Feature: handle rate limiting of UAA server. Fixes #1307 #1332

Lokowandtg · 2025-12-17T18:44:39Z

Not tested on a system without ratelimiting...

Kehrlann

Thank you for your contribution!

[issue] the current implementation doesn't work when UAA_API_REQUEST_LIMIT is not set. See the suggestions in the IntegrationTestConfiguration class.

Kehrlann · 2025-12-18T09:50:10Z

integration-test/src/test/resources/logback-test.xml

    <logger name="cloudfoundry-client.delay"             level="${CLIENT_LOGGING_LEVEL:-INFO}"/>
    <logger name="cloudfoundry-client.operations"        level="${CLIENT_LOGGING_LEVEL:-INFO}"/>
-    <logger name="cloudfoundry-client.request"           level="${CLIENT_LOGGING_LEVEL:-INFO}"/>
+    <logger name="cloudfoundry-client.request"           level="DEBUG"/>


Revert this change.

Kehrlann · 2025-12-18T10:03:50Z

integration-test/src/test/java/org/cloudfoundry/ThrottlingUaaClient.java

+import org.immutables.value.Value;
+import reactor.core.publisher.Mono;
+
+public class ThrottlingUaaClient implements UaaClient {


Suggested change

public class ThrottlingUaaClient implements UaaClient {

/**

* An {@link UaaClient} implementation that throttles calls to the UAA

* {@code /Groups} and {@code /Users} endpoints. It uses a single "bucket"

* for throttling requests to both endpoints.

*

* @see <a href="https://resilience4j.readme.io/docs/ratelimiter">resilience4j docs</a>

*/

public class ThrottlingUaaClient implements UaaClient {

Done. Thanks.

Kehrlann · 2025-12-18T10:04:24Z

integration-test/src/test/java/org/cloudfoundry/ThrottlingUaaClient.java

+    private final ThrottledUsers users;
+    private Groups groups;
+
+    public ThrottlingUaaClient(ReactorUaaClient delegate, int uaaLimit) {


Suggested change

public ThrottlingUaaClient(ReactorUaaClient delegate, int uaaLimit) {

public ThrottlingUaaClient(ReactorUaaClient delegate, int maxRequestsPerSecond) {

Kehrlann · 2025-12-18T10:05:37Z

integration-test/src/test/java/org/cloudfoundry/ThrottlingUaaClient.java

+    public ThrottlingUaaClient(ReactorUaaClient delegate, int uaaLimit) {
+        // uaaLimit is calls per second. We need the milliseconds for one call because
+        // resilience4j uses sliced timeslots, while the uaa server uses a sliding window.
+        int timeBasePerRequest = 1000 / uaaLimit;


Suggested change

int timeBasePerRequest = 1000 / uaaLimit;

int clockSkewMillis = 20; // 20ms clock skew

int rateLimitRefreshPeriodMillis = (1000 / maxRequestsPerSecond) + clockSkewMillis;

[nitpick] The clock skew only makes sense if you have 1 to ~10 rps. If you set 100rps, then the clock skew is bigger than the un-skewed window, and you're going to be doing roughly 33rps instead of 100, which might be surprising.
I think it's fine to leave it as-is, maybe add a comment explaining that this value was chosen for a maxRequestsPerSecond value between 1 and 10?

Correct, done.

Kehrlann · 2025-12-18T10:06:09Z

integration-test/src/test/java/org/cloudfoundry/ThrottlingUaaClient.java

+                        .limitForPeriod(1)
+                        .limitRefreshPeriod(
+                                Duration.ofMillis(
+                                        timeBasePerRequest + 20)) // 20 ms to handle clock skew.


See above: put the clock skew in the variable directly.

Kehrlann · 2025-12-18T10:08:59Z

integration-test/pom.xml

+        <dependency>
+            <groupId>io.github.resilience4j</groupId>
+            <artifactId>resilience4j-ratelimiter</artifactId>
+            <version>1.7.0</version>


Please put the version in a property in the root pom.xml.

Good point, done.

Kehrlann · 2025-12-18T11:03:56Z

integration-test/src/test/java/org/cloudfoundry/IntegrationTestConfiguration.java

+    @Bean
+    Boolean uaaRatelimit(
+            ConnectionContext connectionContext, @Qualifier("admin") UaaClient uaaClient) {
+        return uaaClient
+                .rateLimit()
+                .getRatelimit(RatelimitRequest.builder().build())
+                .map(response -> getServerRatelimit(response))
+                .timeout(Duration.ofSeconds(5))
+                .onErrorResume(
+                        ex -> {
+                            logger.error(
+                                    "Warning: could not fetch UAA rate limit, using default"
+                                            + " "
+                                            + 0
+                                            + ". Cause: "
+                                            + ex);
+                            return Mono.just(false);
+                        })
+                .block();
+    }
+
+    private Boolean getServerRatelimit(RatelimitResponse response) {
+        Current curr = response.getCurrentData();
+        if (!"ACTIVE".equals(curr.getStatus())) {
+            logger.debug(
+                    "UaaRatelimitInitializer server ratelimit is not 'ACTIVE', but "
+                            + curr.getStatus()
+                            + ". Ignoring server value for ratelimit.");
+            return false;
+        }
+        Integer result = curr.getLimiterMappings();
+        logger.info(
+                "Server uses uaa rate limiting. There are "
+                        + result
+                        + " mappings declared in file "
+                        + response.getFromSource());
+        logger.info(
+                "If you encounter 429 return codes, configure uaa rate limiting or set variable"
+                        + " 'UAA_API_REQUEST_LIMIT' to a save value.");
+        return true;
+    }
+


[suggestion] Drop this entirely, this is just a helper message. Only maintainers will ever care about this, and I don't think we need this level of "discoverability". Your change in the README is enough.

Moved it to a dedicated integration test, that fits better and also can give the warning.

Kehrlann · 2025-12-18T11:09:00Z

integration-test/src/test/java/org/cloudfoundry/IntegrationTestConfiguration.java

-                                .build())
-                .build();
+            @Value("${test.admin.clientSecret}") String clientSecret,
+            int uaaLimiterMapping) {


[suggestion] Drop the uaaLimiterMapping bean, and instead inject the value here. This allows you to create an unthrottled UAA client, if necessary. For example:

@Bean @Qualifier("admin") UaaClient adminUaaClient( ConnectionContext connectionContext, @Value("${test.admin.clientId}") String clientId, @Value("${test.admin.clientSecret}") String clientSecret, @Value("${uaa.api.request.limit:#{null}}") Integer environmentRequestLimit) { ReactorUaaClient unthrottledClient = ReactorUaaClient.builder() .connectionContext(connectionContext) .tokenProvider( ClientCredentialsGrantTokenProvider.builder() .clientId(clientId) .clientSecret(clientSecret) .build()) .build(); if (environmentRequestLimit == null) { return unthrottledClient; } else { return new ThrottlingUaaClient( unthrottledClient, environmentRequestLimit); } }

Thats better, done.

Kehrlann · 2025-12-18T11:09:52Z

integration-test/src/test/java/org/cloudfoundry/IntegrationTestConfiguration.java

-                .connectionContext(connectionContext)
-                .tokenProvider(tokenProvider)
-                .build();
+    UaaClient uaaClient(


Apply the same suggestion as the adminUaaClient

done. Thanks!

Kehrlann and others added 2 commits December 16, 2025 10:22

poc uaa throttling

7bae184

Feature: handle rate limiting of UAA server. Fixes cloudfoundry#1307

7728153

Lokowandtg requested review from Kehrlann, anthonydahanne, beyhan and s-yonkov-yonkov and removed request for Kehrlann December 17, 2025 18:55

Lokowandtg mentioned this pull request Dec 17, 2025

UAA ratelimit is not handled and blocks integrationtests #1307

Open

This was referenced Dec 18, 2025

Proof of concept for integration-test UAA throttling #1321

Closed

Feature: handle rate limiting of UAA server. Fix #1307 #1313

Closed

Kehrlann requested changes Dec 18, 2025

View reviewed changes

fix review findings

5a2db7b

-public class ThrottlingUaaClient implements UaaClient {
+/**
+ * An {@link UaaClient} implementation that throttles calls to the UAA
+ * {@code /Groups} and {@code /Users} endpoints. It uses a single "bucket"
+ * for throttling requests to both endpoints.
+ *
+ * @see <a href="https://resilience4j.readme.io/docs/ratelimiter">resilience4j docs</a>
+ */
+public class ThrottlingUaaClient implements UaaClient {

	public ThrottlingUaaClient(ReactorUaaClient delegate, int uaaLimit) {
	public ThrottlingUaaClient(ReactorUaaClient delegate, int maxRequestsPerSecond) {

	int timeBasePerRequest = 1000 / uaaLimit;
	int clockSkewMillis = 20; // 20ms clock skew
	int rateLimitRefreshPeriodMillis = (1000 / maxRequestsPerSecond) + clockSkewMillis;

Feature: handle rate limiting of UAA server. Fixes #1307 #1332

Are you sure you want to change the base?

Feature: handle rate limiting of UAA server. Fixes #1307 #1332

Uh oh!

Conversation

Lokowandtg commented Dec 17, 2025

Uh oh!

Kehrlann left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants