<div dir="ltr">Can you please elaborate a bit more on how your are testing scenario is? I'm a bit confused to what you are testing when you are talking about generating new tokens. Are you using OIDC or SAML? Are you talking about code->token exchanges, refresh token requests, or what?<div><div><br></div><div>To test if your hardware is capable to deal with the load you need to test logins (verifying passwords are CPU intensive) as well as obtaining tokens (both code->token, done after login, and refreshing token, done ~1 min or so by active users, but most users won't continuously use the application).<br><div><br></div><div>500 users should be no problem at all. As an example with a single thread (which will use a single core) I could invoke 10000 token refreshes in under 60 seconds on my laptop. So a single core on my laptop should be able to handle 500 users.</div><div><div class="gmail_extra"><br><div class="gmail_quote">On 20 May 2016 at 08:00, Vaibhav Naldurgkar <span dir="ltr"><<a href="mailto:vaibhav_naldurgkar@persistent.com" target="_blank">vaibhav_naldurgkar@persistent.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Hi Stian,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thank you for your reply.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">The new tokens needs to be generated for each user, which is needed from security point of view. The performance tests were also conducted using single Admin
user and token for admin user; however in that case the performance was not good. In between 15th to 20th admin token access requests – the CPU usage of keycloak Java process was crossing 90 to 120% mark.</span></p></div></div></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">As you have mentioned, Creating tokes are expected to be a bit CPU intensive – what should be the server configuration in terms of CPU to deal with more than
500 users to use keycloak as OAuth provider.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks, Vaibhav<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Stian Thorgersen [mailto:<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>]
<br>
<b>Sent:</b> Thursday, May 19, 2016 6:28 PM<br>
<b>To:</b> Vaibhav Naldurgkar<br>
<b>Cc:</b> <a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<b>Subject:</b> Re: [keycloak-user] Keycloak OAuth High CPU usage<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Creating tokes are expected to be a bit CPU intensive as they need to be signed. When you say you try to generate tokens for 10-20 users are you doing performance tests and having 10-20 threads generating tokens? It shouldn't make any difference
if you have 10 or if you have 200 users, it's the total number of tokens that can be generated that's an issue. Having 200 concurrent users with a access token timeout of 60 seconds should mean that you need to be able to generate roughly 200/60 tokens = 3.3
tokens/sec.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On 19 May 2016 at 13:24, Vaibhav Naldurgkar <<a href="mailto:vaibhav_naldurgkar@persistent.com" target="_blank">vaibhav_naldurgkar@persistent.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399">Hi All,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399">I am using Keycloak 1.9.3 with default configuration. Keycloak server is installed on RHEL 6.5 virtual image with 4 CPU , 8 GB RAM and
java version is jdk1.8.0_73 We are trying to use keycloak as a OAuth provider. But when we try and generate token(<a href="http://auth/realms/master/protocol/openid-connect/token" target="_blank">http:///auth/realms/master/protocol/openid-connect/token</a>) for more than
10-20 users the server gets too slow and cpu usage goes over 100%.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399">Any pointers on how to improve performance of keycloak OAuth provider. We need to support at least 200 concurrent users.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#333399">Thanks, Vaibhav</span><u></u><u></u></p>
</div>
<p>DISCLAIMER ========== This e-mail may contain privileged and confidential information which is the property of Persistent Systems Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient,
you are not authorized to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Ltd. does not accept any liability for
virus infected mails. <u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div><div><div class="h5">
<p>DISCLAIMER
==========
This e-mail may contain privileged and confidential information which is the property of Persistent Systems Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you are not authorized to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Ltd. does not accept any liability for virus infected mails.
</p>
</div></div></div>
</blockquote></div><br></div></div></div></div></div>