0

My Java web application is using an LDAP backend for authentication / authorization. I am currently using a custom socket factory, and want to enable connection pooling for performance reasons.

The confusion starts.

According to the standard JNDI tutorials here, A Context instance cannot use a pooled connection if it has its "java.naming.ldap.factory.socket" property set to a custom socket factory class.

However, according to the official (Java 6) JNDI documentation here, Pooling of connections from a custom socket factory is allowed when java.naming.ldap.factory.socket environment property is set. For the custom socket factory to be pooled the socket factory class must implement the Comparator interface.

Encouraging. What I have done so far:

  • my custom socketfactory implements Comparator<SocketFactory> with a simple comparison of host+port
  • when creating my LdapContext, I do env.put("java.naming.ldap.factory.socket", "portal.ldap.util.PortalSocketFactory") and env.put("com.sun.jndi.ldap.connect.pool", "true")
  • my Tomcat server is started with -Dcom.sun.jndi.ldap.connect.pool.initsize=10 -Dcom.sun.jndi.ldap.connect.pool.maxsize=20 -Dcom.sun.jndi.ldap.connect.pool.prefsize=10 -Dcom.sun.jndi.ldap.connect.pool.timeout=300000 -Dcom.sun.jndi.ldap.connect.pool.protocol="plain ssl" -Dcom.sun.jndi.ldap.connect.pool.debug="all"

Next, a test. I connect to the application, it connects to the LDAP server, and behold - a connection pool is created. Clearly, my custom socketfactory is accepted:

com.sun.jndi.ldap.pool.Pool@26cd2192 {}.get(): 172.17.2.91:636:ssl::portal.ldap.util.PortalSocketFactory:cn=PortalProxy,ou=sa,o=config
com.sun.jndi.ldap.pool.Pool@26cd2192 {}.size: 0
com.sun.jndi.ldap.pool.Pool@26cd2192 {}.get(): creating new connections list for 172.17.2.91:636:ssl::portal.ldap.util.PortalSocketFactory:cn=PortalProxy,ou=sa,o=config
[email protected] size=10; size: 0
[email protected] size=20; size: 0
[email protected] size=10; size: 0
Create com.sun.jndi.ldap.LdapClient@127e942f[172.17.2.91:636]
<snip>
Create com.sun.jndi.ldap.LdapClient@3c7038b9[172.17.2.91:636]
com.sun.jndi.ldap.pool.Pool@26cd2192 {172.17.2.91:636:ssl::portal.ldap.util.PortalSocketFactory:cn=PortalProxy,ou=sa,o=config=com.sun.jndi.ldap.pool.ConnectionsRef@6b9c18ae}.get(): size after: 1
[email protected](): before; size: 10
ConnectionDesc.tryUse() com.sun.jndi.ldap.LdapClient@127e942f idle
[email protected](): use com.sun.jndi.ldap.LdapClient@127e942f; size: 10
Use com.sun.jndi.ldap.LdapClient@127e942f
[email protected](): after; size: 10

BUT you guessed it, something's rotten. Now, every time the application connects, a new pool is instantiated! I can see that the connections are actually pooled, because after the configured 300 seconds, they expire and are removed from the pool:

ConnectionDesc.expire(): not expired com.sun.jndi.ldap.LdapClient@e6c7a64 idle
ConnectionDesc.expire(): expired com.sun.jndi.ldap.LdapClient@39579371 idle
[email protected](): removing com.sun.jndi.ldap.LdapClient@39579371 expired; size: 10
Expired com.sun.jndi.ldap.LdapClient@39579371 expired
ConnectionDesc.expire(): expired com.sun.jndi.ldap.LdapClient@2ada52a1 idle
[email protected](): removing com.sun.jndi.ldap.LdapClient@2ada52a1 expired; size: 9
Expired com.sun.jndi.ldap.LdapClient@2ada52a1 expired
<and so on>

Help! Am I missing some small detail? Has anyone succeeded in getting this to work?

4
  • On a hunch, I have added a debug println() in my socketfactory's compare() method, and ... it is never called by the LdapPoolManager !!
    – mvreijn
    May 27, 2014 at 21:19
  • 1
    It's strange that they specified Comparator and not Comparable. It would make a lot more sense for a socket factory object to compareTo() itself rather than to compare two different objects, one of which is presumably always itself.
    – user207421
    May 27, 2014 at 23:44
  • Agreed. As I understood it (from a post that I cannot find anymore) a new socketfactory (of the custom class) is created that performs the comparison. Seems somewhat dubious.
    – mvreijn
    May 28, 2014 at 8:24
  • I would strongly recommend you move to a current LDAP API. many will have all the pooling classes already provided. -jim
    – jwilleke
    May 28, 2014 at 16:48

1 Answer 1

2

If you have a look at the actual code that does the comparison you'll see that it's definitely a bug. It expects Comparator<String> rather than Comparator<SocketFactory>. classnames of the factories are being passed, not the factories themselves. At a runtime ClassCastException is swallowed and false is returned. That's why you cannot see your "debug println()" from the compare method -- it's never executed.

6
  • It had not come to mind to actually check the java source code. Just checked and it works when I use Comparator<String> ! Now the only drawback is, I have to assume that pooled connections of the same class have the same characteristics. So that would be a bug, yes. Thanks a lot for clearing this up!
    – mvreijn
    Jul 7, 2014 at 19:33
  • On a side note: where would I log this as a bug? Any pointers?
    – mvreijn
    Jul 7, 2014 at 19:37
  • 1
    @mvreijn Next time you see something like this you can log it here: bugs.java.com But this time (if you don't mind) I will save our time and create an issue directly here: bugs.openjdk.java.net
    – pavel
    Jul 7, 2014 at 20:50
  • I have to assume that pooled connections of the same class have the same characteristics You mean of the same Class<T> where T extends SocketFactory, right? If that's true, than would it be different if you used comparison by instance of T rather than by Class<T>? I mean that the general assumption (by design) is that given any 2 instances of ? extends SocketFactory we can tell whether we can use connections created by them interchangeably.
    – pavel
    Jul 7, 2014 at 21:01
  • 1
    @mvreijn Don't worry, server/port combination is managed. Unfortunately, it's not that clear from documentation. Have a look here and here. ClientId takes care of these things in equals. Instances of ClientId are used as keys in Pool's Map.
    – pavel
    Jul 7, 2014 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.