4:33 p.m.
Hi there,
We are running a Keycloak instance with quiet a lot of realms (~400 and growing) and are
starting to get into the dreaded scalability issue of the admin console
(https://issues.jboss.org/browse/KEYCLOAK-6096). I’ve been watching the issue for quiet a
while now and you made it clear that this isn’t a top priority at the moment.
The issue is flagged with „Awaiting volunteers“ and I’d love to contribute.
The design proposed by the reporter sounds reasonable. There would have to be some changes
to the whoami-API (which seems to be exclusively used by the console). The Realms-API
would need pagination, which could be kept backwards compatible. There’s already a page in
the admin-ui for realm-selection that we could add pagination to:
https://service-e.tech.visualvest.de/auth/admin/master/console/#/realms
What do you think? Can I go ahead and give it a try?
Thanks,
Gregor
12:25 p.m.
Hi Gregor,
Not a keycloak dev. I just wanted to show my support for your proposal.
Pagination is required in quite a few places. I might be able to pitch in some help.
Currently, realm roles also don't support pagination. This creates issues with lots of
realm roles.
Regards,
Eugen
Eugen Stan
Netdava International
Mesaj original
De la: Gregor.Tudan(a)cofinpro.de
Trimis: 8 iulie 2019 17:34
Către: keycloak-dev(a)lists.jboss.org
Subiect: [keycloak-dev] Scalability Problems with the admin console
Hi there,
We are running a Keycloak instance with quiet a lot of realms (~400 and growing) and are
starting to get into the dreaded scalability issue of the admin console
(https://issues.jboss.org/browse/KEYCLOAK-6096). I’ve been watching the issue for quiet a
while now and you made it clear that this isn’t a top priority at the moment.
The issue is flagged with „Awaiting volunteers“ and I’d love to contribute.
The design proposed by the reporter sounds reasonable. There would have to be some changes
to the whoami-API (which seems to be exclusively used by the console). The Realms-API
would need pagination, which could be kept backwards compatible. There’s already a page in
the admin-ui for realm-selection that we could add pagination to:
https://service-e.tech.visualvest.de/auth/admin/master/console/#/realms
What do you think? Can I go ahead and give it a try?
Thanks,
Gregor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
9:40 a.m.
PRs for this would be more than welcome. It's been a while since I've
looked at this, but there's at least the two issues identified in the
issues, pagination of realms and whoami. Pagination on the realm list page
would be simple enough, but how to do it for the drop-down needs some
consideration. The whoami issue boils down to the fact that the admin can
have a composite role that adds roles for all realms, which quickly can
explode. Not sure how to solve that one as we don't really want to have
some additional admin console specific logic in how composite roles are
resolved.
On Mon, 8 Jul 2019 at 16:34, Gregor Tudan <Gregor.Tudan(a)cofinpro.de> wrote:
Hi there,
We are running a Keycloak instance with quiet a lot of realms (~400 and
growing) and are starting to get into the dreaded scalability issue of the
admin console (https://issues.jboss.org/browse/KEYCLOAK-6096). I’ve been
watching the issue for quiet a while now and you made it clear that this
isn’t a top priority at the moment.
The issue is flagged with „Awaiting volunteers“ and I’d love to contribute.
The design proposed by the reporter sounds reasonable. There would have to
be some changes to the whoami-API (which seems to be exclusively used by
the console). The Realms-API would need pagination, which could be kept
backwards compatible. There’s already a page in the admin-ui for
realm-selection that we could add pagination to:
https://service-e.tech.visualvest.de/auth/admin/master/console/#/realms
What do you think? Can I go ahead and give it a try?
Thanks,
Gregor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
9:41 a.m.
PR for pagination of roles would be great. Let's open a different thread
for that though as Gregor is mostly concerned with scaling to many realms.
On Mon, 15 Jul 2019 at 12:27, Ioan Eugen Stan <ieugen(a)netdava.com> wrote:
Hi Gregor,
Not a keycloak dev. I just wanted to show my support for your proposal.
Pagination is required in quite a few places. I might be able to pitch in
some help.
Currently, realm roles also don't support pagination. This creates issues
with lots of realm roles.
Regards,
Eugen
Eugen Stan
Netdava International
Mesaj original
De la: Gregor.Tudan(a)cofinpro.de
Trimis: 8 iulie 2019 17:34
Către: keycloak-dev(a)lists.jboss.org
Subiect: [keycloak-dev] Scalability Problems with the admin console
Hi there,
We are running a Keycloak instance with quiet a lot of realms (~400 and
growing) and are starting to get into the dreaded scalability issue of the
admin console (https://issues.jboss.org/browse/KEYCLOAK-6096). I’ve been
watching the issue for quiet a while now and you made it clear that this
isn’t a top priority at the moment.
The issue is flagged with „Awaiting volunteers“ and I’d love to contribute.
The design proposed by the reporter sounds reasonable. There would have to
be some changes to the whoami-API (which seems to be exclusively used by
the console). The Realms-API would need pagination, which could be kept
backwards compatible. There’s already a page in the admin-ui for
realm-selection that we could add pagination to:
https://service-e.tech.visualvest.de/auth/admin/master/console/#/realms
What do you think? Can I go ahead and give it a try?
Thanks,
Gregor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
12:20 p.m.
Hi,
Regarding the composite role I believe there should be a limit to how many roles there can
be in a composite role - for practical reasons. Not sure if this will solve the issue
since there is no limit to the depth of the composition. So maybe a limit here might bein
order.
Not sure, but on the current state I think someone might be able to pull a denial of
service attack using the composite roles? They might be sabotaging themselves though :).
There might be another limit on the number of realms a single user can manage.
Another idea:
I've noticed that some IDM ask you to select the account you wish to operate
beforehand.
Maybe this could be used to request the scopes / roles just for that realm.
We have an api that lists the realms.
User selects the realm and asks for a token for that realm only.
We use this pattern in our app secured with keycloak.
Eugen Stan
Netdava International
Mesaj original
De la: sthorger(a)redhat.com
Trimis: 16 iulie 2019 10:42
Către: Gregor.Tudan(a)cofinpro.de
Răsp. la: stian(a)redhat.com
Cc: keycloak-dev(a)lists.jboss.org
Subiect: Re: [keycloak-dev] Scalability Problems with the admin console
PRs for this would be more than welcome. It's been a while since I've
looked at this, but there's at least the two issues identified in the
issues, pagination of realms and whoami. Pagination on the realm list page
would be simple enough, but how to do it for the drop-down needs some
consideration. The whoami issue boils down to the fact that the admin can
have a composite role that adds roles for all realms, which quickly can
explode. Not sure how to solve that one as we don't really want to have
some additional admin console specific logic in how composite roles are
resolved.
On Mon, 8 Jul 2019 at 16:34, Gregor Tudan <Gregor.Tudan(a)cofinpro.de> wrote:
Hi there,
We are running a Keycloak instance with quiet a lot of realms (~400 and
growing) and are starting to get into the dreaded scalability issue of the
admin console (https://issues.jboss.org/browse/KEYCLOAK-6096). I’ve been
watching the issue for quiet a while now and you made it clear that this
isn’t a top priority at the moment.
The issue is flagged with „Awaiting volunteers“ and I’d love to contribute.
The design proposed by the reporter sounds reasonable. There would have to
be some changes to the whoami-API (which seems to be exclusively used by
the console). The Realms-API would need pagination, which could be kept
backwards compatible. There’s already a page in the admin-ui for
realm-selection that we could add pagination to:
https://service-e.tech.visualvest.de/auth/admin/master/console/#/realms
What do you think? Can I go ahead and give it a try?
Thanks,
Gregor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
6:42 p.m.
Sounds good. I‘ll see if I can put something together for the realms.
Am 16.07.2019 um 09:41 schrieb Stian Thorgersen
<sthorger@redhat.com<mailto:sthorger@redhat.com>>:
PR for pagination of roles would be great. Let's open a different thread for that
though as Gregor is mostly concerned with scaling to many realms.
On Mon, 15 Jul 2019 at 12:27, Ioan Eugen Stan
<ieugen@netdava.com<mailto:ieugen@netdava.com>> wrote:
Hi Gregor,
Not a keycloak dev. I just wanted to show my support for your proposal.
Pagination is required in quite a few places. I might be able to pitch in some help.
Currently, realm roles also don't support pagination. This creates issues with lots of
realm roles.
Regards,
Eugen
Eugen Stan
Netdava International
Mesaj original
De la: Gregor.Tudan@cofinpro.de<mailto:Gregor.Tudan@cofinpro.de>
Trimis: 8 iulie 2019 17:34
Către: keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
Subiect: [keycloak-dev] Scalability Problems with the admin console
Hi there,
We are running a Keycloak instance with quiet a lot of realms (~400 and growing) and are
starting to get into the dreaded scalability issue of the admin console
(https://issues.jboss.org/browse/KEYCLOAK-6096). I’ve been watching the issue for quiet a
while now and you made it clear that this isn’t a top priority at the moment.
The issue is flagged with „Awaiting volunteers“ and I’d love to contribute.
The design proposed by the reporter sounds reasonable. There would have to be some changes
to the whoami-API (which seems to be exclusively used by the console). The Realms-API
would need pagination, which could be kept backwards compatible. There’s already a page in
the admin-ui for realm-selection that we could add pagination to:
https://service-e.tech.visualvest.de/auth/admin/master/console/#/realms
What do you think? Can I go ahead and give it a try?
Thanks,
Gregor
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
1742
days inactive
1759
days old
5 comments
3 participants
participants (3)
-
Gregor Tudan -
Ioan Eugen Stan -
Stian Thorgersen