You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Addressing Rate Limiting and Cache Optimization
#39869
I have set up a Keycloak (25.0.0) environment with Google Workspace as User Federation via their LDAP adapter.
I have more than 15000 users who will be active once the migration to Workspace is complete, but Google has implemented a rate limiting of 4 QPS for Bind Requests, which makes me concerned that later login attempts might hit the rate limit.
To get an idea, I simulated about ten simultaneous connections and, indeed, I hit the rate limit on Google's side, resulting in poor performance (more than 30s)
I then looked at the Cache Policy settings in the User Federation section because I imagine it's related to LDAP as well. Can you confirm if I understand this parameter correctly:
If I set the CACHE to DEFAULT, after the first login, the user is stored in the cache buffer, which will make subsequent logins faster by using the Keycloak - LDAP cache?
When periodic syncs occur and a user is modified, is the user removed from the cache until the next login with new attributes/values?
Additionally, if you have any interesting documentation on this topic, I would appreciate it, as I haven't found any comprehensive resources.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hey everyone,
I have set up a Keycloak (25.0.0) environment with Google Workspace as User Federation via their LDAP adapter.
I have more than 15000 users who will be active once the migration to Workspace is complete, but Google has implemented a rate limiting of 4 QPS for Bind Requests, which makes me concerned that later login attempts might hit the rate limit.
To get an idea, I simulated about ten simultaneous connections and, indeed, I hit the rate limit on Google's side, resulting in poor performance (more than 30s)
I then looked at the Cache Policy settings in the User Federation section because I imagine it's related to LDAP as well. Can you confirm if I understand this parameter correctly:
If I set the CACHE to DEFAULT, after the first login, the user is stored in the cache buffer, which will make subsequent logins faster by using the Keycloak - LDAP cache?
When periodic syncs occur and a user is modified, is the user removed from the cache until the next login with new attributes/values?
Additionally, if you have any interesting documentation on this topic, I would appreciate it, as I haven't found any comprehensive resources.
Thank you in advance !
All reactions