Performance of JwtConsumer's processToClaims on Linux

[Elliot Widdowson]

We are seeing performance issues when invoking the JwtConsumer class's processToClaims method on RedHat 7.6; when the Redhat server is under very light load it's taking >150ms to execute this line of code compared to 1-2ms when run in our local dev environment which is Windows 7. When under load in Redhat this line takes >800ms, but under load in Windows performance doesn't degrade. The Redhat server's CPU is only running at 20% usage during our load tests and there is available memory.

We are using ES256 as our algorithm.

Are you aware of any reasons why we might be experiencing these performance differences between Windows and Linux?

[Elliot Widdowson]

We've found the cause: the wrong security provider was being used to parse tokens in our Redhat environment.

[Brian Campbell]

Happy to hear you figured it out. I didn't have much advice to offer other than look at the providers (that might be using native code for EC).

For the benefit of others that may come later, can you share any details of what provider or provider configuration was problematic vs. what worked better?

[Elliot Widdowson]

The SafeNet Luna Client is on the classpath in Redhat and the Luna security provider was being selected as the provider to use for token parsing; we aren't sure why it has such a performance impact, but it's not the provider we intended to use for this task anyway so we just need to find a way to specify which provider to use.

[Brian Campbell]

FWIW setJwsProviderContext(...) can also be used on the JwtConsumerBuilder to specify which provider to use during signature verification.

setJwsProviderContext

ProviderContext