[Freeipa-devel] threading issues

[Rob Crittenden]

Kevin McCarthy wrote:
> I wanted to put on the list to review threading issues.  Now that
> we're using TG in a mod_proxy setting, we have to be concerned about
> threading issues.
> 
> Right now, the web gui is (incorrectly) allocating a shared IPAServer
> object (by allocating a shared IPAClient).  Unfortunately there are two
> issues here:
> 
> 1) The self.princ and self.krbccache are being set on each request -
>    which obviously won't work with multiple threads
> 
> 2) The IPAConnPool isn't using locks around self.freelist
> 
> The first change that has to happen is the web gui should allocate an
> IPAClient for each request (I'll make that change).
> 
> However, this loses any connection pool benefits.  To fix this, we could
> separate IPAConnPool from IPAServer and implement Locks at the right
> places.
> 
> Any opinions?
> 
> -Kevin

It isn't really doing connection pooling anymore. Each connection is 
created/torn down for each API call. The pooling was done when we were 
binding using the SSL cert and using proxying.

We can't do pooling with kerberos because the credentials cache will 
disappear when the current HTTP request is finished.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20071008/d33d1d7d/attachment.bin>