Active Directory BIND error rates question

[Douglas E Engert]

On 1/12/2015 3:30 PM, Jim Ennis wrote:
> Hello Shibboleth list,
>
> We are running Shibboleth IDP 2.3.8 at UCF on 4 Solaris servers in production (we are working on moving up to a more current IDP version). We are seeing a small but steady error rate in our Shibboleth
> idp-process logs on failed connections to Microsoft Active Directory (Windows Server 2012 DCs).  While the error rate is about 2/10 of one percent, I would prefer it to be zero.  Does anyone else see
> patterns of these errors (see below) and what is an ‘acceptable’ error rate to other institutions?
>
> 00:03:06.926 - WARN [edu.vt.middleware.ldap.auth.SearchDnResolver:1105] - Error pe
>
> rforming LDAP operation, retrying (attempt 0)
>
> javax.naming.CommunicationException: simple bind failed: net.ucf.edu:3269
>
> As I understand our architecture, the authentication attempt occurs on port 3269 and the attributes are pulled on port 636.
>
> 00:05:21.794 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unable
>
> d to connect to the ldap
>
> javax.naming.CommunicationException: net.ucf.edu:636
>
> The error rate is low, and rarely seen by end-users in most cases, but I would like to know if the pattern is unusual or not.

Ports 636 and 3269 are global catalog ports. If you have a large forest, you may be trying to contact a global catalog
in the forest hosted by a sub domain in some remote location and it may be down. It could also be that you don't have
as many global catalogs as you think.

>
> The errors seem to have begun after our upgrade from Windows Server 2008R2 DCs to Windows Server 2012 DCs.
>
> --jim
>
> Jim Ennis
>
> Director Systems and Operations
>
> University of Central Florida
>
> 12716 Pegasus Drive
>
> CSB 308
>
> Orlando, FL 32816
>
> E-mail: jim.ennis at ucf.edu <mailto:jim.ennis at ucf.edu>
>
> Voice: 407-823-1701
>
> Fax: 407-882-9017
>
>
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>