<div dir="ltr">On Fri, Apr 5, 2013 at 1:26 PM, Mosior, Benjamin <span dir="ltr"><<a href="mailto:BEMosior@ship.edu" target="_blank">BEMosior@ship.edu</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Scott,<br>
<br>
I'll attempt to explain what I mean.<br>
<br>
>From a design perspective, unnecessary complexity introduces the potential for additional points of failure (such as overlapping usernames and multiple SSL certificates to maintain [if LDAPS]), not to mention how much more involved troubleshooting can become. As detailed as the documentation is, Shibboleth still ends up being something of a monolith at first approach for the inexperienced or overloaded. For that reason, I advocate simplicity in the overall system design if possible. Of course, changing an existing system can be difficult in some circumstances, so if the complexity issue can be handled by a workaround (such as the failover method for cross-domain authentication in the IdP), that's wonderful.<br>
<br>
As far as performance, the Shibboleth IdP certainly does an excellent job of minimizing the issue. However, consider the scenario where the IdP is offered as part of a SaaS hosting project. The IdP is hosted by a vendor, while the authentication backend still resides at the client site. The inherent connection latency and SSL negotiation times become noticeable when the number of binds double because two LDAPS connections need to be made for authn (four, if attribute retrieval is included). The same sorts of issues may appear if 'x' number of JAAS configurations are chained together. By the time it hits the final mechanism, a login failure's return time may very well be atrocious.<br>
</blockquote><div><br></div><div style>If you want pooling in the JAAS layer you can try this module: <a href="http://www.ldaptive.org/docs/guide/jaas#TOC-Pooling">http://www.ldaptive.org/docs/guide/jaas#TOC-Pooling</a></div>
<div style>If you decide to give it a try, please report back. (I've not tested it in v2...)<br></div><div style>I'm curious as to the real world performance gains as well.</div><div style><br></div><div style>--Daniel Fisher</div>
<div style><br></div></div></div></div>