IdPv3 - authn ldap - connection strategy?

[John Horne]

On Thu, 2016-03-24 at 13:01 -0400, Daniel Fisher wrote:
> On Thu, Mar 24, 2016 at 10:10 AM, Craig Pluchinsky <craigp at iup.edu>
> wrote:
> > I modified the Authentication handler section in authn/ldap-authn-
> > config.xml to add connectionStrategy for default provider (JNDI). 
> > Note I did remove connection pooling and switched to
> > BindAuthenticationHandler.  This worked but might not the correct
> > way.
> > 
> Removing the pooling means you'll open a new connection for each
> authentication request. Certainly works, just not as performant.
> 
I have managed to keep the pooling and set the strategy. From the
provided 'ldap-authn-config.xml', I just added in Craig's 'jndi' bits.
Restarting shibboleth, and monitoring the outgoing LDAP traffic, seems
to indicate that two connections were created to two different LDAP
servers. Restarting shibboleth again - to clear out the pool - showed
that two connections again were created, but one to yet another (third)
server. So it seems to be working.

Since I'm the only user on this test setup, it's difficult to say how
effective it will be. However, it already seems to be doing what I
would expect. That is, use a pooled connection were it can, but use a
RANDOM strategy to select the LDAP server when it requires a new
connection.

I'll have to leave further testing until after the Easter break I'm
afraid :-)



John.

-- 
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK