yahoo-eng-team team mailing list archive

[Boris Bobrov <1920979@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

With complex structure of inherited roles and groups listing projects
and domains a user has access to becomes very slow. Some users are
complaining that it takes a minute to get their list of roles.

Some time ago a similar bug has been fixed in
https://bugs.launchpad.net/keystone/+bug/1700852, but it seems that
there was no real fix and that we just added caching for the call.

It seems that there are several places where too many database calls are
made:

1. For example,
https://github.com/openstack/keystone/blob/ef711cd0eb5fb6fb143783ad4096e3f1dbd9da99/keystone/resource/core.py#L894
could be cached.

2. As mentioned in #1700852, _strip_domain_roles is called many times
and is slow

3. add_implied_roles
(https://github.com/openstack/keystone/blob/ef711cd0eb5fb6fb143783ad4096e3f1dbd9da99/keystone/assignment/core.py#L629)
is slow, probably because `role_api.list_implied_roles` could be cached.

** Affects: keystone
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1920979

Title:
  Slow listing projects for user with many role assignments

Status in OpenStack Identity (keystone):
  New

Bug description:
  With complex structure of inherited roles and groups listing projects
  and domains a user has access to becomes very slow. Some users are
  complaining that it takes a minute to get their list of roles.

  Some time ago a similar bug has been fixed in
  https://bugs.launchpad.net/keystone/+bug/1700852, but it seems that
  there was no real fix and that we just added caching for the call.

  It seems that there are several places where too many database calls
  are made:

  1. For example,
  https://github.com/openstack/keystone/blob/ef711cd0eb5fb6fb143783ad4096e3f1dbd9da99/keystone/resource/core.py#L894
  could be cached.

  2. As mentioned in #1700852, _strip_domain_roles is called many times
  and is slow

  3. add_implied_roles
  (https://github.com/openstack/keystone/blob/ef711cd0eb5fb6fb143783ad4096e3f1dbd9da99/keystone/assignment/core.py#L629)
  is slow, probably because `role_api.list_implied_roles` could be
  cached.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1920979/+subscriptions