[JIRA] (IDP-1898) LDAP authen pool idp.pool.LDAP.validateOnCheckout exposes errors to end-users

[Vladimir Mencl (Jira)]

Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 ) *commented* on IDP-1898 ( https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9 )

Re: LDAP authen pool idp.pool.LDAP.validateOnCheckout exposes errors to end-users ( https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9 )

Thanks for the ongoing discussion.

Diving into the ldaptive (1.3) source code to find the answer.

I can see that org.ldaptive.pool.BlockingConnectionPool.getConnection() first picks a connection from the pool and then calls activateAndValidateConnection() on the already selected connection:

https://github.com/vt-middleware/ldaptive/blob/v1.3/core/src/main/java/org/ldaptive/pool/BlockingConnectionPool.java#L162

The activateAndValidateConnection method is defined in org.ldaptive.pool.AbstractConnectionPool - and this method, when failing to validate the already selected connection, just throws an org.ldaptive.pool.ValidationException - which inherits from org.ldaptive.LdapException :

https://github.com/vt-middleware/ldaptive/blob/v1.3/core/src/main/java/org/ldaptive/pool/AbstractConnectionPool.java#L651

And the LdapExcetion is than caught in net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate().

So, the source code exactly matches the behaviour I’m observing: validateOnCheckout only makes the call fail early (on checkout time), but the authentication request fails either way.

And I don’t see any knobs in the ldaptive code that could be tweaked to change this behaviour.

But … I’ve just found a Pull Request in ldaptive that implements exactly the functionality I’m after (retrying, within some limits) and got merged 2 days ago: https://github.com/vt-middleware/ldaptive/pull/202

So I guess I only need to wait for this to get released (latest ldaptive is 2.1.0 from August 2021) and wait for ldaptive to get updated in Shib IdP …. (and in the meantime, I can lower idp.pool.LDAP.validatePeriod as a workaround...)

( https://shibboleth.atlassian.net/browse/IDP-1898#add-comment?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1898#add-comment?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100188- sha1:ecf3178 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220119/98a611e5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d9fc84d9-1cea-4ac8-acdc-14e890f87c57
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220119/98a611e5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c4a12159-6f5e-4862-98e1-6e6a37b9fdb4
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220119/98a611e5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-082e7270-e2b2-4bab-ade6-a004a09fa28c
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220119/98a611e5/attachment-0005.png>