Submitter: Jenkins
Branch:    master

commit 63124f703a81074793360c1b91711b6ee5a76196
Author: Lance Bragstad <>
Date:   Tue Jul 25 17:03:55 2017 +0000

    Cache list projects and domains for user
    Listing projects and domains for a user based on their role
    assignments was noted as being really slow, especially when users
    have a lot of assignments. This commit implements caching to mitigate
    the issue while we continue to investigate ways to speed up the
    assignment API.
    Change-Id: I72e398c65f01aa4f9a37f817d184a13ed01089ce
    Closes-Bug: 1700852

** Changed in: keystone
       Status: In Progress => Fix Released

You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).

  Slow listing projects for user with many role assignments

Status in OpenStack Identity (keystone):
  Fix Released
Status in OpenStack Identity (keystone) newton series:
  Won't Fix
Status in OpenStack Identity (keystone) ocata series:

Bug description:
  With a large number of role assignments (e.g 500) it becomes very slow
  to list the projects a user has access to (via /users/<id>/projects).
  I'm seeing times of around 4 seconds versus 0.1 for a user with a
  couple of assignments.

  Instrumenting list_projects_for_user
  where each number is the time elapsed since the start of
  list_projects_for_user, I get:

    list_projects_for_user 3.998 role_assignments
    list_projects_for_user 3.999 project_ids
    list_projects_for_user 4.105 list_projects

  The time is spent on the call made to list_role_assignments on line
  269 which in turns calls  _list_effective_role_assignments at

  Listing role assignments for a user directly (with GET
  /role_assignments?<id>) is very fast, which is further
  indication that something in the effective role processing is the
  cause. I haven't yet timed the internal of

  Running keystone mitaka (though I believe this would apply to master)
  with users in LDAP but roles and projects managed by keystone.

To manage notifications about this bug go to:

Mailing list:
Post to     :
Unsubscribe :
More help   :

Reply via email to