OpenSAML user discussion

[Ted Hesselroth <>]

We are using opensaml-2.2.0 in a client-server application. We also have 
a legacy service using opensaml-1.0.1 in the same container. In our 
tests, we can authorize with the legacy service at 50 Hz, but with 2.2.0 
the rate is only 10 Hz. We are passing a bit more information in the 
newer application, but not five times as much.

Is there a general performance difference between the two versions? 
Would going to a version higher than 2.2.0 help? Is there some 
understanding of where the bottlenecks occur in opensaml-2.2.0, such 
that we might change our implementation to avoid them?

Thanks for any responses. If anyone has a link to other performance 
testing of opensaml, we would appreciate knowing about it.

Ted Hesselroth