Is >1 second service time normal for /idp/profile/SAML2/POST/SSO and /idp/profile/SAML2/Redirect/SSO ?

[Cantor, Scott]

On 1/29/14, 6:49 PM, "Cameron Kerr" <cameron.kerr at otago.ac.nz> wrote:

>We¹ve been running our IdP successfully now for at least a year, and are
>beginning to expand the number of services that use it, with our first
>big application recently launched, and the client is really happy with
>how that has gone. So first off, thank you so very much for such a
>wonderful product to work with, it¹s been a real pleasure. The
>implementation and documentation are both excellent examples of how to
>make a product worth supporting.

Thank you.

>What is more of concern are those entries with a high average (and a high
>standard deviation), such as the GET of /idp/profile/SAML2/Redirect/SSO
>with no query string, that produces a 200 response.
> 
>What would be happening when the IdP is evaluating such a request?

Your LDAP server, basically. That's when the attribute resolution takes
place. The IdP has only three basic bottlenecks, login time, attribute
gathering, and crypto. The latter is CPU bound, and the rest are out of
the control of the IdP.

>I wonder if its MySQL related (used for uApprove as well as storing
>shared tokens). And there is a bit of an outlier with
>/idp/uApprove/AttributeRelease. Might enable the slow query logŠ

I can't really speak to uApprove, but MySQL is another case of contacting
a separate system, so yes.

-- Scott