Data Connector failover behavior

[Cantor, Scott]

On 6/3/13 8:47 PM, "David Bantz" <dabantz at alaska.edu> wrote:
>
>One recent Monday the primary AD server used for both authN and LDAP
>attribute retrieval was unaccountably off-line.

I think OSU and UA should merge into one uber-IT department of suckage.

>Am I correct in reporting that the IdP will not start of an LDAP Data
>Connector cannot bind to the directory?  Even if a properly configured
>failover connector is configured?

Pre 2.4, that was true. 2.4 should properly failover during startup. I
backported a change that I made locally once we were doing an update.

https://issues.shibboleth.net/jira/browse/SC-184

>Is there some other configuration tweak I can or should be using to
>prevent an IdP failure to start in a similar abnormal situation (LDAP
>off-line)?

The only way to get 2.3 to do this is by installing a custom version of
the LDAP data connector that works differently, or by not pooling. It's
pool init code that's throwing the error, and that happens earlier than
the failover logic can take over.

>It's surely right to warn me that I'm attempting to start an IdP that
>cannot successfully bind one of the Data Connectors, but would it be
>reasonable to enable the IdP process to start and do what it can with
>configured failover and redundancy?

You have to keep in mind that most of the failover stuff was me haranguing
Chad. His view was that your IT infra is at fault and you have bigger
problems than your IdP if this is a problem. I work in a, shall we say,
different kind of environment.

-- Scott