Why is node-ldapauth so slow, even when cached?
My simple express.js REST-API authenticates through a company-wide LDAP server. I am using the trentm node-ldapauth module
Real question: When I use a simple function that directly compares the username and password to the provided test values, the browser responses end up in about 8 to 15ms range. This includes calling MongoDB to fetch data (not much for this test).
If I use the ldapauth.authenticate function, which does cache ({cache: true}), it takes 80 to 100ms. From the code I can only see that it checks the LRU cache and of course the first request will be slower because it actually checks the LDAP server, but the subsequent ones?
Here's a small snippet from the app:
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
var ldap = new LdapAuth({
url: config.ldap.url,
adminDn: config.ldap.adminDn,
adminPassword: config.ldap.adminPassword,
searchBase: config.ldap.userBase,
searchFilter: config.ldap.userFilter,
cache: true
});
app.enable('trust proxy');
app.use(express.json());
app.use(express.urlencoded());
app.use(checkUrl);
app.use(express.basicAuth(function(user, pass, callback) {
// if(user === 'samuel' && pass === 'supertest') {
// callback(null, {name: 'samuel'});
// } else {
// callback(new Error("Unauthorized"));
// }
ldap.authenticate(user, pass, function(err, user) {
if(err) {
console.log("LDAP auth error: %s %s", err, err.dn);
callback(err);
}
callback(err, user);
});
}));
Any hints are appreciated.
source to share
This is because under the covers node-ldapauth
uses a bcrypt
cryptographically strong and slow hashing algorithm. You actually WANT this to happen. The slower the hash, the longer it takes for the hacker to reverse the hashes. The following link shows you where it was used:
https://github.com/trentm/node-ldapauth/blob/master/lib/ldapauth.js#L338
More details on why you should use bcrypt
this article's validation:
http://codahale.com/how-to-safely-store-a-password/
Of course, some of what the author mentions in this article is widely discussed, but the idea why you want a slow hashing algorithm sounds like it.
source to share