v3 LDAP Settings

[Craig Pluchinsky]

Actually looking at trace logging for ldaptive it appears after about 
two minutes the resolver does attempt a fail over to another ldap server. 
Our front end load balancer waits only 30 secs for a reply from the 
container.  So end user impact is service unavailable.  Any way to change 
the timeout for the resolver?

2016-03-23 14:15:45,281 - TRACE 
[org.ldaptive.provider.jndi.JndiConnectionFactory:92] - 
[[ldapUrl=ldap://server1.fqdn:389 ldap://server2.fqdn:389 
ldap://server3.fqdn:389, count=
0]] Attempting connection to ldap://server3.fqdn:389 for strategy 
org.ldaptive.provider.ConnectionStrategies$RandomConnectionStrategy at 473ca08f

2016-03-23 14:17:52,511 - DEBUG 
[org.ldaptive.provider.jndi.JndiConnectionFactory:105] - Error connecting 
to LDAP URL: ldap://server3.fqdn:389
org.ldaptive.provider.ConnectionException: 
javax.naming.CommunicationException: server3.fqdn:389 [Root exception is 
java.net.ConnectException: Connection timed out]
         at 
org.ldaptive.provider.jndi.JndiConnectionFactory.createInternal(JndiConnectionFactory.java:104)
Caused by: javax.naming.CommunicationException: server3.fqdn:389
         at com.sun.jndi.ldap.Connection.<init>(Connection.java:226)
Caused by: java.net.ConnectException: Connection timed out
         at java.net.PlainSocketImpl.socketConnect(Native Method)

2016-03-23 14:17:52,512 - TRACE 
[org.ldaptive.provider.jndi.JndiConnectionFactory:92] - 
[[ldapUrl=ldap://server1.fqdn:389 ldap://server2.fqdn:389 
ldap://server3.fqdn:389, count=0]] Attempting connection to 
ldap://server2.fqdn:389 for strategy 
org.ldaptive.provider.ConnectionStrategies$RandomConnectionStrategy at 473ca08f

-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Wed, 23 Mar 2016, Daniel Fisher wrote:

> On Wed, Mar 23, 2016 at 2:53 PM, Craig Pluchinsky <craigp at iup.edu> wrote:
>       We're using an Active Directory LDAP for password authN and attribute resolution for our v3.2.0 instance.  Modified the minimal
>       ldap.properties.  ldapURL contains multiple ldap url's and authenticator is set to adAuthenticator.  Not using ssl.  LDAP data
>       connector is basic with only change being setting connectionStrategy to RANDOM.
>
>       Last week one of the ldap servers went down and idp authentication stopped working.  It appears the ldaptive pooling didn't
>       fail over to the next ldap server.  To fix I tested removing pooling config, blocked some of the ldap servers via iptables and
>       authN worked/failed over as expected. During this testing there were issues with attribute resolution failing because it
>       couldn't connect to some of the ldap servers.  Tried adding connectTimeout using <LDAPProperty> but that didn't work.  I
>       created a spring resources file for the ldap data connector with the necessary pieces and fail over seemed to work.  Has anyone
>       else ran in to issues with ldap fail over?
> 
> 
> If you post your resolver XML and spring beans config I can tell you what's different about the configs. Off the top of my head, I'm not
> sure why the defaults aren't giving you better failover characteristics.
> 
> --Daniel Fisher
>  
> 
>