Hi all, I'm using the JS Policy to evaluate resource permissions, but we've started to run into some performance problems when using large numbers of resources. However, I've managed to improve the performance of the JSPolicyProvider, by caching the ScriptEngine (creating new bindings per evaluation) and compiling the code on policy update. The "Obtaining Entitlements" operation is now ~5x faster than before, for my test setup (100 test runs, ~1100 resources, remote Postgres). I'd like to merge my changes back to Keycloak, so I just wanted to check if the community would be interested in this change before I prepare a PR and create a JIRA issue. Regards, Jay -- Jay Anslow, Product Development, CoreFiling Limited http://www.corefiling.com Phone: +44-1865-203192 _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

On 16 Jun 2017, at 15:42, Pedro Igor Silva <psilva(a)redhat.com&gt; wrote: Btw, we were already planning to cahnge JSPolicyprovider to use Keycloak's ScriptingSPI. I have some changes at this respect which I was planning to include to 3.2.0.CR1. Maybe I can share my changes too, so you can check if they also give you a better performance. It is basically the same SPI used to write custom authentication flows. On Fri, Jun 16, 2017 at 11:10 AM, Pedro Igor Silva <psilva(a)redhat.com&gt; wrote: +1. I'm glad to review your changes if you send a PR. On Fri, Jun 16, 2017 at 10:46 AM, Jay Anslow <jma(a)corefiling.com&gt; wrote: Hi all, I'm using the JS Policy to evaluate resource permissions, but we've started to run into some performance problems when using large numbers of resources. However, I've managed to improve the performance of the JSPolicyProvider, by caching the ScriptEngine (creating new bindings per evaluation) and compiling the code on policy update. The "Obtaining Entitlements" operation is now ~5x faster than before, for my test setup (100 test runs, ~1100 resources, remote Postgres). I'd like to merge my changes back to Keycloak, so I just wanted to check if the community would be interested in this change before I prepare a PR and create a JIRA issue. Regards, Jay -- Jay Anslow, Product Development, CoreFiling Limited http://www.corefiling.com Phone: +44-1865-203192 _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev