Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-7133330

LDAP/SSL Performance degradation in JDK 1.6.0_29/30

    Details

    • Subcomponent:
    • CPU:
      x86, sparc
    • OS:
      solaris_10, windows_7

      Description

      I am making minor corrections to the original submission. I confirmed with the submitter that he meant to say that this last worked in 6u27, but in a couple places, he had written 6u29. Marking with 6u27.


      FULL PRODUCT VERSION :
      java version "1.6.0_30"
      Java(TM) SE Runtime Environment (build 1.6.0_30-b12)
      Java HotSpot(TM) 64-Bit Server VM (build 20.5-b03, mixed mode)

      ADDITIONAL OS VERSION INFORMATION :
      This seems to affect us on every OS we have tested it on. Here are the specific OS we have tried:
      Windows 7:
      Microsoft Windows [Version 6.1.7601]

      Red Hat Linux:
      Linux <deleted> 2.6.18-274.17.1.el5 #1 SMP Wed Jan 4 22:45:44 EST 2012 x86_64 x86_64 x86_64 GNU/Linux

      Mac:
      Darwin <deleted> 11.2.0 Darwin Kernel Version 11.2.0: Tue Aug 9 20:54:00 PDT 2011; root:xnu-1699.24.8~1/RELEASE_X86_64 x86_64 i386

      EXTRA RELEVANT SYSTEM CONFIGURATION :
      This problem occurs on a plain installation of the 1.6.0_29 or 1.6.0_30 version of the JDK.

      A DESCRIPTION OF THE PROBLEM :
      We have a library which many of our Java applications use to connect via LDAP to retrieve information from Active Directory. Using any JDK after 1.6.0_27 causes a severe performance hit when doing any query against Active Directory. In versions of the JDK up to 1.6.0_27 these queries would take a few milliseconds at most, but they are now taking 200ms+ per query. This slowness appears to be coming during the read and write to a secure socket.

      Here is a small snippet of code we use to initialize the InitialDirContext which we use to query ADS:

      Hashtable<String, String> env = new Hashtable<String, String>();
      env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
      env.put("com.sun.jndi.ldap.connect.timeout", "5000");
      env.put(Context.PROVIDER_URL, "...");
      env.put(Context.SECURITY_AUTHENTICATION, "simple");
      env.put(Context.SECURITY_PRINCIPAL, "...");
      env.put(Context.SECURITY_CREDENTIALS, "...");
      env.put(Context.SECURITY_PROTOCOL, "ssl");
      return new InitialDirContext(env);

      Note: If we set the security protocol to "plain" the connection is as fast as it used to be, though unsecure.

      If there is any more information which I can provide to help you debug this issue please let me know.

      REGRESSION. Last worked in version 6u27

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      1. Initialize DirContext to connect to LDAP (see description for the properties we are setting for the connection)
      2. Query for attributes

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      Querying an LDAP connection which uses the SSL protocol should take a few milliseconds at most.
      ACTUAL -
      During one test case the queries we run against LDAP are taking somewhere around 200 ms per query. This causes a common use case for the library we use to connect to LDAP to take around 50 seconds to return when it would take around one second with any JDK before 1.6.0_29.

      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      There are no error messages

      REPRODUCIBILITY :
      This bug can be reproduced always.

      ---------- BEGIN SOURCE ----------
      We can supply this if necessary but the library that generates this issue contains several thousand lines of code so it's too large to paste here.
      ---------- END SOURCE ----------

      CUSTOMER SUBMITTED WORKAROUND :
      We have two potential workarounds, though neither are a good fix to this issue:
      1. Use a plain, unencrypted connection to LDAP
      2. Copying the jre/lib/jsse.jar from the 1.6.0_27 JDK into the 1.6.0_30 version appears to fix this issue.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                xuelei Xue-Lei Fan
                Reporter:
                webbuggrp Webbug Group
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Imported:
                  Indexed: