[OPENAM-6039] Asynchronous queue for OAuth2 Tokens can result in token validation failures Created: 22/May/15 Updated: 20/Nov/16 Resolved: 14/Jul/15
|Fix Version/s:||12.0.2, 12.0.3, 13.0.0|
|Reporter:||Matt Miller [X] (Inactive)||Assignee:||Peter Major [X] (Inactive)|
|Labels:||CustomerRFE, EDISON, release-notes|
|Sprint:||Sprint 83 - Sustaining, Sprint 84 - Sustaining|
|Support Ticket IDs:|
CTS tokenstore internally uses blocking queues to distribute the Tasks to the task processors. On operations like Create, the tokenstore queues the request and returns the control to the calling method. In the following scenario this implementation doesnt work
If Create request is executed on server 1 and read/update request is made on server 2 then its possible that request on server 2 is processed before request on server 1
Our usage of OAuth involves 2 steps. 1) get access token and 2) use access token to authenticate users. With OpenAM 11 we have ~zero failure; with OpenAM 12, we are observing close to 1.2-1.3% authenticate failures due to the mentioned problem.
We can't use affinity in this case as there is no session token used in either of the OAuth calls. The fix could be to wait for the operation to be completed by CTS before returning the response to the client. But doing so with current implementation simply negates the purpose of having queues at the first place. Given that, the correct fix in my opinion would be to replace the async CTS with sync CTS.
|Comment by Andy Hall [ 18/Jun/15 ]|
This was a known limitation of the design, alleviated in web scenarios by server affinity in load balancers.
Potential approaches to resolve this include:
Potential short term deployment workaround:
|Comment by Peter Major [X] (Inactive) [ 14/Jul/15 ]|
Fixed with R14615 and R14616
|Comment by Peter Major [X] (Inactive) [ 15/Jul/15 ]|
The one pager for this issue can be found at:
|Comment by Richard Hruza [ 12/May/16 ]|
Verified with: OpenAM 12.0.3-RC2 Build 4dbe218a05 (2016-April-25 17:57)
12.0.3 = 0 % errors
I executed following commands via both AMs with 150 threads in 50 loops. Script is in attachment.
|Comment by wwwnitinkumar [ 15/Sep/16 ]|