Re: [keycloak-user] Very slow export/import of realms

Hi, I am currently having issues with very slow export/import of realms with a large number of users (10K). Both operations take ~10 minutes each. After digging in the KeyCloak code, I've found out that a lot of "flush" is done at the Hibernate/JPA level (at least 4-5 times per user). _Export:_ For the export, there are 4 very slow queries in ExportUtils.exportUser() (https://github.com/keycloak/keycloak/blob/7895eb6a3dd7e4abc16dd401066bd08...): * Set<FederatedIdentityModel> socialLinks = session.users().getFederatedIdentities(user, realm); * Set<RoleModel> roles = user.getRoleMappings(); * List<UserConsentModel> consents = user.getConsents(); * for(GroupModel group : user.getGroups()) { They seem to be caused by Hibernate that forces a flush by default in "getResultList()". As a workaround I told Hibernate to flush only on commit of the transaction through "-Dorg.hibernate.flushMode=COMMIT" and the export time came down to _~20 seconds_. Could there be any issue of changing the flush mode only for the export? Data shouldn't change in the database at this moment and queries shouldn't return stale data. _Import:_ For the import it seems that changing the flushMode isn't sufficient. It should likely not be done. However, I found a few places in the keycloak-model-jpa module where entities are created, persisted, then em.flush() and em.detatch() is called right away without the entity being returned (ex: UserAdapter.grantRole() - https://github.com/keycloak/keycloak/blob/master/model/jpa/src/main/java/...). If I remove all those flush/detach calls, the import process goes down to _~50 seconds_. What is the reason for flushing every time an entity is created rather than letting JPA/Hibernate do it when necessary? Thank you, Gabriel -- Gabriel Lavoie glavoie(a)gmail.com <mailto:glavoie@gmail.com> _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user