java - 如何解决由于 LTPA token 过期而导致的 Websphere Web 应用程序登录延迟？

Question

我正在 Websphere 应用程序服务器 BASE 9.0.0.8 上运行 Web 应用程序。Websphere 安全性是通过独立的 LDAP 注册表(OpenLdap)进行配置的，该注册表也是应用程序用户的注册表。

服务器启动后，用户登录正常，需要几秒钟。在不活动一定时间后，应用程序 session 超时，用户必须再次登录，但这次登录需要几分钟。我没有注意到服务器日志中的任何记录可以解释此类登录延迟，因此我使用此字符串启用了 LTPAToken2 跟踪 *=info:com.ibm.ws.security.ltpa.LTPAToken2=all 。重现登录延迟问题后，我检查了跟踪日志，发现大量此类记录:

[9/27/18 14:07:28:532 CEST] 0000009c LTPAToken2    3   Returning existing encrypted bytes from token object.
[9/27/18 14:07:28:532 CEST] 0000009c LTPAToken2    3   Expiration returned from expire field in token: Thu Sep 27 14:35:00 CEST 2018*
...

在登录延迟期间，跟踪日志中记录了大约 1100 行。最初每秒几乎 200 条记录，后来频率降低，每隔几秒一条记录。大约两分钟的延迟后，用户登录到应用程序，跟踪日志中记录如下:

[9/27/18 14:09:46:132 CEST] 0000009c LdapRegistryI A   SECJ0419I: The user registry is currently connected to the LDAP server ldap://machineX:389.
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    >  new LTPAToken2 from accessID Entry
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   userdata areau:user\:machineX\:389/uid=userX,ou=Users,dc=companyX,dc=xy
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Expiration returned from expire field in token: Thu Sep 27 16:10:00 CEST 2018
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Expiration set to: Thu Sep 27 16:10:00 CEST 2018
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    <  new LTPAToken2 from accessID Exit
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.
[9/27/18 14:09:46:146 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.
[9/27/18 14:09:46:147 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.
[9/27/18 14:09:46:147 CEST] 0000009c LTPAToken2    3   Token was updated thus clearing encrypted bytes to re-encrypt.

Answer 1

WAS 服务器和 LDAP 服务器位于不同的网络子网中。一段时间后，与 LDAP 的现有连接会“失效”。通过禁用 WAS ldap 注册表参数“重用连接”解决了该问题。