unity-idm-discuss

[Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi,

I'm tasked with setting up a Unity IDM instance for productive use in a
scientific environment with expected number of users in the hundreds
(not very clear atm, might be more or less).

What are the recommended resources for a virtual machine hosting Unity
in this usecase, i.e. disksize, RAM, number of processors?

Cheers,
D

Re: [Unity-idm-discuss] Recommended server resources

[Sander A. <sa....@fz...>]

Hi,
it's not an official recommendation, but we are using a VM with 2
Cores, 4GB RAM and 40GB Disk and CentOS as OS. This is working quite
good for us.

Best regards,
Sander

On Tue, 2020-02-25 at 13:18 +0100, D Baum wrote:
> Hi,
> 
> I'm tasked with setting up a Unity IDM instance for productive use in
> a
> scientific environment with expected number of users in the hundreds
> (not very clear atm, might be more or less).
> 
> What are the recommended resources for a virtual machine hosting
> Unity
> in this usecase, i.e. disksize, RAM, number of processors?
> 
> Cheers,
> D
> 
> 
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Recommended server resources

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 25.02.2020 o 14:10, Sander Apweiler pisze:
> Hi,
> it's not an official recommendation, but we are using a VM with 2
> Cores, 4GB RAM and 40GB Disk and CentOS as OS. This is working quite
> good for us.
>
> Best regards,
> Sander
>
> On Tue, 2020-02-25 at 13:18 +0100, D Baum wrote:
>> Hi,
>>
>> I'm tasked with setting up a Unity IDM instance for productive use in
>> a
>> scientific environment with expected number of users in the hundreds
>> (not very clear atm, might be more or less).
>>
>> What are the recommended resources for a virtual machine hosting
>> Unity
>> in this usecase, i.e. disksize, RAM, number of processors?

I can second Sander's recommendations. Disk size use depends on logs 
mostly, the rest is rather fixed well beyond 1GB. CPU - 2-4 will be OK.

Mem is a longer story. 2GB VM minimum, 4GB recommended, you can use up 
to 8GB VM, above it makes rather no sense.

With RAM the main user are passwords processors (i.e. checking or 
setting up a password). But you can fine tune the settings, and recent 
versions of Unity manage memory wrt this quite well. In short - the more 
memory you have, the more secure password storage settings you can have. 
Also note that users count doesn't matter, number of concurrently active 
users (e.g. logins, sessions, logouts, admins, ...) matter.

Below 1GB per unity (note OS use!) it slowly starts to be harder to make 
it working, requires config tweaking.

HTH,
Krzysztof

Re: [Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi!

thanks! I've now picked 4 GB RAM, 2 cores and 40 GB of disk space on a
CentOS 8 instance with
java-11-openjdk-headless-11.0.5.10-2.el8_1.x86_64.
But installing the rpm throws an error:

dnf install unity-idm-3.2.0-1.noarch.rpm
Last metadata expiration check: 0:33:00 ago on Wed 26 Feb 2020 13:52:54 UTC.
Error:
 Problem: conflicting requests
  - nothing provides osgi(org.glassfish.hk2.hk2) needed by
unity-idm-3.2.0-1.noarch
(try to add '--skip-broken' to skip uninstallable packages or '--nobest'
to use not only best candidate packages)

But the manual promises me that I need nothing but java11! ;-)

Cheers,
D

On 25/02/2020 19:21, Krzysztof Benedyczak wrote:
> Hi,
> 
> W dniu 25.02.2020 o 14:10, Sander Apweiler pisze:
>> Hi,
>> it's not an official recommendation, but we are using a VM with 2
>> Cores, 4GB RAM and 40GB Disk and CentOS as OS. This is working quite
>> good for us.
>>
>> Best regards,
>> Sander
>>
>> On Tue, 2020-02-25 at 13:18 +0100, D Baum wrote:
>>> Hi,
>>>
>>> I'm tasked with setting up a Unity IDM instance for productive use in
>>> a
>>> scientific environment with expected number of users in the hundreds
>>> (not very clear atm, might be more or less).
>>>
>>> What are the recommended resources for a virtual machine hosting
>>> Unity
>>> in this usecase, i.e. disksize, RAM, number of processors?
> 
> I can second Sander's recommendations. Disk size use depends on logs
> mostly, the rest is rather fixed well beyond 1GB. CPU - 2-4 will be OK.
> 
> Mem is a longer story. 2GB VM minimum, 4GB recommended, you can use up
> to 8GB VM, above it makes rather no sense.
> 
> With RAM the main user are passwords processors (i.e. checking or
> setting up a password). But you can fine tune the settings, and recent
> versions of Unity manage memory wrt this quite well. In short - the more
> memory you have, the more secure password storage settings you can have.
> Also note that users count doesn't matter, number of concurrently active
> users (e.g. logins, sessions, logouts, admins, ...) matter.
> 
> Below 1GB per unity (note OS use!) it slowly starts to be harder to make
> it working, requires config tweaking.
> 
> HTH,
> Krzysztof
> 
> 

Re: [Unity-idm-discuss] Recommended server resources

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 26.02.2020 o 15:38, D Baum pisze:
> Hi!
>
> thanks! I've now picked 4 GB RAM, 2 cores and 40 GB of disk space on a
> CentOS 8 instance with
> java-11-openjdk-headless-11.0.5.10-2.el8_1.x86_64.
> But installing the rpm throws an error:
>
> dnf install unity-idm-3.2.0-1.noarch.rpm
> Last metadata expiration check: 0:33:00 ago on Wed 26 Feb 2020 13:52:54 UTC.
> Error:
>   Problem: conflicting requests
>    - nothing provides osgi(org.glassfish.hk2.hk2) needed by
> unity-idm-3.2.0-1.noarch
> (try to add '--skip-broken' to skip uninstallable packages or '--nobest'
> to use not only best candidate packages)
>
> But the manual promises me that I need nothing but java11! ;-)
>
I'll check it (no idea what's that dependency), but anyway I'd suggest 
using tar.gz bundle. It is nicer for performing safe upgrades.

Best,
KB

Re: [Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi!

OK, if *you* don't know the dependency then it can't be that important
for unity. ;-)

I can install with
rpm -ihv --force --nodeps unity-idm-3.2.0-1.noarch.rpm

On first startup, I get an exception in the logs:

eu.unicore.util.configuration.ConfigurationException: The value of
unityServer.core.credentials.1.credentialConfigurationFile (Credential
configuration file)= '/etc/unity-idm/samples/empty', must represent an
EXISTING and READABLE filesystem path.

Creating an empty file /etc/unity-idm/samples/empty solves the problem -
so I'm guessing the rpm is missing this file and it should be included.

I'm also getting a warning about reflective access, which I'm going to
ignore for now

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by
org.codehaus.groovy.vmplugin.v7.Java7$1
(file:/usr/share/unity-idm/lib/groovy-2.5.6.jar) to constructor
java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
WARNING: Please consider reporting this to the maintainers of
org.codehaus.groovy.vmplugin.v7.Java7$1
WARNING: Use --illegal-access=warn to enable warnings of further illegal
reflective access operations
WARNING: All illegal access operations will be denied in a future release

D

On 26/02/2020 15:46, Krzysztof Benedyczak wrote:
> Hi,
> 
> W dniu 26.02.2020 o 15:38, D Baum pisze:
>> Hi!
>>
>> thanks! I've now picked 4 GB RAM, 2 cores and 40 GB of disk space on a
>> CentOS 8 instance with
>> java-11-openjdk-headless-11.0.5.10-2.el8_1.x86_64.
>> But installing the rpm throws an error:
>>
>> dnf install unity-idm-3.2.0-1.noarch.rpm
>> Last metadata expiration check: 0:33:00 ago on Wed 26 Feb 2020
>> 13:52:54 UTC.
>> Error:
>>   Problem: conflicting requests
>>    - nothing provides osgi(org.glassfish.hk2.hk2) needed by
>> unity-idm-3.2.0-1.noarch
>> (try to add '--skip-broken' to skip uninstallable packages or '--nobest'
>> to use not only best candidate packages)
>>
>> But the manual promises me that I need nothing but java11! ;-)
>>
> I'll check it (no idea what's that dependency), but anyway I'd suggest
> using tar.gz bundle. It is nicer for performing safe upgrades.
> 
> Best,
> KB
> 

Re: [Unity-idm-discuss] Recommended server resources

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 26.02.2020 o 16:52, D Baum pisze:
> Hi!
>
> OK, if *you* don't know the dependency then it can't be that important
> for unity. ;-)
>
> I can install with
> rpm -ihv --force --nodeps unity-idm-3.2.0-1.noarch.rpm
>
> On first startup, I get an exception in the logs:
>
> eu.unicore.util.configuration.ConfigurationException: The value of
> unityServer.core.credentials.1.credentialConfigurationFile (Credential
> configuration file)= '/etc/unity-idm/samples/empty', must represent an
> EXISTING and READABLE filesystem path.
>
> Creating an empty file /etc/unity-idm/samples/empty solves the problem -
> so I'm guessing the rpm is missing this file and it should be included.

Yeah, we don't ship samples in RPM, perhaps should be changed, as in 
default config we in few places use this empty file from samples.


> I'm also getting a warning about reflective access, which I'm going to
> ignore for now
>
> WARNING: An illegal reflective access operation has occurred
> WARNING: Illegal reflective access by
> org.codehaus.groovy.vmplugin.v7.Java7$1
> (file:/usr/share/unity-idm/lib/groovy-2.5.6.jar) to constructor
> java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
> WARNING: Please consider reporting this to the maintainers of
> org.codehaus.groovy.vmplugin.v7.Java7$1
> WARNING: Use --illegal-access=warn to enable warnings of further illegal
> reflective access operations
> WARNING: All illegal access operations will be denied in a future release

That's known issue on Java 9+ with groovy - sorry we can't do anything 
about it, besides crossing fingers that groovy guys fix it at some point.

With Java 11 at least that's harmless.

Cheers,
KB

Re: [Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi!

On 27/02/2020 22:27, Krzysztof Benedyczak wrote:
>> Creating an empty file /etc/unity-idm/samples/empty solves the problem -
>> so I'm guessing the rpm is missing this file and it should be included.
> 
> Yeah, we don't ship samples in RPM, perhaps should be changed, as in
> default config we in few places use this empty file from samples.

At the risk of being philosophical: an empty file isn't much of an
example, so you could also move the empty file to somewhere else
(modules?) if you wanted to keep the samples folder out of the rpm. ;-)

>> I'm also getting a warning about reflective access, which I'm going to
>> ignore for now
>>
>> WARNING: An illegal reflective access operation has occurred
>> WARNING: Illegal reflective access by
>> org.codehaus.groovy.vmplugin.v7.Java7$1
>> (file:/usr/share/unity-idm/lib/groovy-2.5.6.jar) to constructor
>> java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
>> WARNING: Please consider reporting this to the maintainers of
>> org.codehaus.groovy.vmplugin.v7.Java7$1
>> WARNING: Use --illegal-access=warn to enable warnings of further illegal
>> reflective access operations
>> WARNING: All illegal access operations will be denied in a future release
> 
> That's known issue on Java 9+ with groovy - sorry we can't do anything
> about it, besides crossing fingers that groovy guys fix it at some point.
> 
> With Java 11 at least that's harmless.

Thanks, that's good to know!

D