idpv3 testing: clientIP in audit logs and consent jdbc ?

[Jarno Huuskonen]

Hi,

On Fri, Jan 30, Tom Zeller wrote:
> Here's what I was using for PostgreSQL, I don't have one for MySQL at
> the moment. And this would be for conf/global.xml.

Thanks, I got it working with mysql. Example config(s) below.
(I think with db you'll want to set idp.consent.maxStoredRecords = -1) ?

Where do I get required DB table definitions ? I think with my mysql
example it tries to use dbname.StorageRecords table.

If I block access to the database server(s):
iptables -I OUTPUT 1 -d ip.add.re.ss -j DROP
iptables -I OUTPUT 1 -d ip.add.re.ss2 -j DROP

Then the login process hangs(chrome timeouts in 60s).
If I use c3p0 connection pool (with short timeouts), then login
succeeds (but after clicking accept on the consent it still takes
close to 20s).
I think this could cause this delay:
idp-consent/src/main/java/net/shibboleth/idp/consent/flow/storage/AbstractConsentIndexedStorageAction.java
it looks like storeResult has hardcoded int attempts = 10
retries. Is it possible to change this with config files ?

>     <bean id="shibboleth.consent.ConsentStorageService"
>         class="org.opensaml.storage.impl.JPAStorageService"
>         p:cleanupInterval="%{idp.storage.cleanupInterval:PT10M}"
>         c:factory-ref="shibboleth.consent.ConsentStorageService.EntityManagerFactory"
>        p:valueSize="2048" />
> 
>     <bean id="shibboleth.consent.ConsentStorageService.EntityManagerFactory"
>         class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
>         <property name="packagesToScan" value="org.opensaml.storage.impl" />
>         <property name="dataSource"
> ref="shibboleth.consent.ConsentStorageService.DataSource" />
>         <property name="jpaVendorAdapter"
> ref="shibboleth.consent.ConsentStorageService.JPAVendorAdapter" />
>         <property name="jpaDialect">
>             <bean
> class="org.springframework.orm.jpa.vendor.HibernateJpaDialect" />
>         </property>
>     </bean>
> 

    <bean id="shibboleth.consent.ConsentStorageService.JPAVendorAdapter"
      class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter">
      <property name="database" value="MYSQL" />
      <property name="databasePlatform"
value="org.hibernate.dialect.MySQL5InnoDBDialect" />
      <property name="generateDdl" value="true" />
    </bean>

    <!-- No connection pool -->
    <bean id="shibboleth.consent.ConsentStorageService.DataSource"
      class="org.springframework.jdbc.datasource.DriverManagerDataSource">
      <property name="driverClassName" value="com.mysql.jdbc.Driver" />
      <property name="url" value="jdbc:mysql://ip.ad.re.ss:3306/DBNAME?connectTimeout=950&amp;socketTimeout=1100" /> <!-- Plus  any other mysql opts -->
      <property name="username" value="YOURUSER" />
      <property name="password" value="YOURPW" />
    </bean>
    <!-- OR c3p0 pool -->
   <bean id="shibboleth.consent.ConsentStorageService.DataSource"
      class="com.mchange.v2.c3p0.ComboPooledDataSource"
      destroy-method="close">
      <property name="driverClass" value="com.mysql.jdbc.Driver" />
      <property name="jdbcUrl" value="jdbc:mysql://ip.ad.re.ss:3306/DBNAME?connectTimeout=950&amp;socketTimeout=1100" /> <!-- Plus  any other mysql opts -->
      <property name="user" value="shibidp" />
      <property name="password" value="PqwaSRcfOiruMe4cxx" />
      <property name="maxPoolSize" value="64" />
      <property name="testConnectionOnCheckout" value="true" />
      <!-- any other c3p0 options --> 
   </bean>

-Jarno

-- 
Jarno Huuskonen