LDAP failover on error

[Leonard Kroll]

Here is an example of my ldap connector with failover that works.
I have a myLDAP, my2LDAP and my3LDAP, that failover on connection failure or with the noResultIsError flag, if the OU is wrong returning no result. I can then check OUs in other trees.

Hope this helps.

~lennyK

<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
ldapURL="ldaps://xxx.xxx.xxx.xxx ldaps://xxx.xxx.xxx.xxx"
baseDN="ou=Wizard,dc=umassb,dc=net"
principal="xxooxxoo at umassb.net"
principalCredential="wwweeerrr"
lowercaseAttributeNames="true"
noResultIsError="true"
searchScope="SUBTREE">

<resolver:FailoverDataConnector ref="my2LDAP" />

<dc:FilterTemplate>
    <![CDATA[
          (mail=$requestContext.principalName)
   ]]>
</dc:FilterTemplate>

<ReturnAttributes>title samaccountname userprincipalname mail cn givenname sn</ReturnAttributes>

<LDAPProperty name="java.naming.referral" value="follow"/>

</resolver:DataConnector>

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Dan McLaughlin
Sent: Friday, October 19, 2012 10:21 AM
To: Shib Users
Subject: Re: LDAP failover on error

I ended up disabling failover at the connection and moved to multiple sufficient ldap handlers in the login.config and dataconnector failover in the attribute-resolver and this works.  It would have been nice to have all this handled at a lower level, but this will work.

On Friday, October 19, 2012, Daniel Fisher wrote:
On Thu, Oct 18, 2012 at 7:53 PM, Dan McLaughlin
<dmclaughlin at tech-consortium.com<javascript:;>> wrote:
> We are trying to configure our LDAP Data Connector and Login.config so that
> LDAP connections failover if the LDAP server returns an error OR is down.
> Based on the exception below it would seem that the LDAP code as it stands
> today is not able to failover if LDAP queries return errors, only if the
> connection can't be established.  Is this correct?
>

You can configure operation retries based on a specific naming
exception, but I'm not sure if that will provide the behavior you
want:

edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
     ldapUrl="ldap://server-hq8.mydomain.local:636
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636"
     ssl="true"
     connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"
     operationRetryExceptions="javax.naming.NamingException"
     timeout="1000"
     baseDn="T=MYTREE"
     subtreeSearch="true"
     derefAliases="never"
     userFilter="(&(cn={0})(objectclass=person))";

If reopening the connection does not resolve the issue, then we're
probably looking at a custom connection handler to solve this problem.

--Daniel Fisher
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<javascript:;>


--

--

Thanks,

Dan McLaughlin
Technology Consortium, LLC
dmclaughlin at tech-consortium.com<mailto:dmclaughlin at tech-consortium.com>
mobile: 512.633.8086
http://www.tech-consortium.com

NOTICE: This e-mail message and all attachments transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is strictly prohibited. The contents of this e-mail are confidential and may be subject to work product privileges. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

Need to schedule a meeting??? http://www.tungle.me/DanMcLaughlin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121019/3ad79783/attachment-0001.html