Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[Michael A Grady]

> On Jun 2, 2016, at 10:36 PM, Daniel Fisher <dfisher at vt.edu> wrote:
> 
> On Wed, Jun 1, 2016 at 4:04 PM, IAM David Bantz <dabantz at alaska.edu <mailto:dabantz at alaska.edu>> wrote:
>  - I understand there's delay entailed between in waiting for a failed attempt to authN at one directory before attempting another, but that seems to be << 1 sec; is there some further cascading effect or different sort of performance hit to be concerned about?
> 
> I don't think so. Opening new connections is the most expensive activity. Assuming your directory is properly indexed, pooling connections is where you're going to get the most benefit.
> 
> - I've configured several steps of fail-over (in the v2 attribute-resolver data connectors as well as login.config for authN). Are you saying that with similar levels of redundancy using v3 aggregate resolver I may be establishing concurrent connections with 3 - 5 LDAP directories? Wouldn't THAT entail a performance hit of some sort?
> 
> Only on IDP startup. Assuming your pools are tuned to keep connections alive, the work required to keep pools healthy is minimal compared to opening and closing connections.
> 
> --Daniel Fisher
> 

If one does aggregate DN resolvers/authn handlers, what happens if the user is found in both, but authentication succeeds in one and fails in the other?

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160621/a80cc30a/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160621/a80cc30a/attachment.sig>