<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"> <!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/17cedc37e275540f0da95c78d8867326?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FMG-2.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="5f4e1a96fdc3f5003f2edd4b" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_5f4e1a96fdc3f5003f2edd4b" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5f4e1a96fdc3f5003f2edd4b"> Martin Gollowitzer </a> <strong>created</strong> an issue </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr> <!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"> <a href="https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Identity Provider</a> / <a href="https://shibboleth.atlassian.net/browse/IDP-1882?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-633e1850-2998-433a-a40a-5733758b1086" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://shibboleth.atlassian.net/browse/IDP-1882?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">IDP-1882</a> </td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/IDP-1882?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">idp.attribute.resolver.LDAP.connectionStrategy ignored in attribute-resolver.xml</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-avatar-633e1850-2998-433a-a40a-5733758b1086" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Affects Versions:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 4.1.4 </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="70121:5040b2f7-37ad-4449-b621-76b5c7e66a9d" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_70121:5040b2f7-37ad-4449-b621-76b5c7e66a9d" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=70121%3A5040b2f7-37ad-4449-b621-76b5c7e66a9d"> Daniel Fisher </a> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Components:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> Attribute Resolver, LDAP </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 25/Nov/21 7:02 AM </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Environment:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0; margin-top: 0">Container based on jetty:9.4.43-jre11 run via podman on RHEL 8.4</p> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-static-trivial-c480f455-a8fd-4f58-acfa-84478d3b44b6" height="16" width="16" border="0" align="absmiddle" alt="Trivial" style="vertical-align: text-bottom"> Trivial </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="5f4e1a96fdc3f5003f2edd4b" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_5f4e1a96fdc3f5003f2edd4b" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5f4e1a96fdc3f5003f2edd4b"> Martin Gollowitzer </a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0; margin-top: 0">We are running Shibboleth IDP 4.1.4 containerized and use an Active Directory as source for our attribute resolver via LDAP.<br> In ldap.properties, we have set the following (relevant parts):</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0"> {{ idp.authn.LDAP.ldapURL = ldap://dc1 ldap://dc2 ldap://dc3<br> idp.authn.LDAP.connectionStrategy = RANDOM<br> idp.attribute.resolver.LDAP.ldapURL = %</p> {idp.authn.LDAP.ldapURL} <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">idp.attribute.resolver.LDAP.connectionStrategy = %</p> {idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE} <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0"> }} </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The data connector in attribute-resolver.xml looks like this:</p>
<div class="code panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0">
<div class="codeContent panelContent" style="padding: 9px 12px">
<pre class="code-xml" style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal">
<DataConnector id=<span class="code-quote" style="color: #009100">"ActiveDirectory"</span> xsi:type=<span class="code-quote" style="color: #009100">"LDAPDirectory"</span>
ldapURL=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.ldapURL}"</span>
baseDN=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.baseDN}"</span>
principal=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.bindDN}"</span>
principalCredential=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.bindDNCredential}"</span>
trustFile=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.trustCertificates}"</span>
useStartTLS=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.useStartTLS:true}"</span>
connectTimeout=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.connectTimeout}"</span>
responseTimeout=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.responseTimeout}"</span>
connectionStrategy=<span class="code-quote" style="color: #009100">"%{idp.attribute.resolver.LDAP.connectionStrategy}"</span>>
<span class="code-tag" style="color: #000091"><FilterTemplate></span>
<![CDATA[
(userPrincipalName=$resolutionContext.principal)
]]>
<span class="code-tag" style="color: #000091"></FilterTemplate></span>
<ConnectionPool
minPoolSize=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.minSize:3}"</span>
maxPoolSize=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.maxSize:10}"</span>
blockWaitTime=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.blockWaitTime:PT3S}"</span>
validatePeriodically=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.validatePeriodically:true}"</span>
validateTimerPeriod=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.validatePeriod:PT5M}"</span>
validateDN=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.validateDN:}"</span>
validateFilter=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.validateFilter:(objectClass=*)}"</span>
expirationTime=<span class="code-quote" style="color: #009100">"%{idp.pool.LDAP.idleTime:PT10M}"</span>/>
<span class="code-tag" style="color: #000091"></DataConnector></span>
</pre>
</div>
</div> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">However, according to the logs, Shibboleth uses the ACTIVE_PASSIVE connection strategy, no matter what we set as strategy in ldap.properties (we even tried setting both strategies to RANDOM without the reference from the resolver to the authn strategy). The only way to get it to use RANDOM is to hardcode the strategy in attribute-resolver.xml and not referencing the variables from ldap.properties.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">To the best of our knowledge, our configuration should work, so we assume this is a bug.</p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"> <script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/IDP-1882?inbox=true&",
"name": "View Issue"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/IDP-1882#add-comment?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-2ab772f9-461e-44a0-a24b-6beb15c78de5" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://shibboleth.atlassian.net/browse/IDP-1882#add-comment?atlOrigin=eyJpIjoiY2Y3NzY1MTEyZGE5NGZhMTkyNDlkZWM3NDRiMDgxOGQiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr> </td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100183-<span title="8cd14d04934098220230548ced0f15a6e6fdf9dd" data-commit-id="8cd14d04934098220230548ced0f15a6e6fdf9dd}">sha1:8cd14d0</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-d5f4ba12-30aa-4dd4-ad52-d2bbacbfa9fc" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>