LDAP backed Horizon very slow when listing project/domain role assignments

asked 2015-03-16 12:50:49 -0500

pentatonic gravatar image

Hello, I'm running Juno and testing out the domain specific identity driver with LDAP. Things are working fine but I noticed a couple areas in the UI that are very slow. After I looked in the Keystone logs, I figured out why but was wondering if there is a change planned in Kilo to address it.

The issue happens when you go into "project", "modify users". At that point, it will load up the screen to allow modification of role assignment for that project for users and groups.

To load that screen, it first wants to prepopulate it with the existing role assignments in that project. It does so by performing: GET .../v3/projects/project id/group/group id/roles and GET .../v3/projects/project id/user/user id/roles, respectively for every group, then users that are found in the project's domain. If there are 500 users and 100 groups, that is 600 GETs before the screen can be displayed. On a bigger system, this results into an abnormally long wait until the screen shows up.

In Keystone v3.1 (I think), the new GET /v3/role_assignments call was introduced where you can do that single GET call with say a ?scope.project.id parameter to get all the assignments in one shot.

That is the obvious fix to this problem; my guess is that Horizon Juno did not catch up to some of the optimization and latest API calls from Keystone.

Is this correct? Also was there a fix after Juno? Thanks!

edit retag flag offensive close merge delete