Common Ldap handler connection pooling

Registered by Arun Kant

Currently LDAP API handler establishes new connection for identity data (user, group) lookup which becomes quite costly when TLS support is enabled. With TLS enabled, establishing new connection is quite expensive so idea is to re-use already established pool of connections.

So locally we tried to optimize ldap lookup by using connection pooling (https://pypi.python.org/pypi/ldappool/1.0) and that has improved performance numbers by 30%. This package has MPL license and change has been requested to add this in global requirements (https://review.openstack.org/#/c/95842/).

By default, connection pooling is going to be disabled. Configuration parameters are going to be added for enabling, pool size, number of re-try attempts, delay in retries. These configuration is going to be added in existing config section, ldap

Adding text from initial bug opened related to this.
Bug# https://bugs.launchpad.net/keystone/+bug/1320997

In performance testing with 100 concurrent users, with OpenLdap as ldap server, we observed that ldap identity backend takes around 9-15 times more time (around 7-10 seconds) with respect to mysql identity backend. And 77% of time is spent in ldap data retrieval for authentication request.

This request is to make similar enhancement in LDAP handler code to use connection pooling.

Blueprint information

Status:
Complete
Approver:
None
Priority:
Undefined
Drafter:
Arun Kant
Direction:
Needs approval
Assignee:
Arun Kant
Definition:
New
Series goal:
None
Implementation:
Implemented
Milestone target:
None
Started by
Morgan Fainberg
Completed by
Morgan Fainberg

Related branches

Sprints

Whiteboard

Gerrit topic: https://review.openstack.org/#q,topic:bp/ldap-connection-pooling,n,z

Addressed by: https://review.openstack.org/95300
    Adding support for ldap connection pooling.

(?)

Work Items

This blueprint contains Public information 
Everyone can see this information.

Subscribers

No subscribers.