IdP High Performance and Optimization Best Practices Guide

Transcription

1 IdP High Performance and Optimization Best Practices Guide

2 Copyright Information SecureAuth is a copyright of SecureAuth Corporation. SecureAuth s IdP software, appliances, and other products and solutions, are copyrighted products of SecureAuth Corporation. December, 2016 For information on supporting this product, contact your SecureAuth sales representative: support@secureauth.com Phone: or Website:

3 Contents Introduction 1 Application Pool Configuration 2 Hardware Recommendations 3 SecureAuth IdP Configuration 4

4 Introduction This brief guide provides recommendations on the best way to maximize the performance of SecureAuth IdP. The SecureAuth IdP image shipped to our clients is built on a.net platform that utilizes IIS as the web server to host the SecureAuth application. The topics covered in this document are: + Application Pool Configuration + Hardware Recommendations + SecureAuth IdP Configuration Introduction 1

5 IdP High Performance and Optimization Best Practices Guide Application Pool Configuration One of the easiest ways to optimize IdP performance is by defining and fine-tuning an application pool dedicated to handling high-volume traffic. To do this: + Add an application pool to SecureAuth IdP (such as SecureAuthX, where X can be a number from 1 to 999, depending on the number of applications created by the user) that will handle a high volume of usage/traffic from the end users. SecureAuth IdP ships with 1 application pool shared among the end-user-facing applications. As more realms are created, more applications must share the same application pool. Should any of those applications experience any errors, this will affect all the applications sharing that same application. Not only will dedicating an application pool reduce the impact of the misbehaving application, but also reduces congestion for the remaining applications. + Once you have dedicated the a realm to the application pool, make the following changes to the application pool s Advanced Settings option: Start Automatically: set to True Start Mode: set to AlwaysRunning Idle Time-out (minutes): set to 0 Recycling: set to the anticipated time of the day with the least traffic Virtual Memory Limit (KB): set to 0 Making these settings prevents the application from going idle and enables you to reset the memory during the time of day in which you anticipate the least amount of traffic. Application Pool Configuration 2

6 IdP High Performance and Optimization Best Practices Guide Hardware Recommendations While we don t specify a set number of CPU cores or recommended RAM for the machine on which the IdP appliance resides, we do recommend that hardware resources be allocated appropriately should CPU and/or memory usage exceed 90%. Hardware Recommendations 3

7 IdP High Performance and Optimization Best Practices Guide SecureAuth IdP Configuration The following changes to the SecureAuth IdP settings are recommended: + In the Logs tab of the Web Admin UI, uncheck any check boxes in the Debug Logs row. Debug logging should only be enabled when requested by a SecureAuth engineer for troubleshooting purposes; it should be disabled for normal operation. Enabling debug logging incurs additional CPU cycles and prevents the IdP from operating at peak efficiency. + In the Workflow tab of the Web Admin UI, set the Public/Private Mode drop-down field to Public Mode Only if no Multi-Factor Methods are enabled for that realm. Enabling Private Mode causes the IdP to look for the presence of persistent tokens that are used primarily to see if the user is allowed to bypass the Multi-Factor challenge, which is redundant since no Multi-Factor methods are enabled. Setting the workflow to Public Mode Only bypasses this check outright, speeding up the authentication process. + In the System Info tab of the web admin UI, make the necessary configurations to ensure that clicking the Test button in the WSE 3.0 / WCF section yields the Passed! message for all the realms. Application errors caused by the IdP server s inability to communicate with the SecureAuth cloud servers will slow down the application. SecureAuth IdP Configuration 4