prometheus prometheus;
@Override
public void beforeAll(ExtensionContext context) throws Exception {
if (client != null) {
return;
}
// get test properties
var properties = new Properties();
try {
properties.load(getClass().getResourceAsStream("/test.properties"));
} catch (IOException e) {
throw new Exception("Failed to read properties", e);
}
var version = properties.getProperty("version");
var jar = properties.getProperty("jar");
var timeout = properties.getProperty("timeout");
// create and start container
@SuppressWarnings("resource")
var container = new GenericContainer<>("quay.io/keycloak/keycloak:" + version)
.withEnv("KEYCLOAK_ADMIN", "admin")
.withEnv("KEYCLOAK_ADMIN_PASSWORD", "password")
.withEnv("KC_LOG_CONSOLE_COLOR", "true")
.withEnv("KC_HEALTH_ENABLED", "true")
.withEnv("KC_METRICS_ENABLED", "true")
.withCopyFileToContainer(MountableFile.forHostPath(jar), "/opt/keycloak/providers/metrics.jar")
.withLogConsumer(out -> System.out.print(out.getUtf8String()))
.withExposedPorts(8080)
.withStartupTimeout(Duration.parse(timeout))
.waitingFor(Wait.forHttp("/health").forPort(8080))
.withCommand("start-dev");
try {
container.start();
} catch (RuntimeException e) {
throw new Exception("Failed to start keycloak", e);
}
// create client for keycloak container
var url = "http://" + container.getHost() + ":" + container.getMappedPort(8080);
var keycloak = Keycloak.getInstance(url, "master", "admin", "password", "admin-cli");
assertEquals(version, keycloak.serverInfo().getInfo().getSystemInfo().getVersion(), "version invalid");
var target = ClientBuilder.newClient().target(url);
var token = Keycloak.getClientProvider().targetProxy(target, TokenService.class);
prometheus = new Prometheus(Keycloak.getClientProvider().targetProxy(target, PrometheusClient.class));
client = new KeycloakClient(keycloak, token);
}
@Override
public boolean supportsParameter(ParameterContext parameterContext, ExtensionContext extensionContext) {
return Set.of(KeycloakClient.class, Prometheus.class).contains(parameterContext.getParameter().getType());
}
@Override
public Object resolveParameter(ParameterContext parameterContext, ExtensionContext extensionContext) {
return parameterContext.getParameter().getType().equals(KeycloakClient.class) ? client : prometheus;
}
}

81
src/test/java/io/kokuwa/keycloak/metrics/prometheus/Prometheus.java Normal file
View file

@ -0,0 +1,81 @@
package io.kokuwa.keycloak.metrics.prometheus;
import java.util.HashSet;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.stream.Collectors;
import java.util.stream.Stream;
/**
* Client to access Prometheus metric values:
*
* @author Stephan Schnabel
*/
public class Prometheus {
private final Set<PrometheusMetric> state = new HashSet<>();
private final PrometheusClient client;
public Prometheus(PrometheusClient client) {
this.client = client;
}
public int loginAttempts() {
return scrap("keycloak_login_attempts_total").intValue();
}
public int loginAttempts(String realmName) {
return scrap("keycloak_login_attempts_total", "realm", realmName).intValue();
}
public int loginSuccess() {
return scrap("keycloak_logins_total").intValue();
}
public int loginSuccess(String realmName) {
return scrap("keycloak_logins_total", "realm", realmName).intValue();
}
public int loginFailure() {
return scrap("keycloak_failed_login_attempts_total").intValue();
}
public int loginFailure(String realmName) {
return scrap("keycloak_failed_login_attempts_total", "realm", realmName).intValue();
}
public void scrap() {
state.clear();
Stream.of(client.scrap().split("[\\r\\n]+"))
.filter(line -> !line.startsWith("#"))
.filter(line -> line.startsWith("keycloak"))
.map(line -> {
var name = line.substring(0, line.contains("{") ? line.indexOf("{") : line.lastIndexOf(" "));
var tags = line.contains("{")
? Stream.of(line.substring(line.indexOf("{") + 1, line.indexOf("}")).split(","))
.map(tag -> tag.split("="))
.filter(tag -> tag.length >= 2)
.collect(Collectors.toMap(tag -> tag[0], tag -> tag[1].replace("\"", "")))
: Map.<String, String>of();
var value = Double.parseDouble(line.substring(line.lastIndexOf(" ")));
return new PrometheusMetric(name, tags, value);
})
.forEach(state::add);
}
private Double scrap(String name) {
return state.stream()
.filter(metric -> Objects.equals(metric.name(), name))
.mapToDouble(PrometheusMetric::value)
.sum();
}
private Double scrap(String name, String tag, String value) {
return state.stream()
.filter(metric -> Objects.equals(metric.name(), name))
.filter(metric -> Objects.equals(metric.tags().get(tag), value))
.mapToDouble(PrometheusMetric::value)
.sum();
}
}

19
src/test/java/io/kokuwa/keycloak/metrics/prometheus/PrometheusClient.java Normal file
View file

@ -0,0 +1,19 @@
package io.kokuwa.keycloak.metrics.prometheus;
import javax.ws.rs.Consumes;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.core.MediaType;
/**
* JAX-RS client for prometheus endpoint.
*
* @author Stephan Schnabel
*/
public interface PrometheusClient {
@GET
@Path("/metrics")
@Consumes(MediaType.TEXT_PLAIN)
String scrap();
}

13
src/test/java/io/kokuwa/keycloak/metrics/prometheus/PrometheusMetric.java Normal file
View file

@ -0,0 +1,13 @@
package io.kokuwa.keycloak.metrics.prometheus;
import java.util.Map;
/**
* Represents a parsed Prometheus line.
*
* @author Stephan Schnabel
* @param name Metric name
* @param tags Tags for this metriv value
* @param value Metric value
*/
public record PrometheusMetric(String name, Map<String, String> tags, Double value) {}

3
src/test/resources/test.properties Normal file
View file

@ -0,0 +1,3 @@
version=${version.org.keycloak}
timeout=PT5m
jar=${project.build.directory}/${project.build.finalName}.jar