I'm running a Grails app (Grails 2.4.2) as a REST server, in which I use spring-security-core v2.0.0..
My app works well most of the time until some strange things happen that make the login extremely slow (over a minute or two). My thread dump shows that there're 20 to 30 threads stuck at Bcrypt.encipher function.
Normally spring security takes around 100ms to login. When the issue happens, it takes around 2 minutes, sometimes even longer.
Here's the stacktrace:
at org.springframework.security.crypto.bcrypt.BCrypt.encipher(BCrypt.java:487)
at org.springframework.security.crypto.bcrypt.BCrypt.key(BCrypt.java:556)
at org.springframework.security.crypto.bcrypt.BCrypt.crypt_raw(BCrypt.java:623)
at org.springframework.security.crypto.bcrypt.BCrypt.hashpw(BCrypt.java:696)
at org.springframework.security.crypto.bcrypt.BCrypt.checkpw(BCrypt.java:770)
at org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder.matches(BCryptPasswordEncoder.java:89)
at grails.plugin.springsecurity.authentication.encoding.BCryptPasswordEncoder.isPasswordValid(BCryptPasswordEncoder.java:44)
at org.springframework.security.authentication.dao.DaoAuthenticationProvider.additionalAuthenticationChecks(DaoAuthenticationProvider.java:85)
at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:149)
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
at org.springframework.security.authentication.AuthenticationManager$authenticate$3.call(Unknown Source)
I've tried all the ways I can do but couldn't reproduce the issue. It happens totally random to me.
My stack:
Server: CentOS 6.6
Container: Tomcat 7
DBMS: MySQL (InnoDB)
Grails version 2.4.2
Spring Security Core plugin version 2.0.0
Spring Security version 3.2.9.RELEASE (spring-security-core 2.0.0's dependency)
Have anyone ever run into the same problem? Can anyone help point out what the random factor is and how to reproduce the hang?
Many thanks!