FreeRADIUS/mod_auth_radius — pull request #5 by nmadura (2014-04-14 22:11:36+00:00)
Title: added the ability to cache authentication locally

The modifications to this module were written to reduce strain on radius servers when the client does not support cookies. Namely, the cookie storage mechanism works great when your client is a web browser or in a small environment.

However, in a larger enterprise environment where the radius server in-turn passes authentication off to ldap/kerb servers where negotiation is on the order of a second or two if the client does not support cookies, this authentication mechanism really starts to bog down.

Namely, we are using this module to authenticate our SVN clients over https, we were experiencing tremendous slowdowns when transferring larger numbers (10+) of changed files to the server. The slowdown occurred because the SVN clients don't support a cookie, so the full client <=> apache <=> radius <=> kerb path had to be traversed for every file that was being sent! So one file would take 2-3 seconds to transfer, 20 files were taking 40-60 seconds to transfer instead of a couple of seconds because of the amount of time that was required to handle the authentication.

By default authentication information is only held in the tables for 30 seconds, and the password is stored in it's xor'd form, this allows for repeated authentication attempts to be handled directly by the Apache server rather than by having to traverse through the radius environment. We have been using this modification for quite some time, and it seems to work rather well.

You should be able to fully deactivate the modified code by removing the #define USE_LOCAL_CACHE

Let me know if you have any questions.