The Apache HttpClient used by Crowd's REST client by default only makes at most 2 connections to the same host. This can be overridden by calling the setMaxConnectionsPerHost method. Currently the Crowd client only calls setMaxTotalConnections, which sets the size of the pool, but does not raise the limit on the maximum number of connections to each host. Since the Crowd host is always the same, this effectively means we have a connection pool size of 2 to Crowd. This leads to poor performance, especially in environments where session.validationinterval is set to 0

Resolution

Upgrade the Crowd REST client to 2.3.3 or above.

Patch

If you are unable to upgrade for some reason, then use the attached patched Crowd 2.2.8 REST client.