Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 359672

Summary:	LdapLoginModule#getUserRolesByDn fails when user is in a very large number of groups
Product:	[RT] Jetty	Reporter:	Bill Higgins <billhigg>
Component:	server	Assignee:	Jesse McConnell <jesse.mcconnell>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	normal
Priority:	P3	CC:	janb, jetty-inbox
Version:	unspecified
Target Milestone:	7.5.x
Hardware:	All
OS:	Mac OS X - Carbon (unsup.)
Whiteboard:

Description Bill Higgins

2011-10-02 23:49:05 EDT

Build Identifier: 7.3.1.v20110307

In my company, we use LDAP groups broadly. I configured Jetty to use the LdapLoginModule and ended up with the following query inside the LdapLoginModule#getUserRolesByDn method:

roleBaseDn: ou=memberList,ou=mycogroups,o=myco.com
filter: (&(objectClass=groupOfUniqueNames)(uniquemember=uid=1A3919131,c=us,ou=mycodirectory,o=myco.com))

When I submitted the form that ended up hitting this code, the browser spun forever until it finally quit.

The only workaround I could come up with was to take the intended role name from web.xml (e.g. my-group) and use this as an additional attribute on the roleBaseDn value:

roleBaseDn: cn=my-group,ou=memberList,ou=mycogroups,o=myco.com

This allows the code to succeed but it effectively means that I can only support one role since I restrict the basic search to only that role.

It seems like the Jetty code in LdapLoginModule#getUserRolesByDn is choking on a large number of roles. I would be happy to find a more clever workaround but I am at wit's end.

Reproducible: Always

Comment 1 Bill Higgins

2011-10-02 23:54:31 EDT

I am no LDAP expert but a wild guess is that perhaps you could ask the LDAP server to do more work up front but reduce the total work by running a set of queries where you send in each role that you care about to see if the user is a member.

E.g. today it seems to be asking:

"Tell me all of Bill's roles"

... which in my case seems to be about 500 and is making Jetty unhappy. Perhaps instead the logic could be like this:

"OK, web.xml cares about the 'admin' role and the 'user' role."
" - is Bill in the 'admin' role?"
" - is Bill in the 'user' role?"

Just a thought.

Comment 2 Jesse McConnell

2011-10-06 17:48:50 EDT

Bill,

This isn't an easy fix from a cursory examination of the code.  At issue is that on login we construct an object that contains the basic information we need from the remote data source and the only api we use off of this UserInfo object is at the List level...so getRoleNames() returning everything known about the user.  This makes sense because we can only really mark the user as 'authenticated' when we know we can get all information from the authorities...if we refactored this api would would move authentication and authorization from a one time hit to a more lazy approach that would result in new and exciting ways to fail (i authenticated but now that the webpage is getting loaded we need to check for role A but alas, the ldap is down now and we can't check...what do we do?

But I would be open to figuring out how to make this populating of the roles more bullet proof for your use case...are you getting any sort of timeout exception or anything when this lock up occurs?  I am not an ldap wiz but I did write this login module (least I think I did...been a while)...I'll take a bit of a look to see if I have any knobs I can turn here while I wait for your response.

Comment 3 Jesse McConnell

2011-10-06 18:14:09 EDT

Bill,

I just checked with the experts over at Apache Directory and they said that what we are doing ought to work fine for your use case.  What backend ldap server is this and do you have any stack traces or anything like that available?

If this is easily reproducible and isn't giving you much feedback on what is wrong you could either take a series of thread dumps to see what is taking up the time or better yet would be to profile with something like yourkit so you can easily see what thread is taking up the time and what it is up to..

let me know your findings!

jesse

Comment 4 Bill Higgins

2011-10-07 04:33:28 EDT

Hi Jesse, thanks for your response. I will work on getting the information you asked for and report back. It may take a week or two because I have to track down the right people.

Comment 5 Jesse McConnell

2011-10-26 16:53:21 EDT

Bill, do you have an update on this?  Otherwise I might just close it and you can reopen should you dig up more information in the future.

Comment 6 Bill Higgins

2011-10-26 16:57:38 EDT

Hi Jesse, I am unable to do additional investigation at this point and will stick with my workaround.

I agree with your suggestion of closing it and I will reopen if I get additional supporting data.

Comment 7 Jesse McConnell

2011-10-26 17:00:15 EDT

Bill,

ok good deal, good luck and if you need something you know where we are

cheers,
jesse