Tips: Do not index virtual attributes in OpenDJ

OpenDJ-300x100OpenDJ, the open source LDAP directory service in Java, offer some interesting services to reduce and optimize the size and usage of data.

One of them is the Virtual Attribute feature, which allow certain attributes and values to be computed as needed, either based on some of the server internals or other attributes. OpenDJ ships with a number of virtual attributes by default : entryDN, entryUUID, etag, gouverningStructureRule, hasSubordinate, isMemberOf, numSubordinate, password Expiration Time (ds-pwp-password-expiration-time), structuralObjectClass, subSchemaSubEntry, …

Since these attributes are virtual and thus not stored as part of the entries in the database backend, you must not define any index for them. When possible, the virtual attribute provider will make use of default system index (like entryDN uses the DN index), but most of the time, these attributes are for reading and consuming.

If you do configure an index for one of the virtual attribute, the server will repeatedly report that the index is degraded with an error message similar to the following :

[21/Jan/2013:09:16:07 +0000] category=JEB severity=NOTICE msgID=8847510 msg=Due to changes in the configuration, index dc_example_dc_com_entryDN is currently operating in a degraded state and must be rebuilt before it can be used

And then some seaches may fail to return entries. So you must delete this index to let the server behave properly.

OpenDJ Roadmap Update…

OpenDJ-300x100It took us some time to evaluate and refine the roadmap for OpenDJ, but it’s finally there. We’ve updated the Roadmap on the wiki, and set a date for the next release of OpenDJ.

The first change decided is that the next release will be versioned 2.6. We got the feedback that the versioning scheme with Xpress releases and final releases with the same version number is confusing. Moving forward, we will try to keep the following scheme : a stable release will have an even minor number and development releases will have an odd number.

We’ve also set the date for the release to end of Q2 of 2013 (end of June).

The REST to LDAP service has now been integrated in OpenDJ server, although not fully featured yet. The team is working really hard to deliver the remaining features by June, and closing the few remaining important defects. If you want to start evaluating the REST to LDAP service, just grab a recent nightly build. Mark is doing a great job of documenting the REST features as they become available.

We will soon make the RPM and Debian packages available for tests with the nightly builds, along with the new upgrade mechanism, and then enter a cycle of stabilization before the 2.6.0 release.

Feedback is important for us, so please download and test the nightly builds, report success via email or issues in our bug tracking tool.

Devoxx France 2013

DevoxxFR 2013, the conference for passionate developers that took place in Paris France last week , is over and the long easter week-end after it was well appreciated. The 3 days conference has been great for ForgeRock, and so busy for the whole staff that I couldn’t find the time to blog or even tweet during the conference. I spent most of my time on the booth, and didn’t get a chance to see any session. The only sessions I could fully participate in were the JUG Leaders BOF and my own Conference presentation about “Security for enterprises in a cloudy and mobile world” (See the presentation in French, on Parleys). That presentation was well attended and seemed to have caught interest, by judging from the number of questions that were asked during and after the presentation.
LP0_7549Our booth has been busy. We’ve had interesting discussions with developers, architects, consultants about our company, about our products. We met a few members of our community, already using our products, and even customers 🙂
We’ve also discussed with a few engineers interested in the job positions that we have open in our Research and Development center in Grenoble, both in product development and quality engineering.

I’d like to thank the organizers for the great conference. And I hope that we’ll be able to have a strong presence next year.

You can find my photo album from Devoxx France 2013 on G+.

OpenDJ presented at the LavaJUG

As I mentioned last week, I was presenting OpenDJ and server performances in Java at the LavaJUG on Thursday.
Ludo@LavaJUG

The session was broadcasted live on Google Hangout, unfortunately due to a nice blue screen, in 2 parts. You can watch them here:

Part 1:

Part 2:

The slides are available on the LavaJUG Wiki

Thanks for the great reception to the whole LavaJUG and more specifically to its leaders Olivier Coupelon, Pierre Colomb, Sylvain Desgrais and Thomas Maurel.

Upcoming events: LavaJUG & Devoxx France

I will be at the LavaJUG (Java User Group from Clermont-Ferrand, France) this Thursday from 19:00 to 21:00, presenting our experience with the OpenDJ project with building a highly scalable and high performance server in Java. The presentation is based on what I’ve already presented in a few JUG in France (AlpesJUG, MarsJUG, PoitouCharentesJUG,…) and Switzerland (JUG Lausanne), but has been updated with regards to GarbageFirst GC and the most recent HotSpot JVM.

 

And next week, from  March Wednesday 27th to Friday 29th, you will find ForgeRock at the Devoxx France conference.

Come to our conference session about “Enterprise Security in a Cloudy and Mobile World” (the session is in French). The session is on Friday 29th, from 11:45 to 12:35, in Miles Davis room. Mark it on your calendar, and if you miss it, make sure you stop by our booth (B3) to say hello and talk with some of our engineers. We will also be present at the HackerGarten on Wednesday from 14:00 to 18:00, should you want to have fun with one of our open source projects : OpenAM, OpenDJ or OpenIDM.

DevoxxFR-2013-banniere-texte-600-232

“Parlez vous Français ?” @ JavaOne 2012 !

French dinner at JavaOneJavaOne, like most of conferences, serves 2 purposes. First it is the place to learn about the theme of the conference, in the case of JavaOne, the Java platform, language and environment. There are presentations, demos, keynotes for all of that. But more importantly, it is the place to socialize, meet friends and acquaintances, strengthen your network(s).

And so, we had on Tuesday evening, right after ForgeRock party, a “French dinner”. More specifically, a dinner with French speaking persons that are quiet active, one way or another, in the Java community. We, French, do love food and spending hours over a meal discussing, joking, laughing, sipping wine in good company. This year was no different, as the few photos can illustrate.

Thanks to Guillaume Laforge, leader of the Groovy community, for organizing it this year.

LP0_5975LP0_5979LP0_5978

ForgeRock Party at JavaOne 2012

Thanks to all the developers from our open source projects and communities, all the customers and friends that attended the party that ForgeRock threw yesterday on the side of the JavaOne conference. We had lots of fun seeing you, discussing and raising toast to the good old times or to the great futures.

A special thanks as well to James Gosling, father of the Java programming language and supporter of ForgeRock, for showing up and raising the level of the party to an All Stars game !

You can find the photo album of the party on Facebook.

JDuchess @ JavaOne

Yesterday, as I was entering the conference room for our Open Source Identity and Access Management expert panel session at JavaOne, I noticed all JDuchesses were gathering in the corner for a group photo. As I had my camera with me, I quickly took it out and captured the moment.

 

The picture is viewable and downloadable from my Flicker account in all sizes, including the original 12M pixel one. Feel free to use as you want (in compliance with the creative commons license).

Meeting ForgeRock during JavaOne / OOW

If you want to meet ForgeRock and you’re in the San Francisco bay during JavaOne and Oracle Open World, there will be several opportunities to meet some of us: our CEO, our Sales team, some of our developers or myself.

Sunday September 30th:

I will be participating in the JUG Leaders meetings and discussions as well as the GlassFish ones (when schedule allows). Later, you can find me at the GlassFish and Friends Party from 8pm to 10pm at The Thirsty Bear.

Monday October 1st:

JavaOne attendees should be able to see me during the conference. I will be part of a panel discussion on Open Source Identity and Access Management solutions, from 5:30pm to 6:15pm.


Following that, some ForgeRock employees and I will be at the 2nd Annual Solaris Family reunion from 7:00pm to 11:00pm. The event, part of the ZFS Day, is free, but please register here.

 

Tuesday October 2nd:

ForgeRock logoCome and meet the developers and other members of the open source projects supported by ForgeRock. We’re having a Beer Burst party from 5:00pm until 8:30pm at The House of Shields. Please register through eventbrite so that we know how many to expect.

Rest of the week…

Otherwise, throughout the week, I will be most of the time at the JavaOne conference or in the ForgeRock San Francisco offices with the local team. Please send me an email or message me on Twitter (@LudoMP) to arrange a meeting.  I will be leaving California for New York on Monday, October 8th.

I hope to see a large number of people from the OpenDJ, OpenAM or OpenIDM community, other open source projects, ex-coworkers, future customers, and friends during my stay.

OpenDJ 2.4.6 is now available

As few days after an important milestone for OpenDJ, the open source LDAP directory server in Java, I’m happy to announce that a new bug fix release of  the 2.4 series has just been made available. OpenDJ 2.4.6 is an update release of the OpenDJ project and improves reliability and performances with large groups and entries, as well as very large databases. The full details about the release have been posted in the OpenDJ 2.4.6 Release Notes. Upgrading to this release is recommended for everyone running earlier versions. For additional features and bug fixes, please use OpenDJ 2.5.0-Xpress1.

The release is built out of revision 8102 of the b2.4 branch of the code repository.

As usual, you can find every thing on the OpenDJ Downloads page:

The draft documentation for OpenDJ, and more specifically the Administration Guide, has been updated on the OpenDJ project site, still on the track for an accurate, reviewed version for OpenDJ 2.5.

Feedback is important to us and you can participate on the IRC channel, the mailing lists or join our community.

Enjoy !

Tab Sweep Summer Edition

Closing tabs and removing bookmarks in my browser before going on vacation, I ought to post a few links before :

ForgeRock is growing and I’m happy to count Chris Ridd as a new member of the OpenDJ team. Chris’ main focus will be support and sustaining, but he’s already started building knowledge information and posted an article on our wiki about using Eclipse for OpenDJ development; and has a new feature enhancement in progress.

Open source projects likes other open source projects. For the last few months, Silverpeas has been running demos, testing with the OpenDJ LDAP directory service. They’ve moved one step closer with integrating OpenDJ in their unit test framework, posted the JUnit module on GitHub, and documented the process. A French version of the article is also available.

Bill Nelson keeps on publishing snippets of the OpenDJ Administration, Maintenance and Tuning class, and this week posted an Architecture overview of the OpenDJ directory server.

Version 2.0 of the LDAP Synchronization Connector (LSC-Project) has been released. I need to give a try to the new version, as LSC has been proved to be helpful for migrating directory services.

Dave Koelmeyer wrote a simple article, yet very useful, describing how to enable LDAP secondary group memberships with Ubuntu 12.04 and OpenDJ.

Phil Lembo, alias ELDAPO, posted a short article to describe how to update the JVM version used by OpenDJ. There are some good reasons for enforcing some stickiness with the version of the JVM, but controlling the runtime environment for a service that can be critical is the major one.

Have I already mentioned that we’re hiring ? If you’re a developer, have some good object oriented programming experience with Java, and want to live close to the Alps, enjoying cycling, hiking or hand-gliding during summer time and skiing or snowboarding in winter, then you should apply now.

At Pipay, 15 km from ForgeRock Grenoble Engineering Center

OpenDJ 2.5.0-Xpress1 is now available

I’m happy to announce that a new revision of OpenDJ, the open source LDAP directory server in Java has just been released. OpenDJ 2.5.0-Xpress1 is a new stable release of the main development branch of the OpenDJ project.

OpenDJ 2.5.0-Xpress1 brings you the latest features such as:

  • Capability to delegate authentication to Microsoft Active Directory (pass-through authentication)
  • Improved enforcement of referential integrity for groups, whereby OpenDJ can now ensure both that members’ entries exist when they are added to groups, and also that members are removed from groups when their entries are deleted
  • Access log filtering, with additional output configuration to combine request and response messages, log control OIDs, and specify timestamp formats
  • Optimistic concurrency control through ETag attributes
  • Synchronization of Samba and OpenDJ passwords

You can find more details about the OpenDJ 2.5.0-Xpress1 release in the OpenDJ Release Notes.

The release is built out of revision 8087 of the trunk of the code repository.

As usual, you can find every thing on the OpenDJ Downloads page:

The draft documentation for OpenDJ, and more specifically the Administration Guide, has been updated on the OpenDJ project site, still on the track for an accurate, reviewed version for the final release of OpenDJ 2.5.0, due by the end of this year.

Feedback is important to us and you can participate on the IRC channel, the mailing lists or join our community.

Enjoy !

More secure passwords !

I’ve received an intriguing request from a customer last week :  he wanted to know if we’ve done benchmarks of the password hashing schemes that are available in OpenDJ, our LDAP directory service. Their fear was that with stronger schemes, they could not sustain a high authentication rate.

In light of the LinkedIn leak of several millions of passwords, hashed with a simple unsalted SHA1, I decided to run a quick and simple test.

SSHA1 is the default hashing scheme for password in OpenDJ. The salt is an 8 bytes (64-bit) random string and is used with the password to produce the 20 bytes message digest. But OpenDJ directory server supports a wide range of password hashing scheme and salted SHA512 is currently the most secure hashing algorithm we support (and the salt here is also an 8 bytes (64-bit) random octet string).

So for the test, I generated a sample directory data set with 10 000 users, and imported it in the OpenDJ directory (a 2.5 development build) with the default settings, on my laptop (MacBook Pro, 2.2 GHz intel Core i7).

$ ldapsearch -D "cn=directory manager" -w secret12 -p 1389 -b "dc=example,dc=com" 'uid=user.10' dn userPassword
dn: uid=user.10,ou=People,dc=example,dc=com
userPassword: {SSHA}cchzM+LrPCvbZdthOC8e62d4h7a4CfoNvl6d/w==

I then ran an “authrate” which is a small benchmark tool that allows to stress an LDAP server with a high number of authentications (LDAP Bind requests) and let it run to 5 minutes.

authrate -h localhost -p 1389 -g 'rand(0,10000)' -D "uid=user.%d,ou=people,dc=example,dc=com" -w password -c 32 -f
-----------------------------------------------------------------
 Throughput     Response Time
 (ops/second)   (milliseconds)
 recent average recent average 99.9% 99.99% 99.999% err/sec
 -----------------------------------------------------------------
 ...
 26558.0  26148.9   1.179    1.195  10.168  19.431  156.421      0.0

I then stopped the server, changed the import default password encryption scheme to Salted SHA512, and reimported the data.

$ ldapsearch -D "cn=directory manager" -w secret12 -p 1389 -b "dc=example,dc=com" 'uid=user.10' dn userPassword
 dn: uid=user.10,ou=People,dc=example,dc=com
 userPassword: {SSHA512}eTGiwtTM4niUKNkEBy/9t03UdbsyYTL1ZXhy6uFnw4X0T6Y9Zf5/dS7hDIdx3/UTlUQ/9JjNV9fOg2BkmVgBhWWu5WpWKPog

And then re-run the “authrate”

$ authrate -h localhost -p 1389 -g 'rand(0,10000)' -D "uid=user.,ou=people,dc=example,dc=com" -w password -c 32 -f
 -----------------------------------------------------------------
 Throughput     Response Time
 (ops/second)   (milliseconds)
 recent average recent average 99.9% 99.99% 99.999% err/sec
 -----------------------------------------------------------------
 ...
 25481.7 25377.6 1.222 1.227 10.470 15.473 158.234 0.0

As you can see, there is not much of a difference in throughput or response time, when using the strongest algorithm to hash user password. So do not hesitate to change the default settings and make use of the strongest password hashing schemes with OpenDJ. It could save you from the embarrassment of, one day, contacting each of your users or customers to ask them to change their compromised password.

The default password hashing schemes are in 2 locations :

  • The default password policy for all passwords that are changed online.
dn: cn=Default Password Policy,cn=Password Policies,cn=config
ds-cfg-default-password-storage-scheme: cn=Salted SHA-512,cn=Password Storage Schemes,cn=config
  • In the Import Password Policy
dn: cn=Password Policy Import,cn=Plugins,cn=config
ds-cfg-default-user-password-storage-scheme: cn=Salted SHA-512,cn=Password Storage Schemes,cn=config

Both properties can be changed with dsconfig while the OpenDJ server is running, and the new scheme will be used for all subsequent operations.

About OpenDJ and Hotspot JVM G1

Duke on a bike
curtesy of Charly Hunt

Understanding and tuning the JVM is quite important to get the best performances out of OpenDJ. We do provide some high level guidance in our documentation and I’ve been talking about Java performances in the last few years at various Java User Groups in France and Switzerland (you can find presentations in French here or here) as well as at a major conference in Brazil : FISL in 2009. On this later occasion, I was asked to cover the presentation for 2 prestigious names in the Sun Hotspot JVM team : Charly Hunt and Tony Printezis. I’ve spent a few hours with them and have learnt a great deal about the internals of the Hotspot JVM and memory management, and all magic parameters, in order to deliver that presentation. At that time, our directory team was interacting a lot with the Hotspot team as we were testing a new and promising garbage collector: Garbage First aka G1. OpenDS was even wrapped and used in one of the largest collection of tests for the Sun JVM.

During the acquisition of Sun by Oracle, the future of G1 and the Hotspot JVM were unsure and our interactions with the Hotspot team diminished seriously.

At ForgeRock, we continued to pay attention to Garbage First and for a long time, we noticed that it wasn’t moving along. Most of the issues that were raised after tests with OpenDS and that were addressed in some development version of the JVM were not integrated in official JVM releases. It only with the Oracle JVM 1.7 update 2 that we noticed the large list of issues fixed with G1. We’ve then resumed testing OpenDJ with G1 to see that while the promise of no full GC seems to be addressed, the performance impact of G1 is still significantly high. With our limited tests of JVM under 4GB of heap size, we noticed a 10% performance degradation over CMS, corresponding with an approximate 10% increase of CPU load (on a quad core machine with hyperthreading on), but with better overall response times for OpenDJ as the maximum response time decreased from 200ms to 80ms, as illustrated below.

LDAP Modrate with Garbage First
-------------------------------------------------------------------------------
 Throughput     Response Time 
 (ops/second)   (milliseconds) 
recent average  recent average 99.9% 99.99% 99.999% err/sec Entries/Srch
-------------------------------------------------------------------------------
16196.7 16374.1  1.972 1.951  18.886 28.129 66.933  0.0
16468.8 16374.9  1.941 1.951  18.883 28.087 66.521  0.0

LDAP Modrate with CMS
-------------------------------------------------------------------------------
 Throughput     Response Time 
 (ops/second)   (milliseconds) 
recent average  recent average 99.9% 99.99% 99.999% err/sec Entries/Srch
-------------------------------------------------------------------------------
17937.1 17487.7  1.780 1.827  18.175 30.521 116.990 0.0
17783.7 17494.3  1.796 1.826  18.145 30.320 117.017 0.0

We need to run more tests with OpenDJ and G1, especially with very large heaps (from 4 to 32GB), but we’re not sure whether G1 will be able to deliver the performances it promised.

And today I noticed on LinkedIn that both Charly Hunt and Tony Printezis, the 2 main engineers behind the HotSpot JVM and Garbage First, had left Oracle for new adventures. Charly’s gone to  SalesForce and Tony to Adobe. This is certainly a good move for both of them, but it leaves me worried about the future of the Hotspot JVM and its ability to deliver innovation in GCs.

[Update on May 6th]

It appears that more engineers of the Sun JVM team have actually left in the last couple of months : John Pampuch, Igor Veresov, Paul Hohensee..

Devoxx France, 1st Edition

DecoxxI was in Paris end of last week, attending the first edition of Devoxx France, a Java developers’ conference.

Devoxx is a well known and highly attended Java developers conference that takes place late fall in Antwerp. The French version has been initiated by the Paris Java User Group and has a similar structure but with 75% of the talks in French.
For a first edition, Devoxx France 2012 is a real success. Sold out 2 weeks before the event, over 1200 persons attended the 3 days’ conference. Yet, the conference felt human.

I was there only for the second and third days, as an attendee and as a co-speaker in the BOF session about Open Source Software in France.It was also the opportunity to meet and discuss with other developers, open source project leaders and potential customers.

photo by Pierre-Antoine Gregoire, alias @zepag

Out of the talks that I’ve attended, I preferred the ones that were quite low level. Among them, 2 around hacking the JVM and the bytecode:  

I also enjoyed 2 presentations by Alex Snaps, one around concurrency and the CompareAndSet method. The other one about SizeOf or the difficulty to compute the exact size of Java objects, in order to improve large cache efficiency and management. I shall look at the ehcache project code, to see if we can leverage some of it for OpenDJ caches.

Also worth mentioning, 2 greats keynotes on the Friday morning with Pat Chanezon and Neal Ford.

I’ve taken a few photos during Devoxx France 2012, feel free to use or share them (under Creative Commons). And if you want to see more photos of the event, you can check Arnaud Heritier’s collections : Day 1, Day 2, Day 3.

See you next year at Devoxx France 2013, and may be in Antwerp in November for Devoxx (WorldWide)