API Gateway: Policy Manager slowness with a large number of user roles assigned

Products

• CA API Gateway

Issue/Introduction

When an excessive amount of roles is assigned to a user, their login with cause abnormal delays when using policy manager.

Environment

All supported versions of the API Gateway

Resolution

There is a setting to improve this performance by caching the rules as for each entry shown it is performing a rule check. 

The following describes this setting : 

When an admin method is called, the RBAC system is invoked/consulted to check whether or not the principal is allowed to access that method (and on the objects being modified or queried). This amounts, in the end, to a check of all the roles to which the user is assigned, and for each, a lazy loading (meaning in subsequent queries) the permissions are loaded and checked. The problem seen is that these checks/queries are done for EACH invocation of an admin method. On policy manager login, an attempt is made to load all top level objects that would be visible (so folders, top level policies, services) as well as policy fragments and encapsulated assertions). Each of these requires one or more admin calls to access, which means at LEAST one RBAC role lookup per above. 

What we’ve now done is to cache the role and permissions lookup so that subsequent ones for the same user will not require a true round trip to the DB. 

This cache time is a configurable amount of time (in ms). The default time is 60000 but can be overridden with the following system property: 

-Dcom.l7tech.server.rbac.cacheable.roles.maxAge 

/opt/SecureSpan/Gateway/node/default/etc/conf/system.properties