Intermittent Attribute Resolution failure in Shib 3.3.0 against AD/LDAPS

Jeffrey Williams jfwillia at uncg.edu
Wed Mar 8 16:06:57 EST 2017 

Hi All, Long-time Lurker, First-Time Poster:

I'm in the process of moving UNCG from Shib v2 to v3 and we're encountering
an intermittent issue in our development tier when attempting to resolve
attributes from our LDAP environment after a successful MFA login.  As of
yet, I cannot replicate it in validation with the same settings against our
production LDAP.  From what I can tell so far, I don't believe it to be a
Shibboleth issue, but wanted to post here first to make sure I wasn't
missing something before jumping down another rabbit hole.

When it happens, a 'Profile Action ResolveAttributes: Error resolving
attributes' error is logged in Shibboleth.

My questions so far:
-Does this look to be an issue with the way Shibboleth is configured?
-Has anyone else ran into intermittent attribute resolution such as this?
-Are there better logs/log levels to look at for this sort of issue?
-Any other info I can provide to paint a clearer picture of what's going on?

Here is our DataConnector info(some info redacted).

<resolver:DataConnector id="devAD" xsi:type="resolver:LDAPDirectory"
    ldapURL="ldaps://redactedLDAPDevServer.uncg.edu:636
<http://redactedldapdevserver.uncg.edu:636/>"
    baseDN="ou=accounts,o=uncg"
    principal="cn=redactedbindingCred,ou=accounts,o=uncg"
    principalCredential="RedactedBindingCredential"
    useStartTLS="false"
    noResultIsError="false"
    multipleResultsIsError="true"
    searchScope="ONELEVEL">
    <resolver:FilterTemplate>
        <![CDATA[
            (uid=$resolutionContext.principal)
        ]]>
    </resolver:FilterTemplate>
    <!-- JFW: Not 100% that this is required or desired. It's preferred to
dump all attributes back to shibboleth.
    <resolver:ReturnAttributes>%{idp.attribute.resolver.LDAP.
returnAttributes}</resolver:ReturnAttributes>
        -->
      <resolver:LDAPProperty name="java.naming.referral" value="follow" />
      <resolver:LDAPProperty name="java.naming.ldap.attributes.binary"
value="sourceObjectGuid"/>
</resolver:DataConnector>

also from ldap.properties:
idp.authn.LDAP.authenticator                   = directAuthenticator
idp.authn.LDAP.useSSL                          = true

We specifically use SSL and not startTLS in our connect.  However useSSL is
expressly not allowed as an attribute.  If there is a better way for us to
specify an SSL connection to our ldap server, let me know.

I've turned up logging on org.ldaptive to DEBUG and receive the following
eye-chart upon erring out:

2017-03-08 13:37:18,355 - DEBUG [org.ldaptive.BindOperation:138] - execute
request=[org.ldaptive.BindRequest at 14779970::bindDn=
cn=bindingcred,ou=accounts,o=uncg, saslConfig=null, controls=null] with
connection=[org.ldaptive.DefaultConnectionFactory$
DefaultConnection at 853915943::config=[org.ldaptive.ConnectionConfig at 842588842
::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 253115005::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at 4917fc1e]
2017-03-08 13:37:18,378 - DEBUG [org.ldaptive.BindOperation:168] - execute
response=[org.ldaptive.Response at 2012017299 <(201)%20201-7299>::result=null,
resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null,
referralURLs=null, messageId=-1] for request=[org.ldaptive.
BindRequest at 14779970::bindDn=cn=bindingcred,ou=accounts,o=uncg,
saslConfig=null, controls=null] with connection=[org.ldaptive.
DefaultConnectionFactory$DefaultConnection at 853915943::config=[org.ldaptive.
ConnectionConfig at 842588842::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 253115005::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at 4917fc1e]
2017-03-08 13:37:18,379 - DEBUG [org.ldaptive.SearchOperation:138] -
execute request=[org.ldaptive.SearchRequest at 2132798348
<(213)%20279-8348>::baseDn=ou=accounts,o=uncg,
searchFilter=[org.ldaptive.SearchFilter at -2119651592::filter=(uid=UNCG_Username),
parameters={}], returnAttributes=[], searchScope=ONELEVEL, timeLimit=3000,
sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null,
sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.
DnAttributeEntryHandler at -1580910376::dnAttributeName=entryDN,
addIfExists=false]], searchReferenceHandlers=null, controls=null,
followReferrals=false, intermediateResponseHandlers=null] with
connection=[org.ldaptive.DefaultConnectionFactory$
DefaultConnection at 853915943::config=[org.ldaptive.ConnectionConfig at 842588842
::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 253115005::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at 4917fc1e]
2017-03-08 13:37:21,405 - DEBUG
[org.ldaptive.provider.jndi.NamingExceptionUtils:358]
- naming exception class javax.naming.NamingException is ambiguous, maps to
multiple result codes: [OPERATIONS_ERROR, ALIAS_PROBLEM,
ALIAS_DEREFERENCING_PROBLEM, LOOP_DETECT, AFFECTS_MULTIPLE_DSAS, OTHER]
2017-03-08 13:37:21,429 - ERROR
[net.shibboleth.idp.profile.impl.ResolveAttributes:299]
- Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector
'devAD': Unable to execute LDAP search
        at net.shibboleth.idp.attribute.resolver.dc.ldap.impl.
LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:170)
Caused by: org.ldaptive.LdapException: javax.naming.NamingException: LDAP
response read timed out, timeout used:3000ms.; remaining name
'ou=accounts,o=uncg'
        at org.ldaptive.provider.ProviderUtils.throwOperationException(
ProviderUtils.java:77)
Caused by: javax.naming.NamingException: LDAP response read timed out,
timeout used:3000ms.
        at com.sun.jndi.ldap.Connection.readReply(Connection.java:490)

***********
For comparison, a successful resolution:

2017-03-08 15:26:39,791 - DEBUG [org.ldaptive.BindOperation:138] - execute
request=[org.ldaptive.BindRequest at 536187249::bindDn=
cn=bindingcred,ou=accounts,o=uncg, saslConfig=null, controls=null] with
connection=[org.ldaptive.DefaultConnectionFactory$
DefaultConnection at 608981075::config=[org.ldaptive.ConnectionConfig at 842588842
::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 1343346746::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at cf1cab5]
2017-03-08 15:26:39,927 - DEBUG [org.ldaptive.BindOperation:168] - execute
response=[org.ldaptive.Response at 1060940867::result=null,
resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null,
referralURLs=null, messageId=-1] for request=[org.ldaptive.
BindRequest at 536187249::bindDn=cn=bindingcred,ou=accounts,o=uncg,
saslConfig=null, controls=null] with connection=[org.ldaptive.
DefaultConnectionFactory$DefaultConnection at 608981075::config=[org.ldaptive.
ConnectionConfig at 842588842::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 1343346746::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at cf1cab5]
2017-03-08 15:26:39,928 - DEBUG [org.ldaptive.SearchOperation:138] -
execute request=[org.ldaptive.SearchRequest at 2014233177
<(201)%20423-3177>::baseDn=ou=accounts,o=uncg,
searchFilter=[org.ldaptive.SearchFilter at 37997637::filter=(uid=user),
parameters={}], returnAttributes=[], searchScope=ONELEVEL, timeLimit=3000,
sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null,
sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.
DnAttributeEntryHandler at -1580910376::dnAttributeName=entryDN,
addIfExists=false]], searchReferenceHandlers=null, controls=null,
followReferrals=false, intermediateResponseHandlers=null] with
connection=[org.ldaptive.DefaultConnectionFactory$
DefaultConnection at 608981075::config=[org.ldaptive.ConnectionConfig at 842588842
::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 1343346746::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at cf1cab5]
2017-03-08 15:26:40,461 - DEBUG [org.ldaptive.SearchOperation:168] -
execute response=[org.ldaptive.Response at 658143803::result=[
org.ldaptive.SearchResult at 2011471914::entries=[redacted attributes/values
pair list], resultCode=SUCCESS, message=null, matchedDn=null,
responseControls=null, referralURLs=null, messageId=-1] for
request=[org.ldaptive.SearchRequest at 2014233177
<(201)%20423-3177>::baseDn=ou=accounts,o=uncg,
searchFilter=[org.ldaptive.SearchFilter at 37997637::filter=(uid=user),
parameters={}], returnAttributes=[], searchScope=ONELEVEL, timeLimit=3000,
sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null,
sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.
DnAttributeEntryHandler at -1580910376::dnAttributeName=entryDN,
addIfExists=false]], searchReferenceHandlers=null, controls=null,
followReferrals=false, intermediateResponseHandlers=null] with
connection=[org.ldaptive.DefaultConnectionFactory$
DefaultConnection at 608981075::config=[org.ldaptive.ConnectionConfig at 842588842
::ldapUrl=ldaps://ldapDevServer.uncg.edu:636
<http://ldapdevserver.uncg.edu:636/>, connectTimeout=3000,
responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig at 746436902::
credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 2577a95d,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer@
375951774::bindDn=cn=bindingcred,ou=accounts,o=uncg, bindSaslConfig=null,
bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.
JndiConnectionFactory at 1343346746::metadata=[ldapUrl=ldaps://
ldapDevServer.uncg.edu:636 <http://ldapdevserver.uncg.edu:636/>, count=1],
environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ldap.attributes.binary=sourceObjectGuid,
com.sun.jndi.ldap.read.timeout=3000},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1518011879::
operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
properties={java.naming.referral=follow,
java.naming.ldap.attributes.binary=sourceObjectGuid},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$
ActivePassiveConnectionStrategy at 233db8e9, controlProcessor=org.ldaptive.
provider.ControlProcessor at 56244b7c, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null,
hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
JndiConnection at cf1cab5]
2017-03-08 15:26:40,469 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractDataConnector:139]
- Data Connector 'dataConnector': produced the following 56 attributes
during resolution [redacted attributes list]

***************************


Final note on our environment, if it helps:
Our v3 dev environment consists of 2 RHEL 7.3 VM's running the Unicon
v3.3.0 docker image with university-specific customizations being pulled at
runtime from our Stash server.  A Netscaler VIP sits in front of them in
Active/Passive with SSL offloading (we also have certs in the containers
themselves for individual testing.

-- 
Jeffrey Williams, SQL Server 2012 MCSA, Windows Server 2012 MCSA
Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170308/b2447e11/attachment-0001.html>

More information about the users mailing list