Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[Daniel Fisher]

On Wed, Jun 1, 2016 at 4:04 PM, IAM David Bantz <dabantz at alaska.edu> wrote:

>  - I understand there's delay entailed between in waiting for a failed
> attempt to authN at one directory before attempting another, but that seems
> to be << 1 sec; is there some further cascading effect or different sort of
> performance hit to be concerned about?
>

I don't think so. Opening new connections is the most expensive activity.
Assuming your directory is properly indexed, pooling connections is where
you're going to get the most benefit.


> - I've configured several steps of fail-over (in the v2 attribute-resolver
> data connectors as well as login.config for authN). Are you saying that
> with similar levels of redundancy using v3 aggregate resolver I may be
> establishing concurrent connections with 3 - 5 LDAP directories? Wouldn't
> THAT entail a performance hit of some sort?
>

Only on IDP startup. Assuming your pools are tuned to keep connections
alive, the work required to keep pools healthy is minimal compared to
opening and closing connections.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160602/11c8bdac/attachment.html>