-
Type:
Improvement
-
Resolution: Unresolved
-
Priority:
Minor - P4
-
None
-
Affects Version/s: 2.4.0-rc1
-
Component/s: Security
-
None
-
Environment:Any
-
Server Security
-
None
-
3
-
None
-
None
-
None
-
None
-
None
-
None
With the upgraded security features in 2.4, specifically delegating authentication credentials to different databases/sources, all drivers must now ensure that all credentials provided by the application are asserted for each connection prior to submitting any application requests. The driver has lost visibility into what requests need which credentials.
Prior to the delegate credentials drivers could lazy interleave authentication request between other messages and simply ensure that the database a user was accessing already had its credentials asserted on the connection. Using this model the driver only had to assert a single set of credentials before using the connection for the application's requests.
In the new security world, it should be possible for the drivers to pipeline the all of the commands to start all of the credential assertions and then handle the responses to the requests as they are returned from the server. This could significantly reduce the initial connection latency when there is a large number of credentials to assert or there is a high latency connection from the client to the server.
Currently the ClientBasic only supports a single AuthenticationSession making pipelined authentication requests impossible as each authentication start message clobbers the previous start. This should be changed to maintain a set of AuthenticationSessions.