I have an Ubnutu 12.04 server running Apache2 that is configured as a reverse proxy. Apache has been further configured for basic authentication via LDAP. Everything is working fine, except the performance is a bit laggy. The LDAP Auth directives are:
<Location />
AuthType Basic
AuthBasicProvider ldap
AuthName "Secure Intranet"
AuthLDAPURL ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int
AuthzLDAPAuthoritative on
AuthLDAPGroupAttribute memberUid
AuthLDAPGroupAttributeIsDN off
Require ldap-group cn=development,ou=groups,ou=MyCorp,dc=mylan,dc=int
</Location>
Upon inspection, I noticed that for every request Apache is going back to my OpenLDAP server to run a search/bind for the particular user!!! Depending on the HTML of the site behind the proxy, some requests (e.g. JIRA) can result in 10 or 15 search/bind LDAP calls over the LAN. I know this because I am tailing the OpenLDAP log while browsing. Yikes!
According to the Apache2 ldap documentation, mod_ldap should be caching these things by default. Thinking that perhaps the documentation was wrong, I added these directives in ldap.conf:
LDAPSharedCacheSize 500000
LDAPCacheEntries 1024
LDAPCacheTTL 600
LDAPOpCacheEntries 1024
LDAPOpCacheTTL 600
But it made no difference.
Edit:
Using lynx on the server to access https://localhost/ldap-status
returned the following:
LDAP Cache Information
Cache Name Entries Avg. Chain Len. Hits Ins/Rem Purges Avg Purge Time
LDAP URL Cache 1 (0% ull) 1.0 282/283 100% 1/0 (none) 0ms
ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int (Searches) 3 (0% full) 1.0 138/154 90% 6/3 (none) 0ms
ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int (Compares) 3 (0% full) 1.0 138/148 93% 6/3 (none) 0ms
ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int (DNCompares) 0 (0% full) 0.0 0/0 100% 0/0 (none) 0ms
So it seems like the cache is working, though I am not sure what exactly these numbers mean. I am still getting tons of LAN hits against the LDAP server.