Repository navigation
Conversation
…ion sessions Closes keycloak#55015 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
…remembering empty realms Closes keycloak#55015 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #55015
The expiration first looks for a single root authentication session of the realm with a one-row lookup, and only runs the per-bucket queries if one exists. The lookup is a prefix seek on
IDX_ROOT_AUTH_SESSION_REALM, so no schema change is needed.Decision: nothing is remembered between runs, which is the same pattern as for user sessions in #54886. A remembered "empty since T" mark would have depended on the clock and on node-local state.
RealmAwareExpirationTasklets whichever node wins the per-realm check run the realm, so such a mark would only help while the same node keeps winning.Trade-off: realms that do have sessions run one extra cheap query per run, 65 instead of 64. The saving is for realms without sessions, which go from 64 queries to 1. Authentication sessions are short-lived, so the benefit depends on how many realms are idle. This is an enhancement, not a regression, as JPA authentication sessions did not exist before 26.8.
Assumption: the probe runs in the single transaction of the expiration action, so no separate transaction is needed, unlike for user sessions.
The integration test runs in the stateless test suite, as JPA authentication sessions need that feature. It uses Hibernate statistics, which are shared with the periodic expiration task, so it asserts on query kinds and retries up to three times. It fails without the fix.