LDAP failover on error
Dan McLaughlin
dmclaughlin at tech-consortium.com
Thu Oct 18 19:53:16 EDT 2012
We are trying to configure our LDAP Data Connector and Login.config so that
LDAP connections failover if the LDAP server returns an error OR is down.
Based on the exception below it would seem that the LDAP code as it stands
today is not able to failover if LDAP queries return errors, only if the
connection can't be established. Is this correct?
*
*
*attribute-resolver.xml*
*
*
<resolver:DataConnector xsi:type="dc:LDAPDirectory"
id="NOVELLEDIR"
ldapURL="ldaps://server-hq8.mydomain.local:636
ldaps://hq8.mydomain.local:636 ldaps://server-hq5.mydomain.local:636"
baseDN="T=MYTREE">
<dc:FilterTemplate>
<![CDATA[
(&(cn=$requestContext.principalName)(objectclass=person))
]]>
</dc:FilterTemplate>
<dc:ReturnAttributes>GUID cn sn givenName mail
telephoneNumber</dc:ReturnAttributes>
<dc:LDAPProperty name="java.naming.ldap.derefAliases" value="never"/>
<dc:LDAPProperty name="java.naming.ldap.attributes.binary"
value="GUID"/>
<dc:LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="500"/>
<dc:ConnectionPool minPoolSize="5"
maxPoolSize="10"
blockWhenEmpty="true"
blockWaitTime="PT5S"
validatePeriodically="true"
validateTimerPeriod="PT30M"
validateDN="o=MYORG"
validateFilter="(o=MYORG)"
expirationTime="PT10M" />
</resolver:DataConnector>
*login.config*
edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
ldapUrl="ldap://server-hq8.mydomain.local:636
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636"
ssl="true"
connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"
timeout="1000"
baseDn="T=MYTREE"
subtreeSearch="true"
derefAliases="never"
userFilter="(&(cn={0})(objectclass=person))";
18:41:12.285 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:264] -
Begin abort
18:41:12.200 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:144] -
Begin initialize
18:41:12.201 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:180] -
useFirstPass = false
18:41:12.201 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:181] -
tryFirstPass = false
18:41:12.201 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:182] -
storePass = false
18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:183] -
clearPass = false
18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:184] -
setLdapPrincipal = true
18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:185] -
setLdapDnPrincipal = false
18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:186] -
setLdapCredential = true
18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:187] -
defaultRole = []
18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:188] -
principalGroupName = null
18:41:12.203 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:189] -
roleGroupName = null
18:41:12.203 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:77] -
userRoleAttribute = []
18:41:12.208 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1385]
- setting searchScope: ONELEVEL
18:41:12.210 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:427]
- setting subtreeSearch: true
18:41:12.211 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1385]
- setting searchScope: SUBTREE
18:41:12.211 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1370]
- setting baseDn: T=MYTREE
18:41:12.211 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1834]
- setting ssl: true
18:41:12.211 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1168]
- setting ldapUrl: ldap://server-hq8.mydomain.local:636
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636
18:41:12.214 - TRACE
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:93] - setting
connectionStrategy: ACTIVE_PASSIVE
18:41:12.214 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1119]
- setting connectionHandler:
edu.vt.middleware.ldap.handler.DefaultConnectionHandler at 17bdbee
18:41:12.214 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1651]
- setting derefAliases: never
18:41:12.214 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:290]
- setting userFilter: (&(cn={0})(objectclass=person))
18:41:12.215 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1260]
- setting timeout: 1000
18:41:12.216 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] -
Created authenticator:
edu.vt.middleware.ldap.auth.AuthenticatorConfig at 30989818::env={java.naming.provider.url=ldap://server-hq8.mydomain.local:636
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
com.sun.jndi.ldap.connect.timeout=1000,
java.naming.ldap.derefAliases=never, java.naming.security.protocol=ssl}
18:41:12.216 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:412] -
Begin getCredentials
18:41:12.216 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:413] -
useFistPass = false
18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:414] -
tryFistPass = false
18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:415] -
useCallback = false
18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:416] -
callbackhandler class =
javax.security.auth.login.LoginContext$SecureCallbackHandler
18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:419] -
name callback class = javax.security.auth.callback.NameCallback
18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:421] -
password callback class = javax.security.auth.callback.PasswordCallback
18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:102] -
Looking up DN using userFilter
18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] -
Search with the following parameters:
18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -
dn = T=MYTREE
18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -
filter = (&(cn={0})(objectclass=person))
18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -
filterArgs = [me]
18:41:12.219 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -
searchControls = javax.naming.directory.SearchControls at d58174
18:41:12.219 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -
handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 125ea2d]
18:41:12.219 - TRACE [edu.vt.middleware.ldap.auth.SearchDnResolver:200] -
config = {java.naming.provider.url=ldap://server-hq8.mydomain.local:636
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
com.sun.jndi.ldap.connect.timeout=1000,
java.naming.ldap.derefAliases=never, java.naming.security.protocol=ssl}
18:41:12.219 - TRACE
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:93] - setting
connectionStrategy: ACTIVE_PASSIVE
18:41:12.219 - TRACE
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:110] - setting
connectionRetryExceptions: [class javax.naming.NamingException]
18:41:12.219 - TRACE
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:152] - {0}
Attempting connection to ldap://server-hq8.mydomain.local:636 for strategy
ACTIVE_PASSIVE
18:41:12.220 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
the following parameters:
18:41:12.220 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype =
simple
18:41:12.220 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = null
18:41:12.220 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential
= <suppressed>
18:41:12.220 - TRACE
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:87] - env =
{java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.provider.url=ldap://server-hq8.mydomain.local:636,
com.sun.jndi.ldap.connect.timeout=1000,
java.naming.ldap.derefAliases=never, java.naming.security.protocol=ssl}
18:41:12.231 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set
hostname verifier for ldaps
18:41:12.245 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75]
- invoking checkServerTrusted for
sun.security.ssl.X509TrustManagerImpl at 13f163f
18:41:12.246 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75]
- invoking checkServerTrusted for
edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 764179
18:41:12.246 - DEBUG
[edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the
following parameters:
18:41:12.246 - DEBUG
[edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] - hostname =
server-hq8.mydomain.local
18:41:12.247 - DEBUG
[edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] - cert =
CN=server-HQ8.mydomain.local, O=server
18:41:12.247 - DEBUG
[edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using
subjectAltNames = []
18:41:12.248 - DEBUG
[edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:214] - verifyDNS using
CN = [server-HQ8.mydomain.local]
18:41:12.248 - DEBUG
[edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:219] - verifyDNS found
hostname match: server-HQ8.mydomain.local
18:41:12.248 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:90]
- invoking getAcceptedIssuers invoked for
sun.security.ssl.X509TrustManagerImpl at 13f163f
18:41:12.248 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:90]
- invoking getAcceptedIssuers invoked for
edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 764179
18:41:12.284 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:164] -
Error occured attempting authentication
javax.naming.NamingException: [LDAP: error code 80 - NDS error: DS agent
closing (-776)]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3131) ~[na:1.7.0_07]
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3033)
~[na:1.7.0_07]
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2840)
~[na:1.7.0_07]
at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1849) ~[na:1.7.0_07]
at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1772) ~[na:1.7.0_07]
at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1789) ~[na:1.7.0_07]
at
com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:412)
~[na:1.7.0_07]
at
com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:394)
~[na:1.7.0_07]
at
com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:376)
~[na:1.7.0_07]
at edu.vt.middleware.ldap.AbstractLdap.search(AbstractLdap.java:215)
~[vt-ldap-3.3.5.jar:na]
at
edu.vt.middleware.ldap.auth.SearchDnResolver.resolve(SearchDnResolver.java:139)
~[vt-ldap-3.3.5.jar:na]
at edu.vt.middleware.ldap.auth.Authenticator.getDn(Authenticator.java:106)
~[vt-ldap-3.3.5.jar:na]
at
edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:74)
~[vt-ldap-3.3.5.jar:na]
at
edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:320)
~[vt-ldap-3.3.5.jar:na]
at
edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:277)
~[vt-ldap-3.3.5.jar:na]
at
edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:60)
~[vt-ldap-3.3.5.jar:na]
at
edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:103)
~[vt-ldap-3.3.5.jar:na]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
~[na:1.7.0_07]
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
~[na:1.7.0_07]
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
~[na:1.7.0_07]
at java.lang.reflect.Method.invoke(Method.java:601) ~[na:1.7.0_07]
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)
[na:1.7.0_07]
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
[na:1.7.0_07]
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)
[na:1.7.0_07]
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)
[na:1.7.0_07]
at java.security.AccessController.doPrivileged(Native Method) [na:1.7.0_07]
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)
[na:1.7.0_07]
at javax.security.auth.login.LoginContext.login(LoginContext.java:594)
[na:1.7.0_07]
at
edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:177)
[shibboleth-identityprovider-2.3.6.jar:na]
at
edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123)
[shibboleth-identityprovider-2.3.6.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
[servlet-api.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[catalina.jar:7.0.32]
at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.3.6.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[catalina.jar:7.0.32]
at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81)
[shibboleth-identityprovider-2.3.6.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[catalina.jar:7.0.32]
at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common-1.3.5.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:205)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
[catalina.jar:7.0.32]
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
[catalina.jar:7.0.32]
at
com.googlecode.psiprobe.Tomcat70AgentValve.invoke(Tomcat70AgentValve.java:38)
[tomcat70adaptor-2.3.2.jar:2.3.2]
at
org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:219)
[catalina-ha.jar:7.0.32]
at
org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:333)
[catalina-ha.jar:7.0.32]
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
[catalina.jar:7.0.32]
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:929)
[catalina.jar:7.0.32]
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
[catalina.jar:7.0.32]
at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:680)
[catalina.jar:7.0.32]
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
[catalina.jar:7.0.32]
at org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:197)
[tomcat-coyote.jar:7.0.32]
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
[tomcat-coyote.jar:7.0.32]
at
org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:1813)
[tomcat-coyote.jar:7.0.32]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
[na:1.7.0_07]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
[na:1.7.0_07]
at java.lang.Thread.run(Thread.java:722) [na:1.7.0_07]
18:41:12.285 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:264] -
Begin abort
--
Thanks,
Dan McLaughlin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121018/c7169edb/attachment-0001.html
More information about the users
mailing list