High Latency with id_token mutator and RS256 keys
#364
Comments
|
May I ask what the JWKs key type you're using and also how many bits (e.g. RS256 with 2048 bit entropy)? |
|
It would also be helpful if you could create a call graph, that way it's easier to debug. It looks like this is caused by the signing algorithm though (because math/big). You can do that on the existing data file you have, more info: https://blog.golang.org/profiling-go-programs |
|
The jwks key is generated with the following code: package main
import (
"encoding/json"
"fmt"
"os"
"github.com/ory/hydra/jwk"
)
func main() {
if len(os.Args) != 2 {
fmt.Println("key name argument required")
os.Exit(1)
}
gen := jwk.RS256Generator{}
ks, err := gen.Generate(os.Args[1], "sig")
if err != nil {
panic(err)
}
enc := json.NewEncoder(os.Stdout)
// enc.SetIndent("", " ")
if err := enc.Encode(ks); err != nil {
panic(err)
}
}
|
|
Looks like
but it still shouldn't take like 3.02s. |
aeneasr
changed the title
id_token mutatorid_token mutator and RS256 keys
|
Ok, looked into this a bit more. It's generally recommended to use P256 as that is implemented in ASM in Go, as opposed to RSA which is written in Go. We can definitely improve performance with some caching (same session gives same JWT until it expires). I'll write a patch that makes use of caching to tackle this. |
|
Hi Paul, I pushed a fix to master just now. The latency was greatly (I think factor was in the thousands :) ) reduced in the benchmarks. I generally recommend using ECDSA as it is faster than RSA and with the new caching even more so but both RSA and ECDSA should get same performance results. |
|
Can you maybe check it out and see how it behaves? I will release a new version probably next week once some more PRs are merged. |
|
@aeneasr I should have a chance to check that out in the next week or so, I'll report back. |
Describe the bug
I am having latency issues, presumably from signing the jwt for the id token?
Reproducing the bug
Oathkeeper rule
[ { "upstream": { "url": "http://devteam-gateway:8080", "preserve_host": false }, "id": "backoffice-read-lists.devteam-dev", "match": { "url": "\u003chttps?\u003e://devteam.dev.myco.com/\u003c.*\u003e", "methods": [ "GET", "POST", "PUT", "PATCH", "DELETE" ] }, "authenticators": [ { "handler": "oauth2_introspection", "config": { "introspection_request_headers": { "x-forwarded-proto": "https" }, "introspection_url": "http://devteam-ory-hydra-admin:4445/oauth2/introspect" } } ], "authorizer": { "handler": "allow", "config": {} }, "mutators": [ { "handler": "id_token", "config": { "issuer_url": "http://devteam-ory-oathkeeper-proxy", "jwks_url": "file:///etc/secrets/mutator.id_token.jwks.json" } } ], "configMapName": "devteam-ory-oathkeeper-rules" } ]Server logs
(in this instance it did not add too much, but it varies from 300-1500 ms generally, much higher when multiple requests come in at once)
Server configuration
Oathkeeper config (configmap)
Environment
Additional context
top 10 from cpu profile for a single proxied request
for multiple requests
The text was updated successfully, but these errors were encountered: