Details
-
Feature Request
-
Resolution: Unresolved
-
L3 - Default
-
None
-
None
-
None
Description
Given:
- REST API with enabled HTTP Basic Authentication
- LDAP engine plugin is enalbed
Behavior:
Whenever a request is sent to the REST API, then the default HttpBasicAuthenticationProvider checks the given password. Therefore a request is sent to the configured LDAP to fetch the related user information. Afterwards the given password is checked.
Problem:
In a scenario, where multiple requests are received by the REST API, ends up with multiple requests to the configured LDAP. Even when the requests to the REST API is always from the same user.
Due to the amount of requests in a short time this leads to the problem, that the LDAP server does not respond anymore.
Users observed that authentication against the LDAP does just take parts of the time, but loading the authorization data takes a long time. One workaround is https://github.com/camunda-consulting/code/tree/master/snippets/authentication-filter-with-bypass
Desired behavior:
- There should be some kind of caching of the (LDAP) authentication. This could be done either in the REST API or in the LDAP engine plugin.
- There should be a configuration option to determine how long the authentication should be cached.