[JIRA] (IDP-1898) LDAP authen pool idp.pool.LDAP.validateOnCheckout exposes errors to end-users

Tue Jan 18 23:16:02 UTC 2022

Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiOTFkYjYyZGRmODI5NDMzOGE4NTg0YzA3MjNmZjIyY2EiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiOTFkYjYyZGRmODI5NDMzOGE4NTg0YzA3MjNmZjIyY2EiLCJwIjoiaiJ9 ) IDP-1898 ( https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiOTFkYjYyZGRmODI5NDMzOGE4NTg0YzA3MjNmZjIyY2EiLCJwIjoiaiJ9 ) LDAP authen pool idp.pool.LDAP.validateOnCheckout exposes errors to end-users ( https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiOTFkYjYyZGRmODI5NDMzOGE4NTg0YzA3MjNmZjIyY2EiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.4 Assignee: Daniel Fisher ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=70121%3A5040b2f7-37ad-4449-b621-76b5c7e66a9d ) Components: Authentication, LDAP Created: 18/Jan/22 6:16 PM Environment:

IdP 4.1.4
OpenJDK 11.0.13+8-LTS
Tomcat 8.5.70
CentOS 7.9.2009

Priority: Low Reporter: Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 )

Hi,

I have a 4.1.4 IdP (upgraded from 3.x) configured with multiple LDAP servers (multiple space-separated LDAP URLs in idp.authn.LDAP.ldapURL.

I have the server configured with ACTIVE_PASSIVE strategy.

I have set

idp.pool.LDAP.validateOnCheckout               = true

When testing what happens if the first LDAP server goes down (by blackholing all traffic for the server's IP), the login screen rejects the login with: *Login Failure: Validation of connection failed*
and logs show:

2022-01-19 12:09:07,046 - 210.7.46.34 - WARN [org.ldaptive.pool.BlockingConnectionPool:649] - connection failed check out validation: org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 225eb6d6
2022-01-19 12:09:07,051 - 210.7.46.34 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:202] - Credential Validator ldap: Login by 'menclv' failed
org.ldaptive.pool.ValidationException: Validation of connection failed
	at org.ldaptive.pool.AbstractConnectionPool.activateAndValidateConnection(AbstractConnectionPool.java:651)

I would expect that idp.pool.LDAP.validateOnCheckout would not only validate the connection on checkout, but would also kept retrying until it retrieves a valid connection.

Note that in the absence of user activity, the connection pool does get claned up by the perodic validation (turned on by default and running every 5 minutes):

2022-01-19 12:13:40,205 -  - WARN [org.ldaptive.pool.BlockingConnectionPool:786] - org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 8afe808 failed validation
2022-01-19 12:13:40,209 -  - WARN [org.ldaptive.pool.BlockingConnectionPool:786] - org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 59f44d23 failed validation
2022-01-19 12:13:40,281 -  - WARN [org.ldaptive.pool.BlockingConnectionPool:786] - org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at fa72557 failed validation
2022-01-19 12:13:40,283 -  - WARN [org.ldaptive.pool.BlockingConnectionPool:786] - org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 3ee467b8 failed validation
2022-01-19 12:13:40,283 -  - WARN [org.ldaptive.pool.BlockingConnectionPool:786] - org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 4e9c2b72 failed validation

This report is about the situation where the period check has not run yet but the connection is already dead.
I'm reporting this is a bug, I hope it's not just a misunderstanding of the option name.

Thanks a lot in advance for looking into this.

Cheers,
Vlad

( https://shibboleth.atlassian.net/browse/IDP-1898#add-comment?atlOrigin=eyJpIjoiOTFkYjYyZGRmODI5NDMzOGE4NTg0YzA3MjNmZjIyY2EiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1898#add-comment?atlOrigin=eyJpIjoiOTFkYjYyZGRmODI5NDMzOGE4NTg0YzA3MjNmZjIyY2EiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100188- sha1:935ca08 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220118/496603b9/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-67f88919-25e2-45ce-8f31-80c10e365364
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220118/496603b9/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-2eeacbf8-f491-443d-bad7-e6b755bef770
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220118/496603b9/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-44f11f83-5fc5-47df-9bae-f0d3dc23e5a7
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220118/496603b9/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-low-8c0d1d8d-db20-4512-8b85-9b60cf6e5278
Type: image/png
Size: 248 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220118/496603b9/attachment-0007.png>