Problems with LDAP Connection Pool in LDAP Data Connectors

[Daniel Fisher]

On Wed, Oct 10, 2012 at 4:08 AM, Dan McLaughlin
<dmclaughlin at tech-consortium.com> wrote:
> We've starting using LDAP Connection Pooling for our LDAP Data
> Connectors this week and we've started running into " no failover data
> connector available" exceptions.
>
> Netstat only shows a single connection to the LDAP server.  Has anyone
> else seen issues with the LDAP Connection Pooling?
>
> Here is my data connector:
>
>  <resolver:DataConnector xsi:type="dc:LDAPDirectory"
>     id="NOVELLEDIR"
>     ldapURL="ldaps://ldap01:636 ldaps://ldap02:636 ldaps://ldap03:636"
>     baseDN="T=MYTREE">
>
>     <dc:FilterTemplate>
>       <![CDATA[
>       (&(cn=$requestContext.principalName)(objectclass=person))
>       ]]>
>     </dc:FilterTemplate>
>
>     <dc:ReturnAttributes>GUID cn sn givenName mail
> telephoneNumber</dc:ReturnAttributes>
>
>     <dc:LDAPProperty name="java.naming.ldap.derefAliases" value="never"/>
>     <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="GUID"/>
>     <dc:LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="500"/>
>
>     <dc:ConnectionPool minPoolSize="5"
>                        maxPoolSize="10"
>                        blockWhenEmpty="true"
>                        blockWaitTime="PT5S"
>                        validatePeriodically="true"
>                        validateTimerPeriod="PT30M"
>                        validateDN="o=AUS"
>                        validateFilter="(o=AUS)"
>                        expirationTime="PT10M" />
>
>   </resolver:DataConnector>
>
> Here are TRACE logs showing the logs leading up the error…
>
>
> 18:07:13.602 - ERROR
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:379]
> - Received the following error from data connector NOVELLEDIR, no
> failover data connector available
> edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException:
> An error occurred when attempting to search the LDAP
>         at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.searchLdap(LdapDataConnector.java:372)
> ~[shibboleth-common-1.3.5.jar:na]
>         at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.resolve(LdapDataConnector.java:315)
> ~[shibboleth-common-1.3.5.jar:na]
>         at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.resolve(LdapDataConnector.java:50)

Can you put the
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector
package in debug and post those logs? That should show the underlying
exception. The IDP startup logs may also be useful for determining why
your pool isn't initializing correctly.

--Daniel Fisher