Sjibb LDAP pool hangs on firewall TCP session truncation

[Daniel Fisher]

On Tue, Jun 14, 2016 at 12:22 PM, Rich Graves <rgraves at carleton.edu> wrote:

>
> Progress, thanks! Although I haven't been able to reproduce the blocking
> production failure in test (production was fixed by increasing firewall
> idle timeouts), when I (intentionally) break the test system's access to
> LDAP by dropping responses with client-side iptables, what I see is:
>   a) a quick responseTimeout
>   b) the pooled connection validator kills the connection
>   c) an exception is raised and caught
>   d) the user is sent back to the login form with visible error "Login
> Failure: Validation of connection failed."
> Ideally, I would like to see the shibb server automatically retry with the
> next LDAP server in the list instead of (d). Can that be done?
>

Not easily. If you can't keep your connection pool healthy you may be
better off just turning off pooling.


> Another related observation: the user or users need to fail and see the
> "Validation of connection failed" error idp.pool.LDAP.minSize times, not
> just once. Why? Because at least on my system, all
> idp.pool.LDAP.minSize..maxSize connections are created with the first
> working member of the idp.authn.LDAP.ldapURL list. Can I tell ldaptive to
> use ldapUrl in series or at random instead of as an ordered failover list?
>

Yes. It requires a bit more config, but you can use round robin or random
connection strategies.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160616/9004e8ad/attachment.html>