mirrors/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-25 16:42:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated performance impact due to changed hashing

Browse Source 
Fixes #27900

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
This commit is contained in:
Alexander Schwartz
2024-03-14 14:15:30 +01:00
committed by Alexander Schwartz
parent 4ab4fa94fb
commit fbdb2ed9f7
4 changed files with 27 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/documentation/upgrading/topics/changes/changes-24_0_0.adoc
View File

@@ -408,8 +408,9 @@ This can be done by configuring the hash iterations explicitly in the password p
== Expected increased overall CPU usage and temporary increased database activity
The Concepts for sizing CPU and memory resources in the {project_name} High Availability guide have been updated to reflect the new hashing defaults.
While the CPU usage per password-based login in our tests increased by 33% (which includes both the changed password hashing and unchanged TLS connection handling), the overall CPU increase should be around 10% to 15%.
This is due to the averaging effect of {project_name}'s other activities like refreshing access tokens and client credential grants, still this depends on the unique workload of an installation.
The CPU usage per password-based login in our tests increased by the factor of five, which includes both the changed password hashing and unchanged TLS connection handling.
The overall CPU increase should be around the factor of two to three due to the averaging effect of {project_name}'s other activities like refreshing access tokens and client credential grants.
Still, this depends on the unique workload of an installation.
After the upgrade, during a password-based login, the user's passwords will be re-hashed with the new hash algorithm and hash iterations as a one-off activity and updated in the database.
As this clears the user from {project_name}'s internal cache, you will also see an increased read activity on the database level.

6
docs/documentation/upgrading/topics/changes/changes-24_0_2.adoc Normal file
View File

@@ -0,0 +1,6 @@
ifeval::[{project_community}==true]
= Changes to Password Hashing
The release notes for {project_name} 24.0.0 have been updated with corrected description of the expected performance impact for the change, as well as sizing guide.
endif::[]

4
docs/documentation/upgrading/topics/changes/changes.adoc
View File

@@ -5,6 +5,10 @@
include::changes-25_0_0.adoc[leveloffset=3]
=== Migrating to 24.0.2
include::changes-24_0_2.adoc[leveloffset=3]
=== Migrating to 24.0.0
include::changes-24_0_0.adoc[leveloffset=3]