v3 LDAP Settings

[Daniel Fisher]

On Wed, Mar 23, 2016 at 2:53 PM, Craig Pluchinsky <craigp at iup.edu> wrote:

> We're using an Active Directory LDAP for password authN and attribute
> resolution for our v3.2.0 instance.  Modified the minimal ldap.properties.
> ldapURL contains multiple ldap url's and authenticator is set to
> adAuthenticator.  Not using ssl.  LDAP data connector is basic with only
> change being setting connectionStrategy to RANDOM.
>
> Last week one of the ldap servers went down and idp authentication stopped
> working.  It appears the ldaptive pooling didn't fail over to the next ldap
> server.  To fix I tested removing pooling config, blocked some of the ldap
> servers via iptables and authN worked/failed over as expected. During this
> testing there were issues with attribute resolution failing because it
> couldn't connect to some of the ldap servers.  Tried adding connectTimeout
> using <LDAPProperty> but that didn't work.  I created a spring resources
> file for the ldap data connector with the necessary pieces and fail over
> seemed to work.  Has anyone else ran in to issues with ldap fail over?
>

If you post your resolver XML and spring beans config I can tell you what's
different about the configs. Off the top of my head, I'm not sure why the
defaults aren't giving you better failover characteristics.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160323/46fad3e0/attachment.html>