2

I have an Ubnutu 12.04 server running Apache2 that is configured as a reverse proxy. Apache has been further configured for basic authentication via LDAP. Everything is working fine, except the performance is a bit laggy. The LDAP Auth directives are:

    <Location />
            AuthType Basic
            AuthBasicProvider ldap
            AuthName "Secure Intranet"
            AuthLDAPURL ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int

            AuthzLDAPAuthoritative on
            AuthLDAPGroupAttribute memberUid
            AuthLDAPGroupAttributeIsDN off
            Require ldap-group cn=development,ou=groups,ou=MyCorp,dc=mylan,dc=int
    </Location>

Upon inspection, I noticed that for every request Apache is going back to my OpenLDAP server to run a search/bind for the particular user!!! Depending on the HTML of the site behind the proxy, some requests (e.g. JIRA) can result in 10 or 15 search/bind LDAP calls over the LAN. I know this because I am tailing the OpenLDAP log while browsing. Yikes!

According to the Apache2 ldap documentation, mod_ldap should be caching these things by default. Thinking that perhaps the documentation was wrong, I added these directives in ldap.conf:

    LDAPSharedCacheSize 500000
    LDAPCacheEntries 1024
    LDAPCacheTTL 600
    LDAPOpCacheEntries 1024
    LDAPOpCacheTTL 600

But it made no difference.

Edit:

Using lynx on the server to access https://localhost/ldap-status returned the following:

    LDAP Cache Information

   Cache Name                                                             Entries           Avg. Chain Len. Hits   Ins/Rem Purges Avg Purge Time
   LDAP URL Cache                                                         1 (0% ull)           1.0 282/283 100%     1/0 (none)            0ms
   ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int (Searches)   3 (0% full)          1.0 138/154  90%     6/3 (none)            0ms
   ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int (Compares)   3 (0% full)          1.0 138/148  93%     6/3 (none)            0ms
   ldaps://virt-ldap.mylan.int:636/ou=MyCorp,dc=mylan,dc=int (DNCompares) 0 (0% full)          0.0     0/0 100%     0/0 (none)            0ms

So it seems like the cache is working, though I am not sure what exactly these numbers mean. I am still getting tons of LAN hits against the LDAP server.

1 Answer 1

1

Two things come to mind:

  • Have you tried looking at the cache status. If so, what does it say?
  • Is shared memory enabled?
4
  • Added the ldap-status info above. Re the shared memory, how can I check if it is enabled? How would I enable it? FYI - running Apache 2.2.22.
    – Dave
    Mar 28, 2013 at 14:06
  • Easy check would be to see if the numbers in ldap-status jump around when you refresh. Mar 28, 2013 at 14:14
  • Yes, they go up when I refresh. It must be the relationship between Apache and the server it is reverse proxying. I'll look into that.
    – Dave
    Mar 28, 2013 at 14:42
  • Indeed it was a weird interaction between the Apache2 reverse proxy and the server configuration (at least for JIRA). This documentation explicitly states that caching is disabled in this case: confluence.atlassian.com/display/JIRA/…
    – Dave
    Mar 28, 2013 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .