Active Directory BIND error rates question

[Jim Ennis]

Hello Scott and Douglas

We will discuss the AD servers with our MS team and see if we get back to the 0 level error rate we were seeing before our changes last summer.  Not an immediate issue for us, but the error rate should be zero if AD is working properly.

Jim Ennis
Director Systems and Operations
University of Central Florida
12716 Pegasus Drive
CSB 308
Orlando, FL 32816

E-mail: jim.ennis at ucf.edu
Voice: 407-823-1701
Fax: 407-882-9017

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Douglas E Engert
Sent: Monday, January 12, 2015 7:39 PM
To: users at shibboleth.net
Subject: Re: Active Directory BIND error rates question



On 1/12/2015 3:30 PM, Jim Ennis wrote:
> Hello Shibboleth list,
>
> We are running Shibboleth IDP 2.3.8 at UCF on 4 Solaris servers in production (we are working on moving up to a more current IDP version). We are seeing a small but steady error rate in our Shibboleth
> idp-process logs on failed connections to Microsoft Active Directory (Windows Server 2012 DCs).  While the error rate is about 2/10 of one percent, I would prefer it to be zero.  Does anyone else see
> patterns of these errors (see below) and what is an 'acceptable' error rate to other institutions?
>
> 00:03:06.926 - WARN [edu.vt.middleware.ldap.auth.SearchDnResolver:1105] - Error pe
>
> rforming LDAP operation, retrying (attempt 0)
>
> javax.naming.CommunicationException: simple bind failed: net.ucf.edu:3269
>
> As I understand our architecture, the authentication attempt occurs on port 3269 and the attributes are pulled on port 636.
>
> 00:05:21.794 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unable
>
> d to connect to the ldap
>
> javax.naming.CommunicationException: net.ucf.edu:636
>
> The error rate is low, and rarely seen by end-users in most cases, but I would like to know if the pattern is unusual or not.

Ports 636 and 3269 are global catalog ports. If you have a large forest, you may be trying to contact a global catalog
in the forest hosted by a sub domain in some remote location and it may be down. It could also be that you don't have
as many global catalogs as you think.

>
> The errors seem to have begun after our upgrade from Windows Server 2008R2 DCs to Windows Server 2012 DCs.
>
> --jim
>
> Jim Ennis
>
> Director Systems and Operations
>
> University of Central Florida
>
> 12716 Pegasus Drive
>
> CSB 308
>
> Orlando, FL 32816
>
> E-mail: jim.ennis at ucf.edu <mailto:jim.ennis at ucf.edu>
>
> Voice: 407-823-1701
>
> Fax: 407-882-9017
>
>
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net