67b5cca032
Validating an application credential token is very slow, taking at least 400ms+ in a simple devstack environment, 5-10x longer than validating a user/password project token. The primary bottleneck during a token validation request (/v3/auth/tokens) is that token.roles is evaluated at least 5 times. validate_token is called twice, first during RBAC to populate the subject token context and again to actually validate the token. Each call to validate_token then called token.roles twice because it first checks if it is None, before calling it again to use the result. Lastly token.roles is evaluated a fifth time during render_token_response_from_model. Each evaluation of token.roles calls through _get_application_credential_roles into list_role_assignments which then makes multiple round-trip SQL queries to the database. Unlike the related get_roles_for_user_and_project function, none of these calls are currently cached/memoized. We memoize list_role_assignments to get the same-speedup. Reduce the number of token.roles calls to only 3 by storing and re-using the token.roles result in validate_token, then memoize list_role_assignments so the 2nd and 3rd call fetch from the cache instead of repeating many SQL queries. This provides a substantial performance improvement bringing validation time in-line with user/password tokens. Change-Id: I8c45131b298ceae7b43b42e2c5df167607d18c48 |
||
|---|---|---|
| api-ref/source | ||
| config-generator | ||
| devstack | ||
| doc | ||
| etc | ||
| examples/pki | ||
| httpd | ||
| keystone | ||
| keystone_tempest_plugin | ||
| playbooks | ||
| rally-jobs | ||
| releasenotes | ||
| tools | ||
| .coveragerc | ||
| .gitignore | ||
| .gitreview | ||
| .mailmap | ||
| .stestr.conf | ||
| .zuul.yaml | ||
| CONTRIBUTING.rst | ||
| HACKING.rst | ||
| LICENSE | ||
| README.rst | ||
| babel.cfg | ||
| bindep.txt | ||
| reno.yaml | ||
| requirements.txt | ||
| setup.cfg | ||
| setup.py | ||
| test-requirements.txt | ||
| tox.ini | ||
README.rst
OpenStack Keystone
OpenStack Keystone provides authentication, authorization and service discovery mechanisms via HTTP primarily for use by projects in the OpenStack family. It is most commonly deployed as an HTTP interface to existing identity systems, such as LDAP.
Developer documentation, the source of which is in
doc/source/, is published at:
The API reference and documentation are available at:
The canonical client library is available at:
Documentation for cloud administrators is available at:
The source of documentation for cloud administrators is available at:
Information about our team meeting is available at:
Release notes is available at:
Bugs and feature requests are tracked on Launchpad at:
Future design work is tracked at:
Contributors are encouraged to join IRC
(#openstack-keystone on OFTC):
Source for the project:
For information on contributing to Keystone, see
CONTRIBUTING.rst.