Very slow authentication, high CPU with opendirectoryd

Originator:jesse.c.peterson
Number:rdar://13865673 Date Originated:10-May-2013 04:00 PM
Status:Open Resolved:
Product:OS X Product Version:10.8.3/12D78
Classification: Reproducible:Yes
 
10-May-2013 04:00 PM Jesse Peterson:
Summary: When authenticating using a username and password the authentication takes an unacceptably long time (roughly 0.1 to 0.25 seconds) and opendirectoryd CPU usage spikes greatly.

Steps to Reproduce: Execute in a terminal:

while true; do date; dscl /Search auth username password; done

Do replace username and password with the username and password of either a local user or remote user.

Expected Results: Very fast scrolling of dates - say hundreds or thousands per second. Each time a date is printed an authentication has happened.

Actual Results: Only 3-4 authentications happen a second, and opendirectoryd uses close to 100% CPU during this test.

Regression: All OS X systems exhibit behaviour.

Notes:

Have noticed this issue with PAM authentication, too, using the pam_opendirectory.so module. Would like to implement PAM authentication for a web server, but this incredibly slow authentication makes this impossible.

Comments

Apple responded having checked with engineering saying that this is expected behavior. They explained LocalDB uses very strong hashing functions and the delay is expected and, in fact, purposeful.

By jesse.c.peterson at May 15, 2013, 3:18 a.m. (reply...)

Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!