You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Fast exact user search by default in admin console
#8768
We notice a slow user search at admin console for a Keycloak realm with more than 1 million user accounts. Searches take up to 20 seconds. In our use case a search by full email address is needed regularly.
Admin console searches by calling GET /realms/example-realm/users?briefRepresentation=true&first=0&max=20&search=user-search-string
The current search semantics are barely improvable at DB level with an index. That's why we started to look into a search syntax to allow searching for an exact string. The current PR introduces the options to do an infix, prefix or exact search at username, email, firstname and lastname:
Prefix, e.g : foo or foo* (new default)
Exact, e.g : "foo"
Infix, e.g : *foo* (old default)
The PR also drops the search for the full name as concatenation of firstname and lastname.
Overall I like the approach to improve the existing search endpoint. However it would change default search behavior. If the old behavior must be retained, then we would need one of the following:
a) Find an other syntax to do an exact search, so that API clients do not need to migrate. Admin console should use the new search syntax by default, so that a slow infix search is possible but only done when required by the Admin.
b) Introduce a new URL parameter e.g. named nameOrEmailSearch, so that existing search parameter triggers the existing search and new parameter triggers a search with new syntax and queries. Admin console would use the new search parameter nameOrEmailSearch.
Which option would you prefer?
Any other suggestions how we could end up with a fast exact search for a complete username, firstname, lastname or emailadress within the admin console and current user search endpoint?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We notice a slow user search at admin console for a Keycloak realm with more than 1 million user accounts. Searches take up to 20 seconds. In our use case a search by full email address is needed regularly.
Admin console searches by calling
GET /realms/example-realm/users?briefRepresentation=true&first=0&max=20&search=user-search-stringWe started to discuss an improvement at https://groups.google.com/g/keycloak-dev/c/jn5Yy9Y4Lw4
and have this pulls request open for discussion: #8346
The current search semantics are barely improvable at DB level with an index. That's why we started to look into a search syntax to allow searching for an exact string. The current PR introduces the options to do an infix, prefix or exact search at username, email, firstname and lastname:
The PR also drops the search for the full name as concatenation of firstname and lastname.
Overall I like the approach to improve the existing search endpoint. However it would change default search behavior. If the old behavior must be retained, then we would need one of the following:
a) Find an other syntax to do an exact search, so that API clients do not need to migrate. Admin console should use the new search syntax by default, so that a slow infix search is possible but only done when required by the Admin.
b) Introduce a new URL parameter e.g. named
nameOrEmailSearch, so that existingsearchparameter triggers the existing search and new parameter triggers a search with new syntax and queries. Admin console would use the new search parameternameOrEmailSearch.Which option would you prefer?
Any other suggestions how we could end up with a fast exact search for a complete username, firstname, lastname or emailadress within the admin console and current user search endpoint?
All reactions