IDP 3 LDAPConnector

[Daniel Fisher]

On Thu, Mar 3, 2016 at 10:25 AM, Hong Ye <hy93 at cornell.edu> wrote:

> Hello,
>
> I have two questions regarding LDAP connector.
>
> 1. Our IDP 3 use active_passive connectionStrategy and default value of
> searchTimeLimit which is 5 seconds. To test the fail over, we shut down the
> directory service of the first AD on the list, it seem it took more than a
> minute to finish aacli.sh command. Before the shutdown, it took less than
> 3 seconds to complete aacli.sh command. After directory service shutdown,
> it took about 62 seconds to finish the same command. Is there any
> configuration change I can make so that the failover happen faster?
>

Active_Passive means the first URL is always attempted first. If you
shutdown that first host and you're seeing a long delay, then that's how
long it's taking your client to decide the host is actually down. The
default value for connection timeout can be quite high and I'd say yours is
60 seconds. Set the connectTimeout property to something more reasonable
(3-5 seconds?) and you should get better results.


>
> 2.When ROUND_ROBIN connectionStrategy is used, if ldap server being used
> for the new connection is down, will IDP try the next ldap url on the list?
>

Every new connection will be attempted in a round robin fashion. Regardless
of whether any specific host is down. So yes.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160303/5a3ddb30/attachment-0001.html>