Timeout Issues between IDP and OpenLDAP

[Greg Haverkamp]

On Tue, Mar 7, 2017 at 4:38 PM, Travis Mercier <tmercier at csusm.edu> wrote:

> 2017-02-17 08:49:52,349 -
> DEBUG [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:131]
> -
> Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to
> authenticate user [useraccount]
>
> User sees this page after a long timeout:
> (trying several time does not help)
>
> "Internal Server Error
>
> The server encountered an internal error or misconfiguration and was
> unable to complete your request.
>
> Please contact the server administrator at root at localhost to inform them
> of the time this error occurred, and the actions you performed just before
> this error.
>
> More information about this error may be available in the server error
> log."
>
> Our OpenLDAP version is 2.4.40, and our IDP is running 3.2.1.
>
> Let me know if you have any suggestions, or another way to troubleshoot
> this.
>

>From the above, I gather you're fronting the IdP with an Apache web
server?  The first thing I'd do to troubleshoot is to increase the proxy
request timeout so that you can see what is presented to the user.  If
there are no further logs in the process log after the debug line you
showed, then I assume the IdP is aborting on a lost connection.  (To be
honest, I'm not sure if it does that or not.)  Well, the first thing I
might do is turn the ldaptive logs to DEBUG, too.

What you've left out is what OpenLDAP is saying during this.  Is OpenLDAP
logging dropped connections?  Is it logging anything on the connections
from the IdP?  Does your connection to the LDAP server go through your
firewall?  If so, does it drop what it views as idle connections?

You've got your validatePeriod set to 5 minutes.  Are you willing to wait 5
minutes to find out if a connection is no longer operational?  I'd consider
validateOnCheckout, as well.  At the very least, it should make dying
connections obvious more quickly in the logs.

(After I went through a week or so of trying to recreate weird timeouts and
hunt them down, finally getting to the point of blaming ldaptive and the
connection pooling, etc., I ended up finding that I had a corrupt HDB
database.  We scheduled emergency maintenance, moved to MDB, and that
solved our particular problem.  But, purely guessing based on the limited
info, I'd guess that you have stale connections.)

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170307/5dc9da1f/attachment.html>