sporadic user authenication issues

[Dominique Petitpierre]

Hello,

On 02/17/2015 08:33 PM, IAM David Bantz wrote:

> The error in the quoted log messages is explicit:
>
>     LDAP: error code 3 - Timelimit Exceeded
>
> That's AFTER authenticating the user with a bind with the user's
> submitted credentials,
> and AFTER the IdP successfully bound to the ldap and searched for user's
> attributes.
>
> After a few seconds, the directory aborted the ldap search for user's
> attributes with the timeout,

It also could be the client timing out (e.g. "ldapsearch -l <timeout>"
on Linux).  The timeout seems to be 4 seconds which is a clue if you
can find (or change) the respective time limits of the client and
the server.

If it is a LDAP client timeout, it could be caused by a loss of
connectivity to the server unnoticed by the underlying connection
layer, may be due to a proxy restarting, load balancer failover,
etc. In a subsequent post you mention a F5 load balancer: it would be
the main suspect.

Regards.
--
Mr Dominique Petitpierre, user=Dominique.Petitpierre domain=unige.ch
IT Division, University of Geneva, Switzerland