Skip to content

Avoid PostgreSQL parameter limit for denied resources - #51337

Open
sakshichitnis27 wants to merge 3 commits into
keycloak:mainfrom
sakshichitnis27:Issue/51128-fgap-query-parameters
Open

Avoid PostgreSQL parameter limit for denied resources#51337
sakshichitnis27 wants to merge 3 commits into
keycloak:mainfrom
sakshichitnis27:Issue/51128-fgap-query-parameters

Conversation

@sakshichitnis27

Copy link
Copy Markdown

Fixes #51128

Summary

Avoid exceeding PostgreSQL's prepared-statement parameter limit when applying fine-grained admin permission filters to a large number of denied resources.

The partial evaluator previously passed the complete denied-resource ID collection directly to the Criteria API IN predicate. Hibernate consequently created one bind parameter for every denied ID. When the collection contained more than 65,535 IDs, pgjdbc rejected the prepared statement.

Changes

  • Render denied-resource IDs as Hibernate Criteria literals instead of individual bind parameters.
  • Preserve the existing authorization and filtering behavior.
  • Add a focused regression test covering 65,536 denied-resource IDs.
  • Verify that quoted IDs are escaped correctly when rendered as literals.

Only the denied-resource predicate is changed. Allowed-resource filtering and unrelated queries remain unchanged.

Testing

  • Confirmed that the regression test fails before the fix with 65,537 bind parameters.

  • Confirmed that the fixed denied-resource predicate introduces no bind parameters.

  • Ran:

    ./mvnw -pl model/jpa -am test

  • Ran:

    ./mvnw -pl server-spi-private,model/jpa spotless:check

  • Reproduced the original failure against PostgreSQL 16.4 using pgjdbc 42.7.11 with 65,536 parameters.

  • Confirmed that the literal-based query succeeds against the same PostgreSQL instance.

AI assistance disclosure

An AI agent was used to assist with issue analysis, implementation, and regression-test development. I reviewed the changes, understand their behavior, and independently verified the resulting implementation and test results.

Signed-off-by: Sakshi Chitnis <156598682+sakshichitnis27@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 31, 2026 13:05
@sakshichitnis27
sakshichitnis27 requested a review from a team as a code owner July 31, 2026 13:05

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Prevents PostgreSQL parameter-limit failures in FGAP denied-resource filtering.

Changes:

  • Renders denied-resource IDs as Criteria literals.
  • Adds regression coverage for 65,536 IDs and quoted identifiers.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
PartialEvaluator.java Builds denied-resource predicates using literals.
PartialEvaluatorTest.java Verifies generated SQL avoids excessive bind parameters.

Comment on lines +162 to +163
CriteriaBuilder.In<String> deniedResources = builder.in(path.get(ID_FIELD));
deniedIds.forEach(id -> deniedResources.value(builder.literal(id)));
Copilot AI review requested due to automatic review settings August 1, 2026 13:33

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings August 3, 2026 06:23

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

@ahus1

ahus1 commented Aug 3, 2026

Copy link
Copy Markdown
Member

Please avoid merging the main branch into the PR or rebasing the PR unless there are merge conflicts reported by GitHub or a reviewer asks you for a rebase. This prevents spamming reviewers with notifications and saves minutes on the GitHub actions CI.

Also, ensure that the sign-off is added to all commits.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PreparedStatement can have at most 65,535 parameters

3 participants