From aac9ff2ca369798bb7adf23050cdd23ec6d80e25 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Thu, 06 Aug 2026 11:31:52 +0000
Subject: [PATCH] Avoid global monitor on every bind in getDefaultPasswordPolicy (#669)

---
 opendj-server-legacy/src/main/java/org/opends/server/core/DirectoryServer.java |   17 +++++++++++++++--
 1 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/core/DirectoryServer.java b/opendj-server-legacy/src/main/java/org/opends/server/core/DirectoryServer.java
index 5ea6999..3b6ffa3 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/core/DirectoryServer.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/core/DirectoryServer.java
@@ -485,8 +485,12 @@
 
   /** The configuration handler used to manage the password generators. */
   private PasswordGeneratorConfigManager passwordGeneratorConfigManager;
-  /** The default password policy for the Directory Server. */
-  private PasswordPolicy defaultPasswordPolicy;
+  /**
+   * The default password policy for the Directory Server. Volatile so that
+   * getDefaultPasswordPolicy() can read the cached value without taking the
+   * authenticationPolicies monitor; all mutations happen under that monitor.
+   */
+  private volatile PasswordPolicy defaultPasswordPolicy;
   /** The configuration handler used to manage the authentication policies. */
   private PasswordPolicyConfigManager authenticationPolicyConfigManager;
   /** The configuration handler used to manage the password storage schemes. */
@@ -2557,6 +2561,15 @@
    */
   public static PasswordPolicy getDefaultPasswordPolicy()
   {
+    // This method is called on every authentication. Do not take the global
+    // monitor just to read the cached value: it is volatile and only mutated
+    // under the authenticationPolicies monitor.
+    PasswordPolicy cachedPolicy = directoryServer.defaultPasswordPolicy;
+    if (cachedPolicy != null)
+    {
+      return cachedPolicy;
+    }
+
     // Ensure default policy is synchronized.
     synchronized (directoryServer.authenticationPolicies)
     {

--
Gitblit v1.10.0