IDP Login Delay Question

[Joseph Lucia]

Thanks for the info.

As a test, I turned off SSL in the login.config for LDAP. I am still
getting a 5 second delay, but at a different step in the process. It seems
the DefaultConnectionHandler is my issue.

11:51:49.510 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:102] -
Looking up DN using userFilter
11:51:49.511 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] -
Search with the following parameters:
11:51:49.513 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -
 dn = OU=Users,DC=example,DC=com
11:51:49.516 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -
 filter = sAMAccountName={0}
11:51:49.516 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -
 filterArgs = [username]
11:51:49.517 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -
 searchControls = javax.naming.directory.SearchControls at 545576ef
11:51:49.519 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -
 handler =
[edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 36f3702a]
11:51:49.519 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
the following parameters:
11:51:49.522 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype
= simple
11:51:49.522 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn =
CN=Binder,OU=Users,DC=example,DC=com
11:51:49.523 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -
credential = <suppressed>
11:51:54.559 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
the following parameters:
11:51:54.560 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype
= simple
11:51:54.560 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn =
CN=Username,OU=Users,DC=example,DC=com
11:51:54.561 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -
credential = <suppressed>

I might have to just live with the delay,


Joseph Lucia
Information Systems Specialist
Central York School District
717-846-6789 x1211
jlucia at cysd.k12.pa.us






On Mar 25, 2014 ~ Mar 25, 2014 ~ 11:40 AM 11:40 AM, "Cantor, Scott"
<cantor.2 at osu.edu> wrote:

>On 3/25/14, 11:28 AM, "Joseph Lucia" <jlucia at cysd.k12.pa.us> wrote:
>
>>I think I found my delay, but not sure what is causing it. This is from
>>the debug logs, is this normal delay? It seems to be the Set hostname
>>verifier for ldaps.
>
>No, that's not normal. I'd be more inclined to think it's something to do
>with the certificate. I'm not familiar with that code, but perhaps
>something in the cert like a CRL endpoint is triggering something inside
>Java. The symptom certainly fits the common case of a client hitting a
>cert, and following a dead LDAP or HTTPS CRL extension.
>
>-- Scott
>
>>11:19:55.608 - DEBUG
>>[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set
>>hostname verifier for ldaps
>>11:20:00.630 - DEBUG
>>[edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking
>>checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at 2f73b909
>>11:20:00.643 - DEBUG
>>[edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking
>>checkServerTrusted for
>>edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 33d40863
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net

--
CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.