Hello,
I'm experimenting with PAM through authentication and it looks that 389
process parallel requests in serial way.
To demonstrate this behavior I use simple testing script:
for i in `seq 1 10`
do
time ldapsearch -LLL -H ldaps://xxx.cesnet.cz -x \
-b dc=perun-shadow,dc=cesnet,dc=cz \
-D "uid=semik$i,ou=People,dc=perun-shadow,dc=cesnet,dc=cz" \
-w 'zadek' -s base dn &
done
here is part of the output I get:
bind DN [uid=semik6,ou=People,dc=perun-shadow,dc=cesnet,dc=cz]
real 0m2.127s
bind DN [uid=semik10,ou=People,dc=perun-shadow,dc=cesnet,dc=cz]
real 0m4.392s
bind DN [uid=semik1,ou=People,dc=perun-shadow,dc=cesnet,dc=cz]
real 0m6.405s
bind DN [uid=semik5,ou=People,dc=perun-shadow,dc=cesnet,dc=cz]
real 0m8.699s
bind DN [uid=semik2,ou=People,dc=perun-shadow,dc=cesnet,dc=cz]
real 0m10.926s
...
All ldapsearch scripts are executed in background = in parallel way. But
server process them in serial way. I can tell that by increasing time
needed to process ldapsearches. Increment around 2sec is caused by
pam_unix delay because of wrong password.
Is 389 bind process really serialized? Or have I just overlooked some limit?
Configuration of PAM plugin:
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
objectClass: pamConfig
cn: PAM Pass Through Auth
nsslapd-pluginPath: libpam-passthru-plugin
nsslapd-pluginInitfunc: pam_passthruauth_init
nsslapd-pluginType: preoperation
nsslapd-pluginEnabled: on
nsslapd-pluginloadglobal: true
nsslapd-plugin-depends-on-type: database
pamMissingSuffix: ALLOW
pamExcludeSuffix: cn=config
pamIDMapMethod: RDN
pamIDAttr: notUsedWithRDNMethod
pamFallback: FALSE
pamSecure: TRUE
pamService: sshd
nsslapd-pluginId: pam_passthruauth
nsslapd-pluginVersion: 1.2.11.15
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: PAM pass through authentication plugin
nsslapd-pluginarg0: pamIncludeSuffix
nsslapd-pluginarg1: dc=perun-shadow,dc=cesnet,dc=cz
modifiersName: cn=directory manager
modifyTimestamp: 20131101085721Z
Thank you for any suggestions!
--
-----------------------
Jan Tomasek aka Semik
http://www.tomasek.cz/
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
