LDAP connection error causes resolver to fail

[Cantor, Scott]

> I'd like one of the following to happen when LDAP is down:
> 
> (1) The Shibboleth login fails, i.e., return to SP with an error.
> (2) Set ePPN using the JAAS authentication Principal and idp.scope.
> 
> I'm not sure (1) is possible.

The main piece is the property in services.properties that masks resolver failure. I won't argue whether the default is good or bad, but it's there to be changed if you prefer. As for whether returning an error to the SP makes sense, well, I doubt it. But YMMV. Anyway, you can do it.

> It looks to me like an LDAP connection failure kills all attribute
> resolution. Is this expected? If so, is there any way to configure the
> IdP to do (1) above (i.e., return error to SP upon LDAP connection error)?

I'm not sure I understand what you want then. The individual data connector(s) are all configurable by you to handle errors in various ways, and you can backstop them with static connectors for failover that will basically guarantee the connector logically succeeds no matter what, but having done that, the IdP thinks attribute resolution succeeded, which means you aren't getting any error to the SP, you get either partial or no data.

If you want *failure*, then you want the LDAP connector to do what it's doing, but you also need to tell the IdP to not mask that resolver error in the SSO flow's step and have that cause a fatal error, which you can then handle either locally or via SAML response.

I'm not sure which you want.

If you want data to be resolved even if LDAP is down, then the issue is in the resolver, making sure you have failure settings configured right, and possibly providing a failover connector. If you want an error, then the mask property in the services.properties file will help with that.

By default, it does "mask" things but also tends to treat any connector error as fatal, so the end result is you show up at the SP with nothing.

-- Scott