Slow respone of IdP in Jmeter tests

[Gernot Hassenpflug]

Hello all,

I am having trouble figuring whte the authentication of a user is
taking so long in Jmeter tests.  I cannot tell at the moment whether
the problem is with the Jmeter tests, with the IdP setup, or the setup
of the LDAP server which the IdP is using.
Any trouble-shooting advice much appreciated.

 Systems:
   1)  IdP 2.5.1 on 32-bit CentOS 4.8 with Apache 2.2.21 and Tomcat 5.5.35, with 4CPUs ad 4GB of RAM.
   2)  SP 2.4.3 on 32-bit CentOS 4.8 with Apache 1.3 (mod_perl for our application), with 4CPUs and 32GB of RAM.
   3)  LDAP 2.3.43 on 32-bit CentOS4.8, with 4CPUs and 4GB of RAM.
   4)  The Jmeter test server runs jmeter 2.7 on CentOS5.8. It has 16CPUs and 8GB of RAM.

   Severs 1,2,3 are all ESXi VMs on the same network segment. Sever 4 is a stand-alone machine.

Response problem:

For 20 users, the IdP's /idp/Authn/UserPassword POST takes over 10s max, average 7s-8s but can also be over 10s.
For 100 users the max is around 85s.
Other test responses are less than 1s average for 20 users, and 3s-6s average for 100 users.


Data and cookie management setup:
- CSV Data Set Config: specify params.csv file and its commma-delimited content (usernames and passwords, one pair per line).
- HTTP Cookie Manager: default configuration

My test steps in Jmeter are as follows, based on recording a login session with Jmeter's proxy and recording capability (all accesses are via HTTPS), average times in seconds given for 20 users:

1) GET: Access to Shibboleth-protected URL on SP (/ct) [0.105s].
2) POST: /idp/Authn/UserPassword on IdP, sending parameters j_username and j_password which get their values from a params.csv file that Jmeter looks at to read the user name and password records (one pair per line) [14.2s].
3) POST: /Shibboleth.sso/SAML2/POST on SP, sending parameters RelayState and SAMLResponse [4.1s].
4) GET: Access the Shibboleth-protected URL again. Same as step (1) [0.7s].
5) GET: Access the Shibboleth-protected URL for login page (/ct/login) [0.5s].
6) GET: Access the Shibboleth-protected URL for user home page (/ct/home) [0.7s].
7) GET: Access the Shibboleth-protected URL for user personal home page (/ct/home_mypage) [0.5s].
8) GET: Access the Shibboleth-protected URL for user logout (/ct/logout) [0.1s].
9) POST: /Shibboleth.sso/Logout on SP [0.1s].
10)GET: redirect to an off-site page temporarily (company home page) [0.08s].

Settings in IdP:

I have set the RefAliases in the shibboleth configurations on the IdP:

The IdP login.conf contains:

   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://220.157.253.114:389"
      bindDn="cn=Manager,dc=sptest,dc=manaba,dc=jp"
      bindCredential="idp-ldap"
      baseDn="ou=Users,dc=sptest,dc=manaba,dc=jp"
      ssl="false"
      userFilter="uid={0}"
      derefAliases="never";

/opt/shibboleth-idp/conf/attribute-resolver.xml has an addition to resolver:DataConnector：

    <LDAPProperty name="java.naming.ldap.derefAliases" value="never"/>

In apache's ssl.conf the client certificate options are set to:
   SSLVerifyClient optional_no_ca
   SSLVerifyDepth  10


The IdP logs show that the parameters are being sent to the SP, there
are no obvious errors, and the SP logs also do not indicate any errors.

Any helpful hints for trouble-shooting will be much appreciated.
Best regards,
-- 
Gernot Hassenpflug