LDAP failover on error
Dan McLaughlin
dmclaughlin at tech-consortium.com
Thu Oct 18 20:30:33 EDT 2012
I tried the following, but it didn't help. I also tried with &
without the handlerIgnoreExceptions
set.
edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
ldapUrl="ldap://server-hq8.mydomain.local:636
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636"
ssl="true"
connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}{connectionRetryExceptions=javax.naming.NamingException}}"
timeout="1000"
handlerIgnoreExceptions="javax.naming.NamingException"
baseDn="T=MYTREE"
subtreeSearch="true"
derefAliases="never"
userFilter="(&(cn={0})(objectclass=person))";
--
Thanks,
Dan McLaughlin
On Thu, Oct 18, 2012 at 6:53 PM, Dan McLaughlin <
dmclaughlin at tech-consortium.com> wrote:
> We are trying to configure our LDAP Data Connector and Login.config so
> that LDAP connections failover if the LDAP server returns an error OR is
> down. Based on the exception below it would seem that the LDAP code as
> it stands today is not able to failover if LDAP queries return errors, only
> if the connection can't be established. Is this correct?
> *
> *
> *attribute-resolver.xml*
> *
> *
> <resolver:DataConnector xsi:type="dc:LDAPDirectory"
> id="NOVELLEDIR"
> ldapURL="ldaps://server-hq8.mydomain.local:636
> ldaps://hq8.mydomain.local:636 ldaps://server-hq5.mydomain.local:636"
> baseDN="T=MYTREE">
>
> <dc:FilterTemplate>
> <![CDATA[
> (&(cn=$requestContext.principalName)(objectclass=person))
> ]]>
> </dc:FilterTemplate>
>
> <dc:ReturnAttributes>GUID cn sn givenName mail
> telephoneNumber</dc:ReturnAttributes>
>
> <dc:LDAPProperty name="java.naming.ldap.derefAliases" value="never"/>
> <dc:LDAPProperty name="java.naming.ldap.attributes.binary"
> value="GUID"/>
> <dc:LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="500"/>
>
> <dc:ConnectionPool minPoolSize="5"
> maxPoolSize="10"
> blockWhenEmpty="true"
> blockWaitTime="PT5S"
> validatePeriodically="true"
> validateTimerPeriod="PT30M"
> validateDN="o=MYORG"
> validateFilter="(o=MYORG)"
> expirationTime="PT10M" />
>
> </resolver:DataConnector>
>
> *login.config*
>
> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
> ldapUrl="ldap://server-hq8.mydomain.local:636
> ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636"
> ssl="true"
>
> connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"
> timeout="1000"
> baseDn="T=MYTREE"
> subtreeSearch="true"
> derefAliases="never"
> userFilter="(&(cn={0})(objectclass=person))";
>
> 18:41:12.285 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:264] -
> Begin abort
> 18:41:12.200 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:144] -
> Begin initialize
> 18:41:12.201 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:180] -
> useFirstPass = false
> 18:41:12.201 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:181] -
> tryFirstPass = false
> 18:41:12.201 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:182] -
> storePass = false
> 18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:183] -
> clearPass = false
> 18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:184] -
> setLdapPrincipal = true
> 18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:185] -
> setLdapDnPrincipal = false
> 18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:186] -
> setLdapCredential = true
> 18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:187] -
> defaultRole = []
> 18:41:12.202 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:188] -
> principalGroupName = null
> 18:41:12.203 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:189] -
> roleGroupName = null
> 18:41:12.203 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:77] -
> userRoleAttribute = []
> 18:41:12.208 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1385] - setting
> searchScope: ONELEVEL
> 18:41:12.210 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:427]
> - setting subtreeSearch: true
> 18:41:12.211 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1385] - setting
> searchScope: SUBTREE
> 18:41:12.211 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1370] - setting
> baseDn: T=MYTREE
> 18:41:12.211 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1834] - setting ssl: true
> 18:41:12.211 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1168] - setting ldapUrl:
> ldap://server-hq8.mydomain.local:636 ldap://hq8.mydomain.local:636
> ldap://server-hq5.mydomain.local:636
> 18:41:12.214 - TRACE
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:93] - setting
> connectionStrategy: ACTIVE_PASSIVE
> 18:41:12.214 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1119] - setting
> connectionHandler:
> edu.vt.middleware.ldap.handler.DefaultConnectionHandler at 17bdbee
> 18:41:12.214 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1651] - setting
> derefAliases: never
> 18:41:12.214 - TRACE [edu.vt.middleware.ldap.auth.AuthenticatorConfig:290]
> - setting userFilter: (&(cn={0})(objectclass=person))
> 18:41:12.215 - TRACE
> [edu.vt.middleware.ldap.auth.AuthenticatorConfig:1260] - setting timeout:
> 1000
> 18:41:12.216 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] -
> Created authenticator:
> edu.vt.middleware.ldap.auth.AuthenticatorConfig at 30989818::env={java.naming.provider.url=ldap://server-hq8.mydomain.local:636
> ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636,
> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> com.sun.jndi.ldap.connect.timeout=1000,
> java.naming.ldap.derefAliases=never, java.naming.security.protocol=ssl}
> 18:41:12.216 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:412] -
> Begin getCredentials
> 18:41:12.216 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:413] -
> useFistPass = false
> 18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:414] -
> tryFistPass = false
> 18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:415] -
> useCallback = false
> 18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:416] -
> callbackhandler class =
> javax.security.auth.login.LoginContext$SecureCallbackHandler
> 18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:419] -
> name callback class = javax.security.auth.callback.NameCallback
> 18:41:12.217 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:421] -
> password callback class = javax.security.auth.callback.PasswordCallback
> 18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:102] -
> Looking up DN using userFilter
> 18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] -
> Search with the following parameters:
> 18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -
> dn = T=MYTREE
> 18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -
> filter = (&(cn={0})(objectclass=person))
> 18:41:12.218 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -
> filterArgs = [me]
> 18:41:12.219 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -
> searchControls = javax.naming.directory.SearchControls at d58174
> 18:41:12.219 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -
> handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 125ea2d
> ]
> 18:41:12.219 - TRACE [edu.vt.middleware.ldap.auth.SearchDnResolver:200] -
> config = {java.naming.provider.url=ldap://server-hq8.mydomain.local:636
> ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636,
> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> com.sun.jndi.ldap.connect.timeout=1000,
> java.naming.ldap.derefAliases=never, java.naming.security.protocol=ssl}
> 18:41:12.219 - TRACE
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:93] - setting
> connectionStrategy: ACTIVE_PASSIVE
> 18:41:12.219 - TRACE
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:110] - setting
> connectionRetryExceptions: [class javax.naming.NamingException]
> 18:41:12.219 - TRACE
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:152] - {0}
> Attempting connection to ldap://server-hq8.mydomain.local:636 for strategy
> ACTIVE_PASSIVE
> 18:41:12.220 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
> the following parameters:
> 18:41:12.220 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype =
> simple
> 18:41:12.220 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = null
> 18:41:12.220 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential
> = <suppressed>
> 18:41:12.220 - TRACE
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:87] - env =
> {java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> java.naming.provider.url=ldap://server-hq8.mydomain.local:636,
> com.sun.jndi.ldap.connect.timeout=1000,
> java.naming.ldap.derefAliases=never, java.naming.security.protocol=ssl}
> 18:41:12.231 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set
> hostname verifier for ldaps
> 18:41:12.245 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75]
> - invoking checkServerTrusted for
> sun.security.ssl.X509TrustManagerImpl at 13f163f
> 18:41:12.246 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75]
> - invoking checkServerTrusted for
> edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 764179
> 18:41:12.246 - DEBUG
> [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the
> following parameters:
> 18:41:12.246 - DEBUG
> [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] - hostname =
> server-hq8.mydomain.local
> 18:41:12.247 - DEBUG
> [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] - cert =
> CN=server-HQ8.mydomain.local, O=server
> 18:41:12.247 - DEBUG
> [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using
> subjectAltNames = []
> 18:41:12.248 - DEBUG
> [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:214] - verifyDNS using
> CN = [server-HQ8.mydomain.local]
> 18:41:12.248 - DEBUG
> [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:219] - verifyDNS found
> hostname match: server-HQ8.mydomain.local
> 18:41:12.248 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:90]
> - invoking getAcceptedIssuers invoked for
> sun.security.ssl.X509TrustManagerImpl at 13f163f
> 18:41:12.248 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:90]
> - invoking getAcceptedIssuers invoked for
> edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 764179
> 18:41:12.284 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:164] -
> Error occured attempting authentication
> javax.naming.NamingException: [LDAP: error code 80 - NDS error: DS agent
> closing (-776)]
> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3131) ~[na:1.7.0_07]
> at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3033)
> ~[na:1.7.0_07]
> at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2840)
> ~[na:1.7.0_07]
> at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1849) ~[na:1.7.0_07]
> at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1772) ~[na:1.7.0_07]
> at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1789) ~[na:1.7.0_07]
> at
> com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:412)
> ~[na:1.7.0_07]
> at
> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:394)
> ~[na:1.7.0_07]
> at
> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:376)
> ~[na:1.7.0_07]
> at edu.vt.middleware.ldap.AbstractLdap.search(AbstractLdap.java:215)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.auth.SearchDnResolver.resolve(SearchDnResolver.java:139)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.auth.Authenticator.getDn(Authenticator.java:106)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:74)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:320)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:277)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:60)
> ~[vt-ldap-3.3.5.jar:na]
> at
> edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:103)
> ~[vt-ldap-3.3.5.jar:na]
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> ~[na:1.7.0_07]
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
> ~[na:1.7.0_07]
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> ~[na:1.7.0_07]
> at java.lang.reflect.Method.invoke(Method.java:601) ~[na:1.7.0_07]
> at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)
> [na:1.7.0_07]
> at
> javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
> [na:1.7.0_07]
> at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)
> [na:1.7.0_07]
> at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)
> [na:1.7.0_07]
> at java.security.AccessController.doPrivileged(Native Method)
> [na:1.7.0_07]
> at
> javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)
> [na:1.7.0_07]
> at javax.security.auth.login.LoginContext.login(LoginContext.java:594)
> [na:1.7.0_07]
> at
> edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:177)
> [shibboleth-identityprovider-2.3.6.jar:na]
> at
> edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123)
> [shibboleth-identityprovider-2.3.6.jar:na]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
> [servlet-api.jar:na]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [catalina.jar:7.0.32]
> at
> edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
> [shibboleth-identityprovider-2.3.6.jar:na]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [catalina.jar:7.0.32]
> at
> edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81)
> [shibboleth-identityprovider-2.3.6.jar:na]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [catalina.jar:7.0.32]
> at
> edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
> [shibboleth-common-1.3.5.jar:na]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:205)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> [catalina.jar:7.0.32]
> at
> com.googlecode.psiprobe.Tomcat70AgentValve.invoke(Tomcat70AgentValve.java:38)
> [tomcat70adaptor-2.3.2.jar:2.3.2]
> at
> org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:219)
> [catalina-ha.jar:7.0.32]
> at
> org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:333)
> [catalina-ha.jar:7.0.32]
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:929)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:680)
> [catalina.jar:7.0.32]
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> [catalina.jar:7.0.32]
> at
> org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:197)
> [tomcat-coyote.jar:7.0.32]
> at
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
> [tomcat-coyote.jar:7.0.32]
> at
> org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:1813)
> [tomcat-coyote.jar:7.0.32]
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
> [na:1.7.0_07]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
> [na:1.7.0_07]
> at java.lang.Thread.run(Thread.java:722) [na:1.7.0_07]
> 18:41:12.285 - TRACE [edu.vt.middleware.ldap.jaas.LdapLoginModule:264] -
> Begin abort
>
>
> --
>
> Thanks,
>
> Dan McLaughlin
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121018/0c0f6276/attachment-0001.html
More information about the users
mailing list