fix: remove redundant removeTransientAdminRoles calls in addRolesAsAttributes to fix O(n) performance regression with many realms - #51569
Open
waterWang wants to merge 1 commit into
Conversation
…tributes to fix O(n) performance regression with many realms (keycloak#51554)
Contributor
There was a problem hiding this comment.
Pull request overview
Removes redundant per-request admin-role validation to eliminate realm-count-dependent database lookups.
Changes:
- Removes transient admin-role filtering from authorization attribute population.
- Removes the unused static import.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
324
to
325
| if (realmAccess != null) { | ||
| removeTransientAdminRoles(realm, null, user, realmAccess); | ||
| attributes.put("kc.realm.roles", realmAccess.getRoles()); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #51554
Root Cause
The
addRolesAsAttributesmethod inKeycloakIdentity.javacallsremoveTransientAdminRolesfor every role in the access token, on every request. When lightweight admin tokens are expanded to include roles across all realms, this results in O(n) database lookups per request where n = number of realms.With 400 realms, each admin API request takes 9–19 seconds (vs. 5–24ms without the redundant calls), as measured by the reporter.
Fix
Remove the two
removeTransientAdminRolescalls fromaddRolesAsAttributes. The admin role validation is already performed at token creation time byAdminRoleTokenPostProcessor.process()— the roles are stripped of transient entries before the token reaches the client. Re-validating at request time is redundant and causes the O(n) performance regression.Performance Impact
Security
Safe to remove because
AdminRoleTokenPostProcessor.process()already validates transient admin roles during token creation. TheaddRolesAsAttributesmethod is only populating attributes for the authorization context from an already-validated token.Related
200e65568dcd(CVE-2026-4629)