auth-app too slow to get the password

[jvillafanez]

Describe the bug

Requests going through the auth-app service for authentication are too slow. It seems to depend on the number of tokens created by the user.

Steps to reproduce

1. Enable auth-app
2. Create a token with the auth-app
3. Perform several operations

Expected behavior

Operations finish in a reasonable time

Actual behavior

auth-app takes a lot of time to get the password. Lowest time seems to be around 1 second, and it goes up to 14 seconds. In all the cases I've checked, the GetAppPassword operation takes the whole time.

Even considering a heavy workload in the host, the timing seems too focus on that operation.

Setup

Pretty much default setup, with the auth-app service enabled.

Details

OCIS_XXX=somevalue
OCIS_YYY=somevalue
PROXY_XXX=somevalue

Additional context

• The requests are always using the auth-app token. Oauth isn't being used in the requests.
• The token is used for the admin to impersonate other users
• Tokens are being piled up without being removed. I think I have around 121 tokens active for the admin user.

I guess I need to be more careful with the token creation, but I'm not sure if such amount of active tokens should make the system that slow.

[jvillafanez]

I guess the problem is around https://github.com/owncloud/reva/blob/5bd0af7ba164f1810a62cfca06e1db10a918dfc9/pkg/appauth/manager/json/json.go#L218-L235
The CompareHashAndPassword is likely a heavy operation, and we're traversing the user's password list. While we return as soon as we find the password, we might still need to traverse the whole list if the password we need is the last one.

[2403905]

The naive fix could be:

• Range over the passwords in reverse order
• Check the expiration time before the CompareHashAndPassword.
• Delete the expired passwords

[jvillafanez]

There should be some improvements with owncloud/reva#526

My concern is that we should be checking only one possible password, taking advantage of the map to access to the chosen password in constant time. If that password check fails, then the password would be wrong, and there shouldn't be any need of checking additional passwords.