Re: [keycloak-dev] Realm cache
On 12/3/2015 7:50 AM, Stian Thorgersen wrote:
There's still some outstanding issues with the realm cache. It
works,
but can and should be improved for 1.8.
One issue was that once the realm is updated any methods on clients,
roles or groups returns the underlying adapter instead of the cache
adapters. As a work around in 1.7 it now ejects all clients for a realm
when it sees any changes.
Why is that a bad thing? Usually, roles groups, and clients are not
accessed in the same session as a realm update. Realms are usually not
updated. Client registration/unregistration is rare too for most apps.
The vast majority (90%+?) of access is read-only for realms and clients.
We have a few potential ways to solve this:
a) try to always return cache adapters - I went down this road attacking
it from a few different approaches, but was never successful as there
was always something that didn't work
See above, I don't think this is an issue. What we should do is
identify if any updates are performed on realms/clients per login/token
refresh and remove or isolate them so that the realm/client caches
aren't invalidated.
b) only cache realms and have everything else hang off it - this is
my
preferred option for now. As long as updating clients requires
invalidating the realm it seems a bit over the top to have separate
caches for everything
Why can't you keep it as it is?
RealmAdapter.getDelegateForUpdate() always registers a realm
invalidation. add/remove client are methods on RealmModel so the realm
cache was always invalidated. The only time you need to invalidate the
realm is when clientId is changed.
c) make the cache smarter - instead of invalidating a realm, make
sure
we add/remove the clients, etc..
Its an invalidation cache, so "C" won't work unless you have a separate
cache for the client list. So you'd need a realm cache, client list
cache, and client cache.
We also need more automated testing around clustering. Late in 1.7
release process I identified that caches where invalidated when other
nodes loaded things to it, so effectively the cache wasn't working at
all in a cluster.
Thoughts?
I think this is a bit of effort for little gain. users will only see a
difference if there is a lot of realm adminstration happening.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com