[JBoss JIRA] (ELY-524) RealmIdentity data caching support in the LDAP realm
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-524?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-524:
---------------------------------
Fix Version/s: 1.1.0.Beta16
(was: 1.1.0.Beta15)
> RealmIdentity data caching support in the LDAP realm
> ----------------------------------------------------
>
> Key: ELY-524
> URL: https://issues.jboss.org/browse/ELY-524
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: Realms
> Reporter: David Lloyd
> Assignee: Pedro Igor
> Priority: Critical
> Fix For: 1.1.0.Beta16
>
>
> The LDAP realm should use a caching strategy to avoid excessive database load in the presence of per-request authentication traffic.
> The realm implementation could maintain a synchronized LRU cache of one-time-initialize references to a cached DirContext or Attributes or binding or some combination of these. Because the cache is synchronized, the one-time-initialize object would be added under the lock and then the lock released before the object is populated and returned as a cached credential, allowing atomic action with a minimum of contention.
> For each cached entity, a NamingListener could be established which would invalidate (or possibly update) the cached value as the database changes.
> Alternatively, a NamingListener could be established for all identities, and each update would invalidate or update any cached values corresponding to the DN or resolved name.
> This is a complex design topic so discussion is welcome.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (ELY-773) Where AuthenticationConfiguration has calls to PasswordFactory.getInstance(alg) pass in Supplier<Provider[]>
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-773?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-773:
---------------------------------
Fix Version/s: 1.1.0.Beta16
(was: 1.1.0.Beta15)
> Where AuthenticationConfiguration has calls to PasswordFactory.getInstance(alg) pass in Supplier<Provider[]>
> ------------------------------------------------------------------------------------------------------------
>
> Key: ELY-773
> URL: https://issues.jboss.org/browse/ELY-773
> Project: WildFly Elytron
> Issue Type: Task
> Components: Authentication Client
> Reporter: Darran Lofthouse
> Assignee: David Lloyd
> Priority: Critical
> Fix For: 1.1.0.Beta16
>
>
> This may be obsoleted by ongoing work but just wanted an issue to track where AuthenticationConfiguration and related classes currently uses PaswordFactory.getInstance without passing in a Supplier for Provider[].
> * SetCredentialsConfiguration
> * SetKeyStoreCredentialAuthenticationConfiguration
> * ElytronAuthenticator
> * ElytronXmlParser.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (ELY-770) Review SASL mechanism handling of isComplete()
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-770?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-770:
---------------------------------
Fix Version/s: 1.1.0.Beta16
(was: 1.1.0.Beta15)
> Review SASL mechanism handling of isComplete()
> ----------------------------------------------
>
> Key: ELY-770
> URL: https://issues.jboss.org/browse/ELY-770
> Project: WildFly Elytron
> Issue Type: Task
> Components: SASL
> Reporter: Darran Lofthouse
> Priority: Critical
> Fix For: 1.1.0.Beta16
>
>
> The javadoc of the isComplete() method states: -
> _Determines whether the authentication exchange has completed. This method is typically called after each invocation of evaluateResponse() to determine whether the authentication has completed successfully or should be continued._
> Also getAuthorizationID() states: -
> _Reports the authorization ID in effect for the client of this session. This method can only be called if isComplete() returns true.
> _
> Although the former is very vague there just seem to be a suggestion that complete means successfully complete, our mechs are setting complete very early and other wrappers such as AuthenticationCompleteCallbackSaslServerFactory are using complete as a flag to report failures.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months