v3 LDAP Settings

[Craig Pluchinsky]

Here is the data connector config that didn't fail over as expected

     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
         ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
         baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
         principal="%{idp.attribute.resolver.LDAP.bindDN}"

principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
         useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
         connectionStrategy="RANDOM">
         <dc:FilterTemplate>
             <![CDATA[
                 %{idp.attribute.resolver.LDAP.searchFilter}
             ]]>
         </dc:FilterTemplate>
     </resolver:DataConnector>


Spring config that does work.  I just copied the example at 
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector and 
removed pooling stuff.  connectTimeout is 3000ms.

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:p="http://www.springframework.org/schema/p"
        xmlns:context="http://www.springframework.org/schema/context"
        xsi:schemaLocation="http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                            http://www.springframework.org/schema/context 
http://www.springframework.org/schema/context/spring-context-3.1.xsd">

     <bean class="org.ldaptive.DefaultConnectionFactory">
         <property name="connectionConfig">
             <bean class="org.ldaptive.ConnectionConfig" 
p:ldapUrl="%{idp.attribute.resolver.LDAP.ldapURL}"

p:connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
                 p:useSSL="%{idp.attribute.resolver.LDAP.useSSL}"

p:useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}">
                 <property name="connectionInitializer">
                     <bean class="org.ldaptive.BindConnectionInitializer"
                         p:bindDn="%{idp.attribute.resolver.LDAP.bindDN}"

p:bindCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}" />
                 </property>
             </bean>
         </property>
         <property name="provider">
             <bean class="org.ldaptive.provider.jndi.JndiProvider">
                 <property name="providerConfig">
                     <bean 
class="org.ldaptive.provider.jndi.JndiProviderConfig" 
p:connectionStrategy="RANDOM" />
                 </property>
             </bean>
         </property>
     </bean>

     <bean class="org.ldaptive.SearchExecutor" 
p:baseDn="%{idp.attribute.resolver.LDAP.baseDN}" />

     <bean id="cacheBuilder" class="com.google.common.cache.CacheBuilder" 
factory-method="from">
         <constructor-arg value="expireAfterAccess=10s,maximumSize=25" />
     </bean>

     <bean id="cache" class="com.google.common.cache.Cache" 
factory-bean="cacheBuilder" factory-method="build" />

     <bean 
class="net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder"
         p:templateText="%{idp.attribute.resolver.LDAP.searchFilter}" 
p:velocityEngine-ref="shibboleth.VelocityEngine" p:v2Compatibility="true"
         init-method="initialize" />
</beans>



-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Wed, 23 Mar 2016, Daniel Fisher wrote:

> On Wed, Mar 23, 2016 at 2:53 PM, Craig Pluchinsky <craigp at iup.edu> wrote:
>       We're using an Active Directory LDAP for password authN and attribute resolution for our v3.2.0 instance.  Modified the minimal
>       ldap.properties.  ldapURL contains multiple ldap url's and authenticator is set to adAuthenticator.  Not using ssl.  LDAP data
>       connector is basic with only change being setting connectionStrategy to RANDOM.
>
>       Last week one of the ldap servers went down and idp authentication stopped working.  It appears the ldaptive pooling didn't
>       fail over to the next ldap server.  To fix I tested removing pooling config, blocked some of the ldap servers via iptables and
>       authN worked/failed over as expected. During this testing there were issues with attribute resolution failing because it
>       couldn't connect to some of the ldap servers.  Tried adding connectTimeout using <LDAPProperty> but that didn't work.  I
>       created a spring resources file for the ldap data connector with the necessary pieces and fail over seemed to work.  Has anyone
>       else ran in to issues with ldap fail over?
> 
> 
> If you post your resolver XML and spring beans config I can tell you what's different about the configs. Off the top of my head, I'm not
> sure why the defaults aren't giving you better failover characteristics.
> 
> --Daniel Fisher
>  
> 
>