Verdaccio generates lots of authentication requests to LDAP

[rankun203]

and possibly crashes LDAP.

I'm currently investigating on an issue that causes our npm-registry stopped working.

On first sight, it's LDAP that stopped working, as you can see in this issue, it failed with too many open files error.

If we use yarn add <package>, then everything is fine, but if we use npm install, registry server is constantly requesting ldap server and finally at some point, ldap server crashes.

I had to restart ldap server twice to let npm install a package.

Possible reasons:

• Registry server logs have a lot of warnings

  warn --- basic authentication is deprecated, please use JWT instead
  

  I'm thinking that if jwt is used, registry server need only one request to ldap server while login the user with npm adduser (maybe).

• I have cache: True set in ldap settings (it was False, I'm testing with True), maybe it's not working.

• Our OpenLDAP server is too weak to handle that many requests(config issue).

[juanpicado]

Refers to verdaccio/verdaccio#732

[rankun203]

@juanpicado I'm a little curious how jwt works in Verdaccio and its plugins? I thought it's perfect for distributed authentication. Also I noted Verdaccio is warning about not using jwt, so I guess Verdaccio may supports some feature about it.

[juanpicado]

@rankun203 we are working on normalizing the Token Authentication. verdaccio/verdaccio#168 (comment)

Remember this project never was documented and really really hard to maintain, nowadays is not a problem anymore, but some spots are still WIP, token is one of them. JWT will be soon the main feature to be implemented.

[kopax]

Hi @juanpicado , I am still looking forward to re-use ldap plugin when I'll get time to work on it.

I don't really get how #168 can help with the authentication spam the backend service.

How will the JWT solve that ? What's the status?

Also, what is the opinion of @Alexandre-io about it? How did you manage to use this plugin in real life we were only having LDAP not handling one request and failing the npm install command...

[juanpicado]

#168 won't solve that issue. It was just a comment about the current roadmap. Status is in backlog at the moment.

[Alexandre-io]

Can you give me your feedback with verdaccio 3.3.0 and verdaccio-ldap 2.3.0? thx

[kopax]

Did anyone succeeded to activate the cache with latest version?