hi guys, we are using cas to authenticate users via spnego/kerberos. recently we had some trouble with our kdc wich lead to an investigation. among other things we discovered, that there were a lot of threads waiting in:
org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler.doAuthentication(org.jasig.cas.authentication.Credential) @bci=9, line=85 the one they are waiting for was: Thread 33511: (state = IN_NATIVE) - java.net.PlainDatagramSocketImpl.receive0(java.net.DatagramPacket) @bci=0 (Compiled frame; information may be imprecise) - java.net.AbstractPlainDatagramSocketImpl.receive(java.net.DatagramPacket) @bci=2, line=144 (Compiled frame) - java.net.DatagramSocket.receive(java.net.DatagramPacket) @bci=322, line=812 (Compiled frame) - sun.security.krb5.internal.UDPClient.receive() @bci=29, line=206 (Compiled frame) - sun.security.krb5.KdcComm$KdcCommunication.run() @bci=148, line=411 (Compiled frame) - sun.security.krb5.KdcComm$KdcCommunication.run() @bci=1, line=364 (Compiled frame) - java.security.AccessController.doPrivileged(java.security.PrivilegedExceptionAction) @bci=0 (Compiled frame) - sun.security.krb5.KdcComm.send(byte[], java.lang.String, boolean) @bci=398, line=348 (Compiled frame) - sun.security.krb5.KdcComm.sendIfPossible(byte[], java.lang.String, boolean) @bci=4, line=253 (Compiled frame) - sun.security.krb5.KdcComm.send(byte[], boolean) @bci=157, line=229 (Compiled frame) - sun.security.krb5.KdcComm.send(byte[]) @bci=37, line=200 (Compiled frame) - sun.security.krb5.KrbAsReqBuilder.send() @bci=41, line=316 (Compiled frame) - sun.security.krb5.KrbAsReqBuilder.action() @bci=17, line=361 (Compiled frame) - com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(boolean) @bci=535, line=776 (Compiled frame) - com.sun.security.auth.module.Krb5LoginModule.login() @bci=280, line=617 (Compiled frame) - sun.reflect.GeneratedMethodAccessor108.invoke(java.lang.Object, java.lang.Object[]) @bci=40 (Compiled frame) - sun.reflect.DelegatingMethodAccessorImpl.invoke(java.lang.Object, java.lang.Object[]) @bci=6, line=43 (Compiled frame) - java.lang.reflect.Method.invoke(java.lang.Object, java.lang.Object[]) @bci=56, line=497 (Compiled frame) - javax.security.auth.login.LoginContext.invoke(java.lang.String) @bci=269, line=755 (Compiled frame) - javax.security.auth.login.LoginContext.access$000(javax.security.auth.login.LoginContext, java.lang.String) @bci=2, line=195 (Compiled frame) - javax.security.auth.login.LoginContext$4.run() @bci=8, line=682 (Compiled frame) - javax.security.auth.login.LoginContext$4.run() @bci=1, line=680 (Compiled frame) - java.security.AccessController.doPrivileged(java.security.PrivilegedExceptionAction, java.security.AccessControlContext) @bci=0 (Compiled frame) - javax.security.auth.login.LoginContext.invokePriv(java.lang.String) @bci=13, line=680 (Compiled frame) - javax.security.auth.login.LoginContext.login() @bci=26, line=587 (Compiled frame) - sun.reflect.GeneratedMethodAccessor106.invoke(java.lang.Object, java.lang.Object[]) @bci=36 (Compiled frame) - sun.reflect.DelegatingMethodAccessorImpl.invoke(java.lang.Object, java.lang.Object[]) @bci=6, line=43 (Compiled frame) - java.lang.reflect.Method.invoke(java.lang.Object, java.lang.Object[]) @bci=56, line=497 (Compiled frame) - jcifs.spnego.Authentication.processKerberos(java.lang.String, byte[]) @bci=244, line=426 (Compiled frame) - jcifs.spnego.Authentication.processSpnego(byte[]) @bci=183, line=346 (Compiled frame) - jcifs.spnego.Authentication.process(byte[]) @bci=48, line=235 (Compiled frame) - org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler.doAuthentication(org.jasig.cas.authentication.Credential) @bci=25, line=87 (Compiled frame) the corresponding code from jcifs.spnego.Authentication.JCIFSSpnegoAuthenticationHandler (see http://grepcode.com/file/repo1.maven.org/maven2/org.jasig.cas/cas-server-support-spnego/4.0.3/org/jasig/cas/support/spnego/authentication/handler/support/JCIFSSpnegoAuthenticationHandler.java?av=f) is try { // proceed authentication using jcifs synchronized (this) { this.authentication.reset(); this.authentication.process(spnegoCredential.getInitToken()); principal = this.authentication.getPrincipal(); nextToken = this.authentication.getNextToken(); } } catch (final jcifs.spnego.AuthenticationException e) { throw new FailedLoginException(e.getMessage()); } it seems, that the communication with the kdc is synchronized, which means not multithreaded, which means only one user can authenticate at a given time. this seems like a serious bottleneck, especially if the kdc is not really fast or there is some kind of communication problem. while one user is waiting for the kdc timeout (3x 30s default), all other users are waiting too. so my question is: is there a way around this? thx in advance, uzi -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/f8d002c9-e2ea-4185-a2d3-62a63625c9aa%40apereo.org. For more options, visit https://groups.google.com/a/apereo.org/d/optout.
