<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"> <!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/2e18c7720034e03b9f2d50c61bf6a98a?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FVM-3.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="557058:9e33c654-fa34-43c9-a1c1-fcc1c32d3528" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_557058:9e33c654-fa34-43c9-a1c1-fcc1c32d3528" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528"> Vladimir Mencl </a> <strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-c4a12159-6f5e-4862-98e1-6e6a37b9fdb4" height="16" width="16" border="0" align="absmiddle" alt="Bug"> IDP-1898</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr> <!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/IDP-1898?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Re: LDAP authen pool idp.pool.LDAP.validateOnCheckout exposes errors to end-users</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"> <p style="margin: 10px 0 0; margin-top: 0">Thanks for the ongoing discussion.</p> <p style="margin: 10px 0 0">Diving into the ldaptive (1.3) source code to find the answer.</p> <p style="margin: 10px 0 0">I can see that <tt>org.ldaptive.pool.BlockingConnectionPool.getConnection()</tt> first picks a connection from the pool and then calls <tt>activateAndValidateConnection()</tt> on the already selected connection:</p> <p style="margin: 10px 0 0"><a href="https://github.com/vt-middleware/ldaptive/blob/v1.3/core/src/main/java/org/ldaptive/pool/BlockingConnectionPool.java#L162" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://github.com/vt-middleware/ldaptive/blob/v1.3/core/src/main/java/org/ldaptive/pool/BlockingConnectionPool.java#L162</a> </p> <p style="margin: 10px 0 0">The <tt>activateAndValidateConnection</tt> method is defined in <tt>org.ldaptive.pool.AbstractConnectionPool</tt> - and this method, when failing to validate the already selected connection, just throws an <tt>org.ldaptive.pool.ValidationException</tt> - which inherits from <tt>org.ldaptive.LdapException</tt>:</p> <p style="margin: 10px 0 0"><a href="https://github.com/vt-middleware/ldaptive/blob/v1.3/core/src/main/java/org/ldaptive/pool/AbstractConnectionPool.java#L651" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://github.com/vt-middleware/ldaptive/blob/v1.3/core/src/main/java/org/ldaptive/pool/AbstractConnectionPool.java#L651</a> </p> <p style="margin: 10px 0 0">And the <tt>LdapExcetion</tt> is than caught in <tt>net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate()</tt>.</p> <p style="margin: 10px 0 0">So, the source code exactly matches the behaviour I’m observing: <tt>validateOnCheckout</tt> only makes the call fail early (on checkout time), but the authentication request fails either way.</p> <p style="margin: 10px 0 0">And I don’t see any knobs in the ldaptive code that could be tweaked to change this behaviour.</p> <p style="margin: 10px 0 0">But … I’ve just found a Pull Request in ldaptive that implements exactly the functionality I’m after (retrying, within some limits) and got merged 2 days ago: <a href="https://github.com/vt-middleware/ldaptive/pull/202" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://github.com/vt-middleware/ldaptive/pull/202</a> </p> <p style="margin: 10px 0 0">So I guess I only need to wait for this to get released (latest ldaptive is 2.1.0 from August 2021) and wait for ldaptive to get updated in Shib IdP …. (and in the meantime, I can lower <tt>idp.pool.LDAP.validatePeriod</tt> as a workaround...)</p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"> <script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/IDP-1898?inbox=true&focusedCommentId=31910&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-31910",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/IDP-1898#add-comment?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-d9fc84d9-1cea-4ac8-acdc-14e890f87c57" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://shibboleth.atlassian.net/browse/IDP-1898#add-comment?atlOrigin=eyJpIjoiZWZlOTE4NDBkYWU5NDYxYzhhNDgyZDI4NDUzYWM1MjEiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr> </td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100188-<span title="ecf3178efbb055e61c7447a8f32b01b3d221d447" data-commit-id="ecf3178efbb055e61c7447a8f32b01b3d221d447}">sha1:ecf3178</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-082e7270-e2b2-4bab-ade6-a004a09fa28c" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>