Why was OIDCCacheShmMax increased from 500 to 10000?

[marcverney]

Hi,

In 2.4.14, the OIDCCacheShmMax directive's default value was increased from 500 to 10000. I am curious about the reason that led to such a big bump. Did the value of 500 generate too much bugs? Or is it due to a new feature in this version that works better with 10000?

Thanks!

[zandbelt]

the 500 was on the very conservative side 10 years ago when this project was created; machines have far more RAM now on average - and the increase takes only a small margin of that - plus people reported unexpected warnings indeed when moving from test to full production; it is only the default setting, one can change it to their own requirements

[marcverney]

Understood 👍 Thanks for taking the time to respond.

[jrafanie]

@zandbelt Thank you for your work on this library. Does this change account for the default page sizes on different platforms?

If my calculations are correct, for a 4 KiB page size (x86_64), this represents an increase from 2 MB to 40 MB. For a 64 KiB page size (PowerPC), this represents an increase from 32 MB to 640 MB.

We noticed significant memory usage growth on PowerPC after upgrading from version 2.4.10 to 2.4.16 of mod_auth_openidc. To resolve this, we needed to specify a value for OIDC_DEFAULT_CACHE_SHM_SIZE/OIDCCacheShmMax, reverting it to the original default of 500.

This raises two questions:

1. Is there a way to base the default on the system's page size instead of hardcoding a value?
2. Is there a recommended method for calculating the appropriate shared memory allocation based on concurrent users or other metrics?

[Fryguy]

Note that the reason we are just seeing this now is because Red Hat only relatively recently published their rpm with a rebase on 2.4.16+, and our CI pulled it in.

* Tue Apr 08 2025 Tomas Halman <thalman@redhat.com> - 2.4.16.11-1
Rebase to version 2.4.16.11
- Resolves: RHEL-86221

* Mon Mar 31 2025 Tomas Halman <thalman@redhat.com> - 2.4.16.10-1
Rebase to version 2.4.16.10
- Resolves: RHEL-44894
- Resolves: RHEL-3335

* Fri Apr 12 2024 Tomas Halman <thalman@redhat.com> - 2.4.10-1
Rebase to 2.4.10 version improves `state cookies piling up` problem
  Resolves: RHEL-32450 Race condition in mod_auth_openidc filecache
  Resolves: RHEL-25422 mod_auth_openidc: DoS when using
            `OIDCSessionType client-cookie` and manipulating cookies
            (CVE-2024-24814)

[zandbelt]

you can override the defaults and tune them to your specific server with OIDCCacheShmMax and OIDCCacheShmEntrySizeMax , see https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.18.1/auth_openidc.conf#L689-L704

[jrafanie]

Thanks for the pointer. This is what we did.

Is there a document you can point me to that I can open a PR to update with a warning about how the page size on different systems could require this setting be configured? Previously, it wasn't required to configure it. Or is there a way for this setting to take into account the system page size into the calculation?

Thanks in advance!