Timeout Issues between IDP and OpenLDAP

[Travis Mercier]

Hi All,

I wanted to run this problem we're experiencing with what seems like communication between our idp (idpprodapp1) and OpenLDAP (openldap1) servers. Occasionally, we'll have a user try to login to an idp service (that we are testing right now), and it will appear to hang at the OpenLDAP authentication. Initially this seemed to be during a period of inactivity, but we are unsure if that is still the case. 

We've looked at firewall logs and our idp server does lose connectivity during our daily OpenLDAP refresh (every morning at 6:30am), which would be expected. 

I've enabled the following after seeing a forum post some time ago, however, I don't know if they were what we were looking for:

# LDAP pool configuration, used for both authn and DN resolution
#idp.pool.LDAP.minSize                          = 3
#idp.pool.LDAP.maxSize                          = 10
#idp.pool.LDAP.validateOnCheckout               = false
idp.pool.LDAP.validatePeriodically             = true
idp.pool.LDAP.validatePeriod                   = 300
#idp.pool.LDAP.prunePeriod                      = 300
#idp.pool.LDAP.idleTime                         = 600
#idp.pool.LDAP.blockWaitTime                    = 3000
#idp.pool.LDAP.failFastInitialize               = false

We see the following in a tail of our logs on the idpprodapp1 server. This message is the last message in the file:

2017-02-17 08:49:52,349 - 
DEBUG [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:131] - 
Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to authenticate user [useraccount]

User sees this page after a long timeout:
(trying several time does not help)

"Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at root at localhost to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error log."

Our OpenLDAP version is 2.4.40, and our IDP is running 3.2.1. 

Let me know if you have any suggestions, or another way to troubleshoot this.