[keycloak-dev] JS policy performance improvements

Pedro Igor Silva psilva at redhat.com
Fri Jun 16 10:42:38 EDT 2017

Btw, we were already planning to cahnge JSPolicyprovider to use Keycloak's
ScriptingSPI. I have some changes at this respect which I was planning to
include to 3.2.0.CR1.

Maybe I can share my changes too, so you can check if they also give you a
better performance. It is basically the same SPI used to write custom
authentication flows.

On Fri, Jun 16, 2017 at 11:10 AM, Pedro Igor Silva <psilva at redhat.com>

> +1. I'm glad to review your changes if you send a PR.
> On Fri, Jun 16, 2017 at 10:46 AM, Jay Anslow <jma at corefiling.com> wrote:
>> Hi all,
>> I'm using the JS Policy to evaluate resource permissions, but we've
>> started to run into some performance problems when using large numbers of
>> resources.
>> However, I've managed to improve the performance of the JSPolicyProvider,
>> by caching the ScriptEngine (creating new bindings per evaluation) and
>> compiling the code on policy update.
>> The "Obtaining Entitlements" operation is now ~5x faster than before, for
>> my test setup (100 test runs, ~1100 resources, remote Postgres).
>> I'd like to merge my changes back to Keycloak, so I just wanted to check
>> if the community would be interested in this change before I prepare a PR
>> and create a JIRA issue.
>> Regards,
>> Jay
>> --
>> Jay Anslow, Product Development, CoreFiling Limited
>> http://www.corefiling.com
>> Phone: +44-1865-203192
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev

More information about the keycloak-dev mailing list