The performance of Shibboleth

[Cantor, Scott]

On 9/17/13 10:24 AM, "HaiJun Deng" <dhjnavy at gmail.com> wrote:

>In that post, it says "A single c1.medium instance running the IdP in
>Jetty
>without Terracotta and a million user records and a standard set of
>attributes in an LDAP directory with authentication randomly choosing one
>of
>them can handle roughly 65 transactions per second."
>it seems that the SP does nothing except sending the authentication
>request.

The SP does a lot of things, but the IdP can be load tested with no real
involvement from an SP. Regardless, the typical way people approach their
requirements for the IdP is crazy. They will throw out numbers like 500
logins per second with no earthly clue how many actual logins per second
they would have. Usually that number is 100 or more times lower than it's
claimed to be even at peak.

>Anyway, I am here not to belittle the performance of the shibboleth, i
>just
>wonder what the usual throughput the IdP can achieve without thinking of
>the
>effection of SP and APP.

And that is an unanswerable question. Software runs as fast as the
hardware you put it on constrained by the other back end components it has
to rely on.

An IdP is either I/O bound due to database or directory issues, or CPU
bound from cryptography. The latter scales linearly a long way, and if
configured statelessly, it scales linearly across essentially any amount
of hardware. I don't even think it's ever been tested with a PKCS12 module
to do the signing, which might boost performance by an order of magnitude.

-- Scott