Symptoms

After setting an LDAP directory connector to use SSL (Secure Connection), the Crowd instance and/or integrated applications exhibit performance problems.

Cause

The default JNDI/LDAP service provider in Java does not pool SSL connections by default, which means every LDAP request must open a new connection to the server (reference).

Resolution

 To force the JVM to pool SSL connections, add the following line to your Apache Tomcat /bin/setenv.sh (setenv.bat for Windows) file:

On Linux:

JAVA_OPTS="$JAVA_OPTS -Dcom.sun.jndi.ldap.connect.pool.protocol='plain ssl' -Dcom.sun.jndi.ldap.connect.pool.authentication='none simple DIGEST-MD5'"

On Windows:

JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.jndi.ldap.connect.pool.protocol="plain ssl" -Dcom.sun.jndi.ldap.connect.pool.authentication="none simple DIGEST-MD5"

If you wish to customize the SSL connection pooling further, please see the full documentation provided by Sun.