IDP Login Delay Question

[Joseph Lucia]

Daniel,

Your suspected weirdness is exactly what is going on. For testing purposes
as suggested I removed the TLS="true" and changed the LDAP to
ldap://ip-address and the problem was not reproducible, unfortunately
since I am using SSL/TLS I can't have just the hostname as the Java
verifier throws an exception since it can't resolve the IP to certificate
hostname.

So further digging showed the following, when I did a Wireshark capture of
the Windows 2008 R2 DNS servers (which are also the DC's) I see the DNS
query come in for the DC and no response is given, then 5 seconds later I
see a second query for the DC, on the second query the DNS server replies
with the IP. This is my delay right here. I also changed the DNS server
address in the IDP's ifconfig to an old OSX DNS server that is to be
decommissioned and the issue could not be replicated with this server.

This is good that I have a clear understanding of what is happening, but
why is a different story, what is interesting is I have lots of students
and staff using these DNS servers without any issues. I don't see any no
response A name queries outside of my IDP server. Quite the anomaly.

If anyone has any ideas, I would be happy to hear them.

Thanks,

Joseph Lucia
Information Systems Specialist
Central York School District
717-846-6789 x1211
jlucia at cysd.k12.pa.us






On Mar 28, 2014 ~ Mar 28, 2014 ~ 6:20 PM 6:20 PM, "Daniel Fisher"
<dfisher at vt.edu> wrote:

>On Fri, Mar 28, 2014 at 9:31 AM, Joseph Lucia <jlucia at cysd.k12.pa.us>
>wrote:
>> I changed the timeout with no additional success. My domain also does
>>not
>> have any child domains.
>>
>> As a test I changed from SSL true to TLS true, it still hangs after the
>> first quick login. So as an additional test I removed the bind username
>>and
>> password, rebooted, first login failed, but failed quickly the logs show
>> that it needs the bind authentication, which I knew. So I closed the
>> browser, waited couple of minutes, then tried to login again, this time
>>it
>> got stuck in the same place as normal for the 5 seconds before saying
>>bad
>> username and password.
>>
>
>Try changing dc3.example.com to the actual IP address of your server,
>I'm curious if there is some DNS weirdness going on.
>
>--Daniel Fisher
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net

--
CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.