Re: [keycloak-user] Permissions performance problem

Is there a difference in the number of permissions/resources granted on each run? Maybe, permissions are being run twice when using dashboard. Still not clear to me why. I would need to reproduce this behavior somehow. Is there any client mapper associated with dashboard that is not set to api-server ? On Mon, May 27, 2019 at 11:26 AM Corentin Dupont < corentin.dupont(a)gmail.com&gt; wrote: > Hi Pedro and Luke, > I tried with the "evaluate" tab in the UI. > Just by changing the client in the evaluate tab (first dropbox), I obtain > significant performance changes: > - with "api-server" client: 2.5 seconds. > - with "dashboard" client: 5 seconds. > With the API, the difference is even more significant (200ms vs 2s) > > Note that the resources belong to "api-server". So it might be some > communication delay between the clients as suggested by Luke (if I > understood correctly)? > > > On Mon, May 27, 2019 at 3:54 PM Pedro Igor Silva <psilva(a)redhat.com&gt; > wrote: > >> Hi, >> >> The resource set is the same in both scenarios as they are related to >> api-server. The same goes for permissions and policies. >> >> I don't know what may be causing this difference, but maybe you can find >> a clue when running the evaluation tool to compare how evaluation is >> performed in both situations. >> >> On Sat, May 25, 2019 at 1:12 PM Corentin Dupont < >> corentin.dupont(a)gmail.com&gt; wrote: >> >>> Hi guys, >>> I noticed that if I request permissions with one client, it is faster >>> than >>> with another one. >>> For instance: >>> >>> TOKEN=`curl -X POST -H "Content-Type: >>> application/x-www-form-urlencoded" >>> -d >>> 'username=cdupont&password=xxx&grant_type=password&*client_id=api-server*&client_secret=4e9dcb80-efcd-484c-b3d7-1e95a0096ac0' >>> "http://localhost:8080/auth/realms/waziup/protocol/openid-connect/token" >>> | >>> jq .access_token -r` >>> time curl -X POST >>> http://localhost:8080/auth/realms/waziup/protocol/openid-connect/token >>> -H >>> "Authorization: Bearer $TOKEN" -d >>> >>> "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&audience=api-server&permission=#devices:view&response_mode=permissions" >>> *real 0m0,196s* >>> user 0m0,000s >>> sys 0m0,006s >>> >>> TOKEN=`curl -X POST -H "Content-Type: >>> application/x-www-form-urlencoded" >>> -d >>> 'username=cdupont&password=xxx&grant_type=password&*client_id=dashboard*' >>> "http://localhost:8080/auth/realms/waziup/protocol/openid-connect/token" >>> | >>> jq .access_token -r` >>> time curl -X POST >>> http://localhost:8080/auth/realms/waziup/protocol/openid-connect/token >>> -H >>> "Authorization: Bearer $TOKEN" -d >>> >>> "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&audience=api-server&permission=#devices:view&response_mode=permissions" >>> *real 0m2,142s* >>> user 0m0,006s >>> sys 0m0,006s >>> >>> The only difference between the two commands is the client (highlighted >>> in >>> red). With the second client, it takes 2 seconds more consistently. >>> Any idea? I might be a cache problem... >>> Cheers >>> Corentin >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >>