Intermittent Attribute Resolution failure in Shib 3.3.0 against AD/LDAPS

[Greg Haverkamp]

On Wed, Mar 8, 2017 at 1:06 PM, Jeffrey Williams <jfwillia at uncg.edu> wrote:

> My questions so far:
> -Does this look to be an issue with the way Shibboleth is configured?
> -Has anyone else ran into intermittent attribute resolution such as this?
> -Are there better logs/log levels to look at for this sort of issue?
> -Any other info I can provide to paint a clearer picture of what's going
> on?
>

Somewhat akin to a message I sent to another user on the list last night,
I'll note that one key distinction between IdP v2 and v3 is that v3
defaults to using LDAP connection pooling, which means that if you're not
validating connections and your firewalls and/or load balancers are reaping
what look like stale connections, you'll attempt to make requests on stale
connections and timeout.  (I don't have any long-lived connections to our
AD server; I'm not sure if AD also times out connections after a while,
though I'd expect it to close them rather than merely cut them off.)

Of course, it could be something else.  (As I noted last night, when I
first started hunting a similar problem _after_ our v3 upgrade, I initially
blamed what I just described; but ours ended up being database corruption
in the underlying OpenLDAP database.)

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170308/6d48a8d7/attachment.html>