[JIRA] (IDP-1882) idp.attribute.resolver.LDAP.connectionStrategy ignored in attribute-resolver.xml

[Martin Gollowitzer (Jira)]

Martin Gollowitzer ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5f4e1a96fdc3f5003f2edd4b ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1882?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9 ) IDP-1882 ( https://shibboleth.atlassian.net/browse/IDP-1882?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9 ) idp.attribute.resolver.LDAP.connectionStrategy ignored in attribute-resolver.xml ( https://shibboleth.atlassian.net/browse/IDP-1882?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.4 Assignee: Daniel Fisher ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=70121%3A5040b2f7-37ad-4449-b621-76b5c7e66a9d ) Components: Attribute Resolver, LDAP Created: 25/Nov/21 7:02 AM Environment:

Container based on jetty:9.4.43-jre11 run via podman on RHEL 8.4

Priority: Trivial Reporter: Martin Gollowitzer ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5f4e1a96fdc3f5003f2edd4b )

We are running Shibboleth IDP 4.1.4 containerized and use an Active Directory as source for our attribute resolver via LDAP.
In ldap.properties, we have set the following (relevant parts):

 {{ idp.authn.LDAP.ldapURL = ldap://dc1 ldap://dc2 ldap://dc3
idp.authn.LDAP.connectionStrategy = RANDOM
idp.attribute.resolver.LDAP.ldapURL = %

{idp.authn.LDAP.ldapURL}

idp.attribute.resolver.LDAP.connectionStrategy = %

{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}

 }} 

The data connector in attribute-resolver.xml looks like this:

 <DataConnector id= "ActiveDirectory" xsi:type= "LDAPDirectory"
   ldapURL= "%{idp.attribute.resolver.LDAP.ldapURL}"
   baseDN= "%{idp.attribute.resolver.LDAP.baseDN}"
   principal= "%{idp.attribute.resolver.LDAP.bindDN}"
   principalCredential= "%{idp.attribute.resolver.LDAP.bindDNCredential}"
   trustFile= "%{idp.attribute.resolver.LDAP.trustCertificates}"
   useStartTLS= "%{idp.attribute.resolver.LDAP.useStartTLS:true}"
   connectTimeout= "%{idp.attribute.resolver.LDAP.connectTimeout}"
   responseTimeout= "%{idp.attribute.resolver.LDAP.responseTimeout}"
   connectionStrategy= "%{idp.attribute.resolver.LDAP.connectionStrategy}" >
   <FilterTemplate>
       <![CDATA[
           (userPrincipalName=$resolutionContext.principal)
       ]]>
   </FilterTemplate>
   <ConnectionPool
     minPoolSize= "%{idp.pool.LDAP.minSize:3}"
     maxPoolSize= "%{idp.pool.LDAP.maxSize:10}"
     blockWaitTime= "%{idp.pool.LDAP.blockWaitTime:PT3S}"
     validatePeriodically= "%{idp.pool.LDAP.validatePeriodically:true}"
     validateTimerPeriod= "%{idp.pool.LDAP.validatePeriod:PT5M}"
     validateDN= "%{idp.pool.LDAP.validateDN:}"
     validateFilter= "%{idp.pool.LDAP.validateFilter:(objectClass=*)}"
     expirationTime= "%{idp.pool.LDAP.idleTime:PT10M}" />
 </DataConnector>

However, according to the logs, Shibboleth uses the ACTIVE_PASSIVE connection strategy, no matter what we set as strategy in ldap.properties (we even tried setting both strategies to RANDOM without the reference from the resolver to the authn strategy). The only way to get it to use RANDOM is to hardcode the strategy in attribute-resolver.xml and not referencing the variables from ldap.properties.

To the best of our knowledge, our configuration should work, so we assume this is a bug.

( https://shibboleth.atlassian.net/browse/IDP-1882#add-comment?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1882#add-comment?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:8cd14d0 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211125/4785408b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-2ab772f9-461e-44a0-a24b-6beb15c78de5
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211125/4785408b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-c480f455-a8fd-4f58-acfa-84478d3b44b6
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211125/4785408b/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-633e1850-2998-433a-a40a-5733758b1086
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211125/4785408b/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d5f4ba12-30aa-4dd4-ad52-d2bbacbfa9fc
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211125/4785408b/attachment-0007.png>