topic Re: LDAP connection leaks for activiti-rest-webapp in Alfresco Archive

LDAP connection leaks for activiti-rest-webapp

gregdavisfromnj — Tue, 10 Nov 2015 22:19:44 GMT

I've recently started doing some load testing, and am finding that when deployed in Tomcat, and with version 5.17.0, the REST Web Application is leaking LDAP connections when configured to use LDAP authorization.I've setup a context XML file to configure the application, with the LDAP config parts l

Re: LDAP connection leaks for activiti-rest-webapp

gregdavisfromnj — Wed, 11 Nov 2015 17:15:26 GMT

When I set the connection pooling properties when starting the JVM (rather than or at least in addition to the bean config above), I see the connection count ramp up, then drop every few minutes. So it looks like I am not setting those properties in the bean config properly… or they don't belong there.

As an aside, I also upgraded to JDK 8 when upgrading to 5.17.0 (that was not a great idea, should have changed one thing at a time). The difference may be in whether or not pooling is opportunistically turned on in JDK 8 vs 7. A line from the Oracle docs indicate that the behavior I am seeing is in line with a idle connections waiting to garbage collect, and when no timeout is set. See the section on Idle Connections at http://docs.oracle.com/javase/7/docs/technotes/guides/jndi/jndi-ldap.html :

When the application is finished with a pooled connection (by invoking Context.close() on all contexts that share the connection), the underlying pooled connection is marked as idle, waiting to be reused. By default, idle connections remain in the pool indefinitely until they are garbage-collected. If the "com.sun.jndi.ldap.connect.pool.timeout" System property has been set, the LDAP provider will automatically close and remove pooled connections that have been idle for more than the specified period.

I have tuned the garbage collection settings to avoid stop-the-world collection events… and it seems that is highlighting the potential for the file descriptor leak when the pooling settings are overly reliant on garbage collection for resource cleanup.

Re: LDAP connection leaks for activiti-rest-webapp

gregdavisfromnj — Wed, 11 Nov 2015 17:56:18 GMT

With my pooling properties… there is a different problem. For an LDAP pool maxsize=10, I can issue 10 HTTP requests to the REST web app. Thereafter, it hangs, but I don't see any errors in the catalina.out file about exceeding file descriptor limits.

Re: LDAP connection leaks for activiti-rest-webapp

srini_n — Thu, 17 Mar 2016 23:06:18 GMT

Hi,
I am running into a hotspot with BasicAuthenticationProvider authenticating requests (with LDAP) to Activiti-Rest. 99% of the time taken by the requests are spent in JNDI. I assume I will need some kind of connection pooling for LDAP. Did you get your configuration working correctly? I am using Activiti 5.19.2.
Thanks

Re: LDAP connection leaks for activiti-rest-webapp

gregdavisfromnj — Fri, 18 Mar 2016 13:04:41 GMT

It works, but only with forced periodic garbage collection. At some point I'm going to look into just using Spring LDAP authentication rather than the Activiti authentication. But I suspect I'll have the same problems with the Oracle LDAP client.

If you are burning CPU inside of JNDI, make sure that you have your filters defined as tight as possible. It sounds like you are getting back too many results from the LDAP server to evaluate. Try using JXplorer or LDAPBrowser to replicate the authentication queries, so you see what Activiti is dealing with from the LDAP server.