Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[IAM David Bantz]

Daniel, could you please clarify or add specificity to the performance
differences?

 - I understand there's delay entailed between in waiting for a failed
attempt to authN at one directory before attempting another, but that seems
to be << 1 sec; is there some further cascading effect or different sort of
performance hit to be concerned about?

- I've configured several steps of fail-over (in the v2 attribute-resolver
data connectors as well as login.config for authN). Are you saying that
with similar levels of redundancy using v3 aggregate resolver I may be
establishing concurrent connections with 3 - 5 LDAP directories? Wouldn't
THAT entail a performance hit of some sort?

Thanks in advance for further explanation,

David Bantz
UA OIT IAM

On Tue, May 31, 2016 at 11:47 AM, Daniel Fisher <dfisher at vt.edu> wrote:

>
> One advantage [of ladaptive over jaas for LDAP authN] is performance. JAAS
> failover attempts DN resolution and authentication against each directory
> in sequence (probably without connection pooling). The AggregateDnResolver
> attempts DN resolution concurrently, followed by a single authentication
> attempt (probably with connection pooling)....
>
> --Daniel Fisher
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160601/09f55bdd/attachment.html>