Thanks to visit codestin.com
Credit goes to Github.com

Skip to content

[BUG] OPAQUE password verification potentially blocks async runtime during bind operations #1337

@PerArneng

Description

@PerArneng

Describe the bug
When doing bind in LoginHandler the password_match function uses the opaque cryptographic algorithm which seems to be very CPU bound. From what it seems it looks like it should be put in a spawn_blocking function not to block the async thread pool.

To Reproduce
It's a performance issue so you would need to run benchmarks and compare. I'ts hard to reproduce, because it's just there.

Expected behavior
Faster performance when doing bind with multiple parallel requests.

Logs
N/A

Additional context
We had some performance issues with lldap and a 3rd party system that acted crazy, and did some research and we found that the OPAQUE method was used and it seemed very CPU hungry and reading about it on lldap GitHub page as well, it seemed like that was a fact.

It's even more visible if the core count is low ex if you run in a Kubernetes environment and set limits or have low core count nodes. One of our third party systems started to spam lldap with lots of bind's on each normal request instead of reusing sessions (crazy, I know) . But that led us to investigate. In an normal scenario you might not see this issue so often but putting it out of the async thread pool when executing OPAQUE might give a bit of performance boost when dealing with multiple requests.

Disclaimer: Im pretty novice when it comes to async rust runtimes low level stuff so I could be mistaken here but then please just close the bug.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions