Memory Usage

[Paul Hethmon]

Matthew,

I'll offer my opinion on this, I'm sure Chad will chime in if I'm way wrong.

The LoginContext is used during the actual login process, just the amount of time the user spends at the IdP prior to being authenticated. So the amount of time there looks to be an arbitrary value to allow a user to get distracted and still complete authentication. Also as an influence on it is the amount of time the SAML AuthnRequest is valid for. You want the user to complete authentication while that guy is still in the valid range. Once a user completes authentication, the LoginContext will be cleared since it is no longer needed/used.

The Replay Cache entry I would expect to live longer to prevent exactly that scenario, someone re-using the AuthnRequest, either maliciously or not. Most often is a user hitting refresh. I've also seen the problem where a browser will cache what should not be cached and resubmitting it. So you want that request to stick around in the replay cache until it would time out from the request expiring its life span.

Paul


From: "Zmuda, Matthew R" <Matthew.R.Zmuda at td.com<mailto:Matthew.R.Zmuda at td.com>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Fri, 3 Feb 2012 11:21:24 -0500
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Memory Usage

Hi all,

I’m doing some investigation around memory consumption of shibboleth in our application and had a couple questions:

In HttpServletHelper bindLoginContext a login context entry is added to storage service:

LoginContextEntry entry = new LoginContextEntry(loginContext, 1800000);

Why is timeout value hard coded at 1800000? Is there a specific reason for this value?

I’m also noticing when user arrived at IDP, 2 LoginContextEntry and 1 ReplayCacheEntry are added.
On the way out only 1 LoginContextEntry is cleared out.

My understanding is that after 1800000 ms the extra login context entry should clear. And after the configured amount of time in internal.xml the ReplayCacheEntry would be cleared out.
Are the ReplayCache and LoginContexctEntry used together? What is the purpose of these sticking around?
I’m hoping to free up memory a quickly as possiblewithout posing security risks.

Thanks,

NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.
AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.

-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120203/2f3562ae/attachment-0001.html