LDAP connection error causes resolver to fail

[Terry Fleury]

I'm using Shibboleth IdP v.3.3.1.

Authentication via JAAS (callout to PAM module).
Attribute resolution via LDAP.

Recently, I've had issues where the LDAP server goes offline, which
results in no attributes being released to SPs. However, since the JAAS
authentication succeeded, the SP DOES receive a Shibboleth session with
AuthnContextClassRef (e.g., PasswordProtectedTransport).

I'd like one of the following to happen when LDAP is down:

(1) The Shibboleth login fails, i.e., return to SP with an error.
(2) Set ePPN using the JAAS authentication Principal and idp.scope.

I'm not sure (1) is possible.

I thought (2) would be easy, but I'm finding this isn't the case.

Consider the following attribute-resolution.xml file excerpt:

    <AttributeDefinition xsi:type="PrincipalName" id="jaasuid" />

    <AttributeDefinition id="eduPersonPrincipalName"
        xsi:type="Scoped" scope="%{idp.scope}"
        sourceAttributeID="jaasuid">
        <Dependency ref="jaasuid" />
        <DisplayName xml:lang="en">ePPN</DisplayName>
        <AttributeEncoder xsi:type="SAML1ScopedString"
            name="urn:mace:dir:attribute-def:eduPersonPrincipalName"
            encodeType="false" />
        <AttributeEncoder xsi:type="SAML2ScopedString"
            name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
            friendlyName="eduPersonPrincipalName" encodeType="false" />
    </AttributeDefinition>

    <AttributeDefinition id="uid" xsi:type="Simple"
        sourceAttributeID="uid">
        <Dependency ref="myLDAP" />
        <DisplayName xml:lang="en">Local user ID</DisplayName>
        <AttributeEncoder xsi:type="SAML1String"
            name="urn:mace:dir:attribute-def:uid" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
            name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"
            encodeType="false" />
    </AttributeDefinition>

    <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        noResultIsError="false"
        useStartTLS="true">
        <FilterTemplate>
            <![CDATA[
                (uid=$resolutionContext.principal)
            ]]>
        </FilterTemplate>
        <ReturnAttributes>uid</ReturnAttributes>
    </DataConnector>

(Note that I've snipped a lot of other attributes from this example.)

When the LDAP server is working, ePPN is set from the JAAS
authentication principal just fine. But when LDAP is down (which I
achieve by pointing the LDAP hostname to a non-responsive IP address in
/etc/hosts), ePPN is empty. I get the following error message in
idp-warn.log:

2017-06-08 13:27:54,609 - ERROR
[net.shibboleth.idp.profile.impl.ResolveAttributes:299] - Profile Action
ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Data
Connector 'myLDAP': Unable to execute LDAP search
        at
net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:170)
Caused by: org.ldaptive.provider.ConnectionException:
javax.naming.CommunicationException: ldap.example.org:636 [Root
exception is java.net.NoRouteToHostException: No route to host (Host
unreachable)]
        at
org.ldaptive.provider.jndi.JndiConnectionFactory.createInternal(JndiConnectionFactory.java:102)
Caused by: javax.naming.CommunicationException: ldap.ncsa.illinois.edu:636
        at com.sun.jndi.ldap.Connection.<init>(Connection.java:216)
Caused by: java.net.NoRouteToHostException: No route to host (Host
unreachable)
        at java.net.PlainSocketImpl.socketConnect(Native Method)


It looks to me like an LDAP connection failure kills all attribute
resolution. Is this expected? If so, is there any way to configure the
IdP to do (1) above (i.e., return error to SP upon LDAP connection error)?

Thank you for your help.

-- 
Terry Fleury
tfleury at illinois.edu