Uploaded image for project: 'Apache Knox'
  1. Apache Knox
  2. KNOX-2375

Token state eviction should access the keystore file less frequently

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.4.0
    • Fix Version/s: None
    • Component/s: Server
    • Labels:
      None

      Description

      When the AliasBasedTokenStateService is employed, the TokenStateService reaper loads the keystore file (via the AliasService and KeyStoreService) very frequently.

      1. It queries all the token-state-related aliases
      2. For every token ID
        1. Looks up the token again (validateToken())
        2. Looks up the the token expiration
        3. Removes the token expiration alias
        4. Removes the token max lifetime alias

      This means the KeyStoreService loads the keystore file (1 + 2-to-4-per-token) times every eviction interval (default 5 minutes). That means, if there are 100 expired tokens and 100 unexpired tokens, the reaper will load the keystore file 601 times in one iteration.

      As the keystore file size increases, the already poor performance of loading this file degrades even more to the point that the token state reaper can consume 100% of the CPU.

      The reaper should operate on the in-memory token state as much as possible, and even remove expired token state in bulk (loading / writing the keystore file once for all).

       

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                pzampino Philip Zampino
                Reporter:
                pzampino Philip Zampino
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 3h 10m
                  3h 10m