我不明白 WCF 的安全性缩放 / 为啥 lsass.exe CPU% 这么高？

Posted 2023-02-19

【中文标题】我不明白 WCF 的安全性缩放 / 为啥 lsass.exe CPU% 这么高？

【英文标题】：I do not understand WCF scaling with security / Why is lsass.exe CPU% so high?我不明白 WCF 的安全性缩放 / 为什么 lsass.exe CPU% 这么高？

【发布时间】：2011-12-16 20:56:09

【问题描述】：

我有一个 WCF 服务，大约有 500 个客户端每 3 分钟打一次电话。服务开启时，lsass.exe 进程占用了我 95% 的 CPU。 我做了一个测试，每次客户端打电话时，lsass CPU% 都会上升到 7 左右。所以我明白为什么当数百人同时发送呼叫时服务器会减慢呼叫速度。 我不明白，为什么要使用 lsass ？我正在使用基于 WSHttpBinding 的 CustomBinding 和使用证书的消息级安全性。 Instance/Concurrency 是 PerCall/Single（尽管我几乎尝试了这两者的所有组合但没有任何变化），它托管在 IIS 6 中。 我的猜测是，对于每次调用，lsass 都会检查证书，而这不知何故会占用大量 CPU？有什么办法可以减轻吗？我知道人们已经将 WCF 服务扩展到更大的数量，那么我做错了什么？

附：一些额外的信息：我已经开始追踪，通常会记录的第一件事是

<TraceRecord xmlns="http://schemas.microsoft.com/2004/10/E2ETraceEvent/TraceRecord" Severity="Warning">
    <TraceIdentifier>http://msdn.microsoft.com/en-US/library/System.ServiceModel.Activation.WebHostNoCBTSupport.aspx</TraceIdentifier>
        <Description>Extended protection is not supported or not enabled on this platform. Please install the appropriate patch and enable it if you want extendedProtection support for https with windows authentication.</Description>
        <AppDomain>/LM/W3SVC/920256058/Root/WCFServices/smt-7-129642078492968750</AppDomain>
        <Source>System.ServiceModel.Activation.MetabaseSettingsIis6/17731154</Source>
</TraceRecord>

还有一堆：

http://msdn.microsoft.com/en-US/library/System.ServiceModel.Security.SecuritySessionDemuxFailure.aspx
The incoming message is not part of an existing security session.

和

<ExceptionType>System.ServiceModel.Security.SecurityNegotiationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
<Message>Cannot find the negotiation state for the context 'uuid-4caa56ff-3d38-4905-9151-ce12acdd676c-6778'.</Message>

和

<NegotiationTokenAuthenticator>System.ServiceModel.Security.TlsnegoTokenAuthenticator</NegotiationTokenAuthenticator>
<AuthenticatorListenUri>http://myserviceendpoint</AuthenticatorListenUri>
<Exception>System.ServiceModel.Security.SecurityNegotiationException: Cannot find the negotiation state for the context 'uuid-4caa56ff-3d38-4905-9151-ce12acdd676c-6778'.at System.ServiceModel.Security.NegotiationTokenAuthenticator`1.ProcessRequestCore(Message request) at System.ServiceModel.Security.NegotiationTokenAuthenticator`1.NegotiationHost.NegotiationSyncInvoker.Invoke(Object instance, Object[] inputs, Object[]&amp;amp; outputs)</Exception>

我的 IIS 日志已满

200 0 64
500 0 64
200 0 1236
500 0 1236

主要是最后两个

编辑：服务配置：

<?xml version="1.0"?>
<configuration>
  <configSections>
    <section name="dataConfiguration"     type="Microsoft.Practices.EnterpriseLibrary.Data.Configuration.DatabaseSettings,     Microsoft.Practices.EnterpriseLibrary.Data"/>
  </configSections>
  <connectionStrings>
    <add name="conString" connectionString="Data Source=source1;Failover     Partner=source2;database=myDatabase;Integrated Security=false;uid=userName;pwd=password"     providerName="System.Data.SqlClient"/>
  </connectionStrings>
  <dataConfiguration defaultDatabase="conString"/>
  <system.web>
    <compilation debug="true" targetFramework="4.0"/>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>

  <system.serviceModel>
    <services>
      <service name="ServiceLibrary.Service">
        <endpoint address="ws" binding="wsHttpBinding"     bindingConfiguration="WSHttpBinding_IService"
          name="WSHttpEndpoint_IService"     contract="ServiceLibrary.IService" />
        <endpoint address="cs1" binding="customBinding"     bindingConfiguration="CustomBinding_IService"
          name="CustomEndpoint_IService"     contract="ServiceLibrary.IService" />
        <endpoint address="basic" binding="basicHttpBinding"     name="BasicHttpEndpoint_IService"
          contract="ServiceLibrary.IService" />
        <endpoint address="mex" binding="mexHttpBinding"
          contract="IMetadataExchange" />
      </service>
    </services>
    <bindings>
      <wsHttpBinding>
        <binding name="WSHttpBinding_IService"
            maxBufferPoolSize="524288" maxReceivedMessageSize="1048576">
          <readerQuotas maxDepth="32" maxStringContentLength="65536" maxArrayLength="16384" 
              maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="Message">
            <message clientCredentialType="Certificate" negotiateServiceCredential="true"
                algorithmSuite="Default" />
          </security>
        </binding>
      </wsHttpBinding>
      <customBinding>
        <binding name="CustomBinding_IService">
          <transactionFlow />
          <security authenticationMode="SecureConversation"     messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
            <localServiceSettings maxClockSkew="00:10:00" maxPendingSessions="102400" />
            <localClientSettings maxClockSkew="00:10:00" />
            <secureConversationBootstrap authenticationMode="MutualSslNegotiated"     messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" />
          </security>
          <textMessageEncoding>
            <readerQuotas maxDepth="32" maxStringContentLength="65536" maxArrayLength="16384"     maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          </textMessageEncoding>
          <httpTransport maxBufferSize="1048576" maxReceivedMessageSize="1048576" />
        </binding>
      </customBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceCredentials>
            <serviceCertificate findValue="CN=[domain]" storeLocation="LocalMachine"     storeName="TrustedPeople" />
            <clientCertificate>
              <authentication revocationMode="NoCheck" certificateValidationMode="PeerTrust"     />
            </clientCertificate>
          </serviceCredentials>
          <serviceThrottling maxConcurrentCalls="1000"  maxConcurrentSessions="1000"     maxConcurrentInstances="1000" />
          <serviceMetadata httpGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="false"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true"/>
  </system.serviceModel>
</configuration>

客户端都在使用CustomBinding。但是，WS 绑定仍然会出现问题。事实上，我制作 CustomBinding 是为了解决服务即将用完未决会话的问题。

【问题讨论】：

同时显示您的服务配置。

【参考方案1】：

所以，我终于或多或少地让一切都恢复了。我的问题是所有客户端都试图同时拨打电话，这只是让服务器超载。我将 IIS 应用程序设置为拒绝所有传入流量，然后慢慢添加 IP 组，直到最后它们都能够连接。

Lsass 仍在使用大量 CPU，这是不可接受的。我将不得不找到一种不同的安全方法（证书除外），它更快并且不会让 lsass 发疯，因为我们有数百个客户端。