ldap queries hanging

[Ted Wood]

I already have this rule in the connectionConfig bean:

p:connectTimeout="%{idp.authn.LDAP.connectTimeout:3000}"

On its face it seems like it would do the same thing but is there a difference?  I’ve also noticed a bunch of these messages in the idp-warn.log:

WARN [org.ldaptive.AbstractOperation$ReopenOperationExceptionHandler:277] - Operation exception encountered, reopening connection

I found a reference to this warning here:

http://shibboleth.net/pipermail/users/2015-March/020576.html

and this is supposed to be a bug that was fixed in ldaptive 1.0.6 which I am already using.  Perhaps this is an edge case and would there be an problem with upgrading just the ldaptive jar to 1.2.1 which appears to be the latest version?


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Thursday, December 15, 2016 4:59 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: ldap queries hanging

On Thu, Dec 15, 2016 at 3:44 PM, Ted Wood <TWood at parker.edu<mailto:TWood at parker.edu>> wrote:
Hello shibboleth users,

I’m running into an issue where authentication seems to hang with this message in the idp-process.log:

2016-12-15 11:33:40,858 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=joe_random
2016-12-15 11:33:40,859 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:310] - searching for DN using userFilter


Edit ldap-authn-config.xml and add the following property to the connectionConfig bean:

p:responseTimeout="%{idp.authn.LDAP.responseTimeout:3000}"

No guarantees, but that setting may help.

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161216/8bcb7b64/attachment.html>