IDP Login Delay Question

[Cameron Kerr]

I suspect you may have had an issue due to either:

Firewall rules not allowing both UDP/53 AND TCP/53;

Issues around something like DNS packet size or size of response causing UDP DNS to fail, or something like EDNS. Could also be influenced by IPv6. 

Are you on the same subnet as your DNS server?

You could try and replicate the behaviour from your IdP with dig, as that doesn't use /etc/hosts. You might try turning on warnings or tracing. 

If you could send us a clear screenshot of the wireshark traces showing the requests (with full DNS options) that fail and succeed, suitably anonymised, then that may help. 

Suggest doing another wireshark or tcpdump in the IdP side, but without any capture filter (use -s1500 -p -nn -w somefile.pcap options for tcpdump, then open the completed capture on a different machine running wireshark. 

Other things to look for in the capture: funny ARP behaviour; 

Anything on the DNS server event log?

Does your DNS server have multiple interfaces? Are DNS and IdP in the same subnet?

You might also try running DNSlint (see Microsoft knowledge base) on your DNS servers. 

Sent from my iPhone

> On 1/04/2014, at 4:42 am, "Joseph Lucia" <jlucia at cysd.k12.pa.us> wrote:
> 
> I took the easy path and simply added my DC's to the /etc/hosts file and
> then changed /etc/host.conf to read order hosts,bind,nis. Problem solved.
> Thanks for everyone's assistance.
> 
> 
> Joseph Lucia
> Information Systems Specialist
> Central York School District
> 717-846-6789 x1211
> jlucia at cysd.k12.pa.us
> 
> 
> 
> 
> 
> 
> On Mar 31, 2014 ~ Mar 31, 2014 ~ 10:27 AM 10:27 AM, "Joseph Lucia"
> <jlucia at cysd.k12.pa.us> wrote:
> 
>> Daniel,
>> 
>> Your suspected weirdness is exactly what is going on. For testing purposes
>> as suggested I removed the TLS="true" and changed the LDAP to
>> ldap://ip-address and the problem was not reproducible, unfortunately
>> since I am using SSL/TLS I can't have just the hostname as the Java
>> verifier throws an exception since it can't resolve the IP to certificate
>> hostname.
>> 
>> So further digging showed the following, when I did a Wireshark capture of
>> the Windows 2008 R2 DNS servers (which are also the DC's) I see the DNS
>> query come in for the DC and no response is given, then 5 seconds later I
>> see a second query for the DC, on the second query the DNS server replies
>> with the IP. This is my delay right here. I also changed the DNS server
>> address in the IDP's ifconfig to an old OSX DNS server that is to be
>> decommissioned and the issue could not be replicated with this server.
>> 
>> This is good that I have a clear understanding of what is happening, but
>> why is a different story, what is interesting is I have lots of students
>> and staff using these DNS servers without any issues. I don't see any no
>> response A name queries outside of my IDP server. Quite the anomaly.
>> 
>> If anyone has any ideas, I would be happy to hear them.
>> 
>> Thanks,
>> 
>> Joseph Lucia
>> Information Systems Specialist
>> Central York School District
>> 717-846-6789 x1211
>> jlucia at cysd.k12.pa.us
>> 
>> 
>> 
>> 
>> 
>> 
>> On Mar 28, 2014 ~ Mar 28, 2014 ~ 6:20 PM 6:20 PM, "Daniel Fisher"
>> <dfisher at vt.edu> wrote:
>> 
>>> On Fri, Mar 28, 2014 at 9:31 AM, Joseph Lucia <jlucia at cysd.k12.pa.us>
>>> wrote:
>>>> I changed the timeout with no additional success. My domain also does
>>>> not
>>>> have any child domains.
>>>> 
>>>> As a test I changed from SSL true to TLS true, it still hangs after the
>>>> first quick login. So as an additional test I removed the bind username
>>>> and
>>>> password, rebooted, first login failed, but failed quickly the logs
>>>> show
>>>> that it needs the bind authentication, which I knew. So I closed the
>>>> browser, waited couple of minutes, then tried to login again, this time
>>>> it
>>>> got stuck in the same place as normal for the 5 seconds before saying
>>>> bad
>>>> username and password.
>>> 
>>> Try changing dc3.example.com to the actual IP address of your server,
>>> I'm curious if there is some DNS weirdness going on.
>>> 
>>> --Daniel Fisher
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>> 
>> --
>> CONFIDENTIALITY NOTICE ­ This email message, including any attachments,
>> is for the sole use of the intended recipient(s) and may contain
>> confidential and privileged information. Any unauthorized review, use,
>> disclosure, or distribution is prohibited. If you are not the intended
>> recipient, please contact the sender by reply email and destroy all
>> copies of the original message.
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
> 
> --
> CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net