Active Directory BIND error rates question

[Jim Ennis]

Hello Shibboleth list,

We are running Shibboleth IDP 2.3.8 at UCF on 4 Solaris servers in production (we are working on moving up to a more current IDP version). We are seeing a small but steady error rate in our Shibboleth idp-process logs on failed connections to Microsoft Active Directory (Windows Server 2012 DCs).  While the error rate is about 2/10 of one percent, I would prefer it to be zero.  Does anyone else see patterns of these errors (see below) and what is an 'acceptable' error rate to other institutions?

00:03:06.926 - WARN [edu.vt.middleware.ldap.auth.SearchDnResolver:1105] - Error pe
rforming LDAP operation, retrying (attempt 0)
javax.naming.CommunicationException: simple bind failed: net.ucf.edu:3269

As I understand our architecture, the authentication attempt occurs on port 3269 and the attributes are pulled on port 636.

00:05:21.794 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unable
d to connect to the ldap
javax.naming.CommunicationException: net.ucf.edu:636

The error rate is low, and rarely seen by end-users in most cases, but I would like to know if the pattern is unusual or not.

The errors seem to have begun after our upgrade from Windows Server 2008R2 DCs to Windows Server 2012 DCs.

--jim

Jim Ennis
Director Systems and Operations
University of Central Florida
12716 Pegasus Drive
CSB 308
Orlando, FL 32816

E-mail: jim.ennis at ucf.edu<mailto:jim.ennis at ucf.edu>
Voice: 407-823-1701
Fax: 407-882-9017

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150112/9b9c659f/attachment.html