Details
-
Task
-
Status: Closed (View Workflow)
-
P2
-
Resolution: Done
-
None
-
None
-
-
CP: sprint 92, CP: sprint 95, CP: sprint 96, CP: sprint 97
-
Core: Platform
Description
This is a continuation of MODAT-80, which was split because it spanned more than one sprint.
See [https://wiki.folio.org/pages/viewpage.action?pageId=36581623|MODAT-80/83 - Auth Performance Improvements] for current spike progress
We are expecting that the authentication overhead (the time it takes for Okapi to call mod-authtoken during the "auth" filter phase for /*) is substantial. If this is confirmed by OKAPI-860 and PTF measurements we need to investigate potential optimisations to minimize this overhead.
In the past we have (roughly) discussed different potential approaches:
- cache and re-use authentication tokens for module-to-module calls (for the same endpoint-modulePermissions pair)
- merge mod-authtoken with Okapi (as an internal module) (TODO link the Okapi caching ticket)
- modify internal API between Okapi and mod-authtoken to be able to provide more caching within mod-authtoken (e.g make mod-authtoken responsible for retrieving module permissions (or complete MDs) and cache tokens localy)*
We would like to introduce the optimization in a way that is as transparent to FOLIO modules as possible and does not require fundamental changes to the authentication/authorization model. We may need to change certain aspects of existing behavior, e.g the fact that module-to-module communication "inherits" initial user permissions, to benefit from more aggressive token caching and re-use.
Expected output:
- Wiki page updated
- Cache topic only
TestRail: Results
Attachments
Issue Links
- clones
-
MODAT-80 SPIKE: investigate authentication performance optimizations
-
- Closed
-
- relates to
-
MODAT-82 Replace linear search MainVerticle.LimitedSizeQueue
-
- Closed
-
-
OKAPI-860 Add HTTP (API calls, system calls) metrics to Okapi
-
- Closed
-
-
OKAPI-890 Implement Token Cache
-
- Closed
-
-
PERF-113 Evaluate Benefits of Okapi Token Caching
-
- Closed
-
-
MODAT-20 Experiment with caching of permissions
-
- Closed
-
-
MODAT-51 investigate potential mod-authtoken performance issue
-
- Blocked
-
-
MODAT-86 Remove requestId from token claims
-
- Closed
-