IDP 3 LDAPConnector

[Hong Ye]

Hi Daniel,

Thanks for your reply. Where can I set the connection timeout? I tried to set it in the ldap.properties file and it gave me error.

Hong

On Mar 3, 2016, at 11:27 AM, Daniel Fisher <dfisher at vt.edu<mailto:dfisher at vt.edu>> wrote:

On Thu, Mar 3, 2016 at 10:25 AM, Hong Ye <hy93 at cornell.edu<mailto:hy93 at cornell.edu>> wrote:
Hello,

I have two questions regarding LDAP connector.

1. Our IDP 3 use active_passive connectionStrategy and default value of searchTimeLimit which is 5 seconds. To test the fail over, we shut down the directory service of the first AD on the list, it seem it took more than a minute to finish aacli.sh command. Before the shutdown, it took less than 3 seconds to complete aacli.sh command. After directory service shutdown, it took about 62 seconds to finish the same command. Is there any configuration change I can make so that the failover happen faster?

Active_Passive means the first URL is always attempted first. If you shutdown that first host and you're seeing a long delay, then that's how long it's taking your client to decide the host is actually down. The default value for connection timeout can be quite high and I'd say yours is 60 seconds. Set the connectTimeout property to something more reasonable (3-5 seconds?) and you should get better results.


2.When ROUND_ROBIN connectionStrategy is used, if ldap server being used for the new connection is down, will IDP try the next ldap url on the list?

Every new connection will be attempted in a round robin fashion. Regardless of whether any specific host is down. So yes.

--Daniel Fisher

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160303/c21df10e/attachment.html>