[jcifs] jCIFS NtlmHttpFilter

[Brett Beaumont]

Thanks for the quick response.

One thing that should give jCIFS a huge scalability plus over mod_ntlm is
that mod_ntlm authenticates connections, whereas the NtlmHtptFilter
authenticates sessions. 

Brett.

-----Original Message-----
From: Eric [mailto:eglass1 at comcast.net]
Sent: Thursday, 6 May 2004 11:39 a.m.
To: Brett Beaumont
Cc: 'jcifs at lists.samba.org'
Subject: Re: [jcifs] jCIFS NtlmHttpFilter



> We have a maximum of about 4000 users that use the intranet (though it
would
> be unlikely that they'd all use it at the same time). Has anybody had
> experience with using the NtlmHttpFilter with a site of this size (or
> larger)? Are there any issues that we need to be aware of, or any
particular
> settings that need to be configured?
> 

Every so often somebody posts site statistics, but I haven't been able 
to find one in the archives offhand.  It'd be nice if someone with 
access to LoadRunner or other similar tools could do a load analysis to 
see how much a typical setup could handle.  One advantage we have is 
that we multiplex our authentications over a single backend SMB 
connection, rather than opening a new connection for each incoming 
client.  I don't *think* mod_ntlm does that (although I could be mistaken).

> Also, I've seen a few messages about SMB Signing with Win2003 causing
> problems. Does this affect the NtlmHttpFilter? 
> 

There was one issue brought up recently; I don't recall if it was ever 
resolved:

http://lists.samba.org/archive/jcifs/2004-April/003291.html
http://lists.samba.org/archive/jcifs/2004-April/003292.html
http://lists.samba.org/archive/jcifs/2004-April/003295.html

Note that if the first proposed solution (doing a one-to-one session to 
SMB connection) is employed, the scalability probably won't be any 
better than mod_ntlm (since you'd be creating an independent connection 
to the DC for each client, rather than multiplexing them over the same 
connection).  Mike, was this ever verified/resolved?  I meant to take a 
look at this (as well as the NtlmHttpUrlConnection issue) but haven't 
had the luxury of time to do so.


Eric