Uploaded image for project: 'Kudu'
  1. Kudu
  2. KUDU-1907

Lock contention in SASL Kerberos negotiation

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 1.3.0
    • Fix Version/s: None
    • Component/s: perf, rpc
    • Labels:
      None

      Description

      Dan wrote a negotiation benchmark and found that we can only do ~600 kerberos negotiations/second regardless of the number of concurrent clients. Looking at stack traces reveals that the SASL GSSAPI plugin adds locks around all GSSAPI calls, though it seems like the underlying GSSAPI library is actually thread-safe. (the locks are a relic from bygone days).

      Given that we are only using a small sliver of Cyrus-SASL functionality, we should consider using libgssapi directly instead of via SASL.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                tlipcon Todd Lipcon
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated: