On Fri, Sep 9, 2011 at 4:30 AM, Manuel Haim <span dir="ltr"><<a href="mailto:haim@hrz.uni-marburg.de">haim@hrz.uni-marburg.de</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi Scott,<br>
<br>
just my two cents here...<br>
<div class="im">A bottleneck, however, appears to be in the LDAP JAAS login module at</div>
login time (see login.config). By default, the SearchDnResolver (which<br>
resolves the user's DN according to the specified userFilter) never does<br>
connection pooling, thus the IdP always performs an LDAP BIND here where<br>
it could keep the connection open. We replaced the SearchDnResolver by a<br>
static one for test purposes, and our IdP cluster now handled about<br>
twice as much logins per second. (The IdP is not "blocked" by the LDAP<br>
BINDs, but maybe the number of threads or network connections is at a<br>
limit here?!)<br>
<br>
This issue has been reported at:<br>
<a href="http://code.google.com/p/vt-middleware/issues/detail?id=118" target="_blank">http://code.google.com/p/vt-middleware/issues/detail?id=118</a><br><br></blockquote><div><br></div><div>Support for pooling LDAP connections for authentication will definitely be supported in IDP v3. I can't guarantee it will ever be formally supported in IDP v2, I'll just have to see how the code shakes out.</div>
<div><br></div><div>--Daniel Fisher</div><div><br></div></div>