[keycloak-dev] Slow Direct Grants API endpoint

[Daniel Baxter]

I am working with our ops team to configure 1.1.x with the same level of hardware as our development 1.0.4 system (right now it is running locally on a XEON workstation with piles of RAM). 

Both are connected to postgres databases and I am the only person working on this portion of the project so it is just 1 user at a time right now for 1.1.x. I have tested the database connection and there is no real discernable performance irregularities for anything that runs against that database.

For Keycloak itself, it is mostly straight out of the box appliance install for both 1.0.4 and 1.1.x and it runs on a single machine for development use (I believe our prod deployment is/will be clustered). The performance I am seeing is timeable on a stop watch for 1.1 and near enough to instant for 1.0.4 (under 500 ms). Easily an order of magnitude. Given the response I got (regarding the unexpectedness of the slow behaviour) I want to make sure I have a completely fair comparison and am working to set up 1.1 on a dedicated development server to make the comparison completely fair.

- Daniel

-----Original Message-----
From: Stian Thorgersen [mailto:stian at redhat.com] 
Sent: Wednesday, January 14, 2015 8:46 AM
To: Daniel Baxter
Cc: keycloak-dev at lists.jboss.org
Subject: Re: [keycloak-dev] Slow Direct Grants API endpoint

Direct grants are expected to be a little bit slower in 1.1.x due to the requirement to persist more, but should certainly not be seconds.

Can you give some more details please? Including

* What DB are you using?
* Are you using mem, infinispan or jpa user session provider?
* Clustered?
* How many concurrent requests/users are you testing with?

Any more accurate performance stats would also be helpful

----- Original Message -----
> From: "Daniel Baxter" <daniel.baxter at cira.ca>
> To: keycloak-dev at lists.jboss.org
> Sent: Monday, 12 January, 2015 9:23:42 PM
> Subject: [keycloak-dev] Slow Direct Grants API endpoint
> 
> 
> 
> Hi,
> 
> 
> 
> I am attempting to integrate Keycloak into an existing application to 
> replace the homegrown user management system in place. We have a new 
> project built from the ground up on Keycloak 1.0.4.Final which is 
> exhibiting good performance. However this app that I am porting has a 
> remoting component that connects to the server with bare 
> username/password credentials over the EJB Remoting framework. I was 
> hoping to use 1.1.0 (currently Beta2) which provides a 
> DirectAccessGrantsLoginModule which does exactly what I want (turns 
> username and password into a KeycloakPrincipal). However, the turn around time from Keycloak is on the order of several seconds.
> 
> 
> 
> I have used a bare REST client to execute the POSTs to both our 1.0.4 
> Keycloak and 1.1.0 Keycloak instances and have noted an order of 
> magnitude difference in getting a response. Is this a known issue (I 
> cannot find anything in the public bugs/tasks list)? Or is this due to 
> the Beta status leaving additional performance affecting logging or 
> instrumentation in place?
> 
> 
> 
> Thanks,
> 
> 
> 
> Daniel
> 
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev