Provide DB SQL options support for additional datasources (#41223)

* Provide DB SQL options support for additional datasources Closes #41222 Co-authored-by: Steven Hawkins <shawkins@redhat.com> Signed-off-by: Martin Bartoš <mabartos@redhat.com> * Rename resultNamedKey to namedKey Signed-off-by: Martin Bartoš <mabartos@redhat.com> --------- Signed-off-by: Martin Bartoš <mabartos@redhat.com> Co-authored-by: Steven Hawkins <shawkins@redhat.com>
2026-01-09 23:12:06 -03:30 · 2025-07-18 10:13:55 +02:00 · 2025-07-18 10:13:55 +02:00 · 744e031019
commit 744e031019
parent 631aebd848
23 changed files with 216 additions and 34 deletions
--- a/quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java
@ -116,21 +116,23 @@ public class DatabaseOptions {
     * Example: for `db-dialect`, `db-dialect-<datasource>` is created
     */
    public static final List<Option<?>> OPTIONS_DATASOURCES = List.of(
-            DatabaseOptions.DB_DIALECT,
-            DatabaseOptions.DB_DRIVER,
-            DatabaseOptions.DB,
-            DatabaseOptions.DB_URL,
-            DatabaseOptions.DB_URL_HOST,
-            DatabaseOptions.DB_URL_DATABASE,
-            DatabaseOptions.DB_URL_PORT,
-            DatabaseOptions.DB_URL_PROPERTIES,
-            DatabaseOptions.DB_USERNAME,
-            DatabaseOptions.DB_PASSWORD,
-            DatabaseOptions.DB_SCHEMA,
-            DatabaseOptions.DB_POOL_INITIAL_SIZE,
-            DatabaseOptions.DB_POOL_MIN_SIZE,
-            DatabaseOptions.DB_POOL_MAX_SIZE
-    );
+            DB_DIALECT,
+            DB_DRIVER,
+            DB,
+            DB_URL,
+            DB_URL_HOST,
+            DB_URL_DATABASE,
+            DB_URL_PORT,
+            DB_URL_PROPERTIES,
+            DB_USERNAME,
+            DB_PASSWORD,
+            DB_SCHEMA,
+            DB_POOL_INITIAL_SIZE,
+            DB_POOL_MIN_SIZE,
+            DB_POOL_MAX_SIZE,
+            DB_SQL_JPA_DEBUG,
+            DB_SQL_LOG_SLOW_QUERIES
+            );

    /**
     * In order to avoid ambiguity, we need to have unique option names for wildcard options.
@ -208,7 +210,7 @@ public class DatabaseOptions {
     * <p>
     * Result: {@code db-driver-my-store}
     */
-    public static Optional<String> getResultNamedKey(Option<?> option, String namedProperty) {
+    public static Optional<String> getNamedKey(Option<?> option, String namedProperty) {
        return getKeyForDatasource(option)
                .map(key -> key.substring(0, key.indexOf("<")))
                .map(key -> key.concat(namedProperty));
--- a/quarkus/config-api/src/main/java/org/keycloak/config/database/Database.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/database/Database.java
@ -278,7 +278,7 @@ public final class Database {

        private static String getProperty(Option<?> option, String namedProperty, String defaultValue) {
            return "${kc.%s:%s}".formatted(StringUtil.isNullOrEmpty(namedProperty) ? option.getKey() :
-                            DatabaseOptions.getResultNamedKey(option, namedProperty).orElseThrow(() -> new IllegalArgumentException("Cannot find the named property")),
+                            DatabaseOptions.getNamedKey(option, namedProperty).orElseThrow(() -> new IllegalArgumentException("Cannot find the named property")),
                    defaultValue);
        }

--- a/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java
+++ b/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java
@ -489,6 +489,14 @@ class KeycloakProcessor {
        // set datasource name
        unitProperties.setProperty(JdbcSettings.JAKARTA_JTA_DATASOURCE,datasourceName);
        unitProperties.setProperty(AvailableSettings.DATASOURCE, datasourceName); // for backward compatibility
+
+        DatabaseOptions.getNamedKey(DatabaseOptions.DB_SQL_JPA_DEBUG, datasourceName)
+                .filter(Configuration::isKcPropertyTrue)
+                .ifPresent(f -> unitProperties.put(AvailableSettings.USE_SQL_COMMENTS, "true"));
+
+        DatabaseOptions.getNamedKey(DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES, datasourceName)
+                .flatMap(Configuration::getOptionalKcValue)
+                .ifPresent(threshold -> unitProperties.put(AvailableSettings.LOG_SLOW_QUERY, threshold));
    }

    private void configureDefaultPersistenceUnitProperties(ParsedPersistenceXmlDescriptor descriptor, HibernateOrmConfig config,
@ -517,11 +525,11 @@ class KeycloakProcessor {
        }

        if (getOptionalBooleanKcValue(DatabaseOptions.DB_SQL_JPA_DEBUG.getKey()).orElse(false)) {
-            unitProperties.put("hibernate.use_sql_comments", "true");
+            unitProperties.put(AvailableSettings.USE_SQL_COMMENTS, "true");
        }

        getOptionalKcValue(DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES.getKey())
-                .ifPresent(v -> unitProperties.put("hibernate.log_slow_query", v));
+                .ifPresent(v -> unitProperties.put(AvailableSettings.LOG_SLOW_QUERY, v));
    }

    private void configureDefaultPersistenceUnitEntities(ParsedPersistenceXmlDescriptor descriptor, CombinedIndexBuildItem indexBuildItem,
--- a/quarkus/deployment/src/test/java/org/keycloak/quarkus/deployment/PersistenceXmlDatasourcesTest.java
+++ b/quarkus/deployment/src/test/java/org/keycloak/quarkus/deployment/PersistenceXmlDatasourcesTest.java
@ -1,11 +1,18 @@
 package org.keycloak.quarkus.deployment;

+import io.smallrye.config.SmallRyeConfig;
 import org.hibernate.cfg.AvailableSettings;
 import org.hibernate.cfg.JdbcSettings;
 import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
 import org.hibernate.jpa.boot.spi.PersistenceXmlParser;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.keycloak.Config;
+import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.quarkus.runtime.configuration.KeycloakConfigSourceProvider;
+import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;

 import java.io.IOException;
 import java.nio.file.Files;
@ -162,6 +169,39 @@ public class PersistenceXmlDatasourcesTest {
        });
    }

+    @Test
+    public void sqlProperties() throws IOException {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-user-store=dev-mem", "--db-debug-jpql-user-store=true", "--db-log-slow-queries-threshold-user-store=7500");
+        initConfig();
+
+        var content = """
+                <persistence-unit name="user-store-pu" transaction-type="JTA">
+                    <properties>
+                        <property name="jakarta.persistence.jtaDataSource" value="user-store" />
+                    </properties>
+                </persistence-unit>
+                """;
+        assertPersistenceXmlSingleDS(content, descriptor -> {
+            configurePersistenceUnitProperties("user-store", descriptor);
+            var properties = descriptor.getProperties();
+
+            assertThat(properties.getProperty(AvailableSettings.USE_SQL_COMMENTS), is("true"));
+            assertThat(properties.getProperty(AvailableSettings.LOG_SLOW_QUERY), is("7500"));
+        });
+    }
+
+    private static void initConfig(){
+        Config.init(new MicroProfileConfigProvider(createConfig()));
+    }
+
+    // inspired in AbstractConfigurationTest in quarkus/runtime
+    private static SmallRyeConfig createConfig() {
+        Configuration.resetConfig();
+        KeycloakConfigSourceProvider.reload();
+        Environment.getCurrentOrCreateFeatureProfile();
+        return Configuration.getConfig();
+    }
+
    private void assertUsedName(String content, String expectedName) throws IOException {
        assertPersistenceXmlSingleDS(content, descriptor -> {
            var name = getDatasourceNameFromPersistenceXml(descriptor);
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/DatabasePropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/DatabasePropertyMappers.java
@ -96,10 +96,8 @@ final class DatabasePropertyMappers {
                        .paramLabel("size")
                        .build(),
                fromOption(DatabaseOptions.DB_SQL_JPA_DEBUG)
-                        .to("kc." + DatabaseOptions.DB_SQL_JPA_DEBUG.getKey())
                        .build(),
                fromOption(DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES)
-                        .to("kc." + DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES.getKey())
                        .paramLabel("milliseconds")
                        .build(),
                fromOption(DatabaseOptions.DB_ACTIVE_DATASOURCE)
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/WildcardPropertyMapper.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/WildcardPropertyMapper.java
@ -46,16 +46,16 @@ public class WildcardPropertyMapper<T> extends PropertyMapper<T> {
            replacementChar = '.';
        }

-        if (to != null) {
-            if (!to.startsWith(NS_QUARKUS_PREFIX) && !to.startsWith(NS_KEYCLOAK_PREFIX)) {
-                throw new IllegalArgumentException("Wildcards should map to Quarkus or Keycloak options (option '%s' mapped to '%s'). If not, PropertyMappers logic will need adjusted".formatted(option.getKey(), to));
+        if (getTo() != null) {
+            if (!getTo().startsWith(NS_QUARKUS_PREFIX) && !getTo().startsWith(NS_KEYCLOAK_PREFIX)) {
+                throw new IllegalArgumentException("Wildcards should map to Quarkus or Keycloak options (option '%s' mapped to '%s'). If not, PropertyMappers logic will need adjusted".formatted(option.getKey(), getTo()));
            }
-            this.toPrefix = to.substring(0, to.indexOf(WILDCARD_FROM_START));
-            int lastIndexOf = to.lastIndexOf(">");
+            this.toPrefix = getTo().substring(0, getTo().indexOf(WILDCARD_FROM_START));
+            int lastIndexOf = getTo().lastIndexOf(">");
            if (lastIndexOf == -1) {
                throw new IllegalArgumentException("Invalid wildcard map to.");
            }
-            this.toSuffix = to.substring(lastIndexOf + 1, to.length());
+            this.toSuffix = getTo().substring(lastIndexOf + 1);
        }

        this.wildcardKeysTransformer = wildcardKeysTransformer;
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/DatasourcesConfigurationTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/DatasourcesConfigurationTest.java
@ -436,4 +436,26 @@ public class DatasourcesConfigurationTest extends AbstractConfigurationTest {
                "quarkus.datasource.\"client.store_123\".password", "password"
        ));
    }
+
+    @Test
+    public void sqlParameters() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-my-store=dev-mem");
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-kind-my-store", "dev-mem",
+                "db-debug-jpql-my-store", "false",
+                "db-log-slow-queries-threshold-my-store", "10000"
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-my-store=dev-mem", "--db-debug-jpql-my-store=true", "--db-log-slow-queries-threshold-my-store=5000");
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-kind-my-store", "dev-mem",
+                "db-debug-jpql-my-store", "true",
+                "db-log-slow-queries-threshold-my-store","5000"
+        ));
+    }
 }
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminService.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminService.approved.txt
@ -74,6 +74,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -83,6 +86,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminUser.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminUser.approved.txt
@ -76,6 +76,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -85,6 +88,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
@ -69,6 +69,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -78,6 +81,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
@ -69,6 +69,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -78,6 +81,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -441,4 +448,4 @@ Bootstrap Admin:
 --bootstrap-admin-username <username>
                     Temporary bootstrap admin username. Used only when the master realm is
                       created. Available only when bootstrap admin password is set. Default:
-                       temp-admin.
+                       temp-admin.
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
@ -69,6 +69,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -78,6 +81,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
@ -69,6 +69,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -78,6 +81,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -435,4 +442,4 @@ Bootstrap Admin:
 --bootstrap-admin-username <username>
                     Temporary bootstrap admin username. Used only when the master realm is
                       created. Available only when bootstrap admin password is set. Default:
-                       temp-admin.
+                       temp-admin.
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
@ -111,6 +111,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -120,6 +123,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
@ -178,6 +178,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -187,6 +190,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -672,4 +679,4 @@ Bootstrap Admin:
 Do NOT start the server using this command when deploying to production.

 Use 'kc.sh start-dev --help-all' to list all available options, including build
-options.
+options.
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
@ -159,6 +159,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -168,6 +171,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
@ -179,6 +179,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -188,6 +191,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -677,4 +684,4 @@ By default, this command tries to update the server configuration by running a
      $ kc.sh start '--optimized'

 By doing that, the server should start faster based on any previous
-configuration you have set when manually running the 'build' command.
+configuration you have set when manually running the 'build' command.
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
@ -153,6 +153,13 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
@ -173,6 +173,13 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -588,4 +595,4 @@ By default, this command tries to update the server configuration by running a
      $ kc.sh start '--optimized'

 By doing that, the server should start faster based on any previous
-configuration you have set when manually running the 'build' command.
+configuration you have set when manually running the 'build' command.
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelp.approved.txt
@ -158,6 +158,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -167,6 +170,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt
@ -178,6 +178,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -187,6 +190,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -667,4 +674,4 @@ Bootstrap Admin:
 --bootstrap-admin-username <username>
                     Temporary bootstrap admin username. Used only when the master realm is
                       created. Available only when bootstrap admin password is set. Default:
-                       temp-admin.
+                       temp-admin.
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelp.approved.txt
@ -156,6 +156,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -165,6 +168,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt
@ -176,6 +176,9 @@ Database - additional datasources (Preview):

 --db-active-<datasource> <true|false>
                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-debug-jpql-<datasource> <true|false>
+                     Preview: Used for named <datasource>. Add JPQL information as comments to SQL
+                       statements to debug JPA SQL statement generation. Default: false.
 --db-driver-<datasource> <driver>
                     Preview: Used for named <datasource>. The fully qualified class name of the
                       JDBC driver. If not set, a default driver is set accordingly to the chosen
@ -185,6 +188,10 @@ Database - additional datasources (Preview):
                       the default value of 'dev-file' is deprecated, you should explicitly specify
                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
                       mysql, oracle, postgres. Default: dev-file.
+--db-log-slow-queries-threshold-<datasource> <milliseconds>
+                     Preview: Used for named <datasource>. Log SQL statements slower than the
+                       configured threshold with logger org.hibernate.SQL_SLOW and log-level info.
+                       Default: 10000.
 --db-password-<datasource> <password>
                     Preview: Used for named <datasource>. The password of the database user.
 --db-pool-initial-size-<datasource> <size>
@ -665,4 +672,4 @@ Bootstrap Admin:
 --bootstrap-admin-username <username>
                     Temporary bootstrap admin username. Used only when the master realm is
                       created. Available only when bootstrap admin password is set. Default:
-                       temp-admin.
+                       temp-admin.