latency issue after keycloak version upgrade

[Naresh Kumar]

Hello,

We are currently utilizing Keycloak version 22.0.4 and are in the process of upgrading to version 25.0.6. During our performance testing following the upgrade, we are encountering latency issues, particularly during the authorization phase. We are using the same database as in the previous version.

I would appreciate any assistance regarding this matter.

Thank you,
Naresh Kumar.

NOTICE: The information contained in this transmission and any attachments is confidential and is for the use of the intended recipient(s) only. If you have received in error, please notify the sender and delete it. If you are not the intended recipient, you must not use, disclose or distribute this e-mail without the author's prior permission.

[Naresh Kumar]

Hello,

We are currently utilizing Keycloak version 22.0.4 and are in the process of upgrading to version 25.0.6. During our performance testing following the upgrade, we are encountering latency issues, particularly during the authorization phase. We are using the same database as in the previous version.

I am wondering why the below query runs multiple times (20k) after the keycloak version upgrade to 25.0.6.

select re1_0.ID from KEYCLOAK_ROLE re1_0 where re1_0.CLIENT_ROLE=0 and re1_0.NAME=? and re1_0.REALM_ID=?

binding parameter (1:NVARCHAR) <- [8bee0f28-9795-4668-8ec8-602e82259aa5]
binding parameter (2:VARCHAR) <- [master]

and one more thing to highlight here is that here the first required parameter is name but binding parameter value is some unique id.

We also observed that the above query doesn't execute in below 25.x versions.

[Alexander Schwartz]

Hi Naresh,

I did a short analysis: For KC25.0.6, I traced the SQL you mentioned down to this JPQL statement: https://github.com/keycloak/keycloak/blob/384d7c17f7f4dc25edd309ead4d80546405dbd03/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java#L64

Tracing this named query back, it is only called from https://github.com/keycloak/keycloak/blob/d767c784c9e5bf60e5933162840d536baab8896a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java#L245 which is then only called from https://github.com/keycloak/keycloak/blob/d767c784c9e5bf60e5933162840d536baab8896a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java#L229

Seeing that it is calling within addRealmRole(), this shouldn't be called from a regular login. Did you extend Keycloak with a custom extension? 

If you still see this problem with the latest version of Keycloak 26.1 without using a custom extension, please raise this as a GitHub issue of type "bug". 

Best,

Alexander

--
You received this message because you are subscribed to the Google Groups "Keycloak User" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-use...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/keycloak-user/CAC4AWez5PEjUjid2dFx8qeETZSCqkomf-G%3De3Wjp3uBG%3DBSdHg%40mail.gmail.com.

--

Alexander Schwartz, RHCE

He/Him

Principal Software Engineer, Keycloak Maintainer

Red Hat - Germany remote

asch...@redhat.com   

Red Hat GmbH, Registered seat: Werner von Siemens Ring 12, D-85630 Grasbrunn, Germany 
Commercial register: Amtsgericht Muenchen/Munich, HRB 153243,
Managing Directors: Ryan Barnhart, Charles Cachera, Michael O'Neill, Amy Ross

[Naresh Kumar]

Hi Alexander,

Appreciate your swift response!

I have conducted validation in Keycloak version 26.1; however, we continue to experience the same query being executed multiple times, and we are not utilizing any custom extensions.

Additionally, I would like to point out that with captured thread dumps, it appears this issue may be originating from here:

https://github.com/keycloak/keycloak/blob/d767c784c9e5bf60e5933162840d536baab8896a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java#L221

Thanks,

Naresh Kumar

[Alexander Schwartz]

Hi Naresh,

as stated before: If you still see this problem with the latest version of Keycloak 26.1 without using a custom extension, please raise this as a GitHub issue of type "bug". https://github.com/keycloak/keycloak/issues

Please include the thread dumps that you have collected.

Best,

Alexander

[Alexander Schwartz]

I didn't see a new open issue for this one yet, so I created https://github.com/keycloak/keycloak/issues/36919

Please share the thread dump and any additional information there. Thanks!