we are running a small 389 DS cluster on two RHEL 7.4 machines. The version installed is
the most recent in the Red Hat repositories, 18.104.22.168-19.el7_4. 389 DS is used as user
storage for the Keycloak single sign-on system. It contains about 150k person objects.
To test the whole system, we are running load tests each night. These tests login 100
users per second in Keycloak for 15 minutes, which in turn authenticates the users against
389 DS. On our machines, this normally results in a very low CPU load by 389 DS, about
Up to now we used SSHA512 as password hashing algorithm. We now would like to switch to
PBKDF2: As a first test, we changed the password of the user that Keycloak uses to bind to
389 DS to PBKDF2 hashing. In this configuration, we encountered a problem: When running
the load tests, the system behaves normally for the first few minutes. After this, 389 DS
CPU usage suddenly jumps to almost 800% on one of the servers (the machines have 8 CPUs)
and authentications become very slow. This continues for the remaining runtime of the load
test. When running the test again, 389 DS again behaves normally for the first few
minutes, then CPU usage jumps to 800%.
When changing the password hash back to SSHA512, everything is fine again.
To me this looks like a bug in 389 DS. Please let me know what information to provide so
you can investigate.