Jump to:
| Project: | Shibboleth authentication |
| Version: | 6.x-3.3 |
| Component: | Miscellaneous |
| Category: | support request |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed (fixed) |
| Issue tags: | biblio, login, Performance |
Issue Summary
Using the conventional Drupal login, it takes about 10 seconds from pressing submit to being logged in when the site is busy: a live site running very slowly, alas.
Using the Shibboleth login it's taking around 60 seconds to turn around. Our IdP is sending back the results of the attribute query in about 250ms, then the IdP POST is made to http://www.site.edu/Shibboleth.sso/SAML/POST. It's at this point that logging in hangs for almost a minute.
I've had a look through the shib_auth.module code and it all seems pretty basic: it essentially checks the HTTP headers exist, sees if the user already exists (to either login or create a new user), and checks/updates the email address as required. I currently have no rules defined so have ignored all the related functions.
Is there anything else that could be slowing things down? Or is this a comparable performance to other sites? Just wanted to check as I'm about to pull apart shibboleth2.xml and related attribute files.
On campus, other systems using Shibboleth (such as Moodle) usually turn around the login cycle in about 10 seconds so I just wonder what I've done wrong.
Comments
#1
An update on this. Over holiday weekend, quickly took live site down and temporarily replaced site with bare bones D6 install - only included shib_auth and minimal logging. Needless to say nothing wrong with shib_auth module - sign in using same Shib config was fractions of a second.
So it's now down to a dodgy module elsewhere in my Frankenstein's monster of a Drupal site. Most of my other problems have been through the use of Organic Groups, but just wondered if there are any other 'types' of modules I should be on the lookout for? Only thing that puzzles me is that conventional Drupal login on my 'real' site still only takes a second or two, and I cannot see why the shib_auth login path takes about 60sec.
If no responses after a few weeks will close this Issue - it's not the module that's at fault after all - but it is a good forum for any other users to discuss problems with the module. I'm sure every maintainer aims to get to zero open issues...
And if I find the guilty culprit, I will post my findings.
#2
Found the 2 most likely contenders:
I disabled both of the above modules (leaving another 100 or so enabled) and Shib login worked like a dream (with them enabled, login is 60+ secs; disabled, login < 5 secs).
OGUR 1.5 is a dead duck (IMHO), but will look a little more closely at Biblio and report back.
#3
Updating OGUR to version 4.0 is highly recommended... however the real performance killer was Biblio module see #425284-3: Performance issue in biblio_user(), due to a menu_build() call during login. If you can live without the 'My Publications' feature of Biblio, user authentication through Shibboleth is a few seconds. :)
Closing this issue, but please follow Biblio issue if this, too, is a problem for you.