Intermittent Attribute Resolution failure in Shib 3.3.0 against AD/LDAPS

[Daniel Fisher]

On Wed, Mar 8, 2017 at 4:06 PM, Jeffrey Williams <jfwillia at uncg.edu> wrote:

> Caused by: org.ldaptive.LdapException: javax.naming.NamingException: LDAP
> response read timed out, timeout used:3000ms.; remaining name
> 'ou=accounts,o=uncg'
>         at org.ldaptive.provider.ProviderUtils.throwOperationException(
> ProviderUtils.java:77)
> Caused by: javax.naming.NamingException: LDAP response read timed out,
> timeout used:3000ms.
>         at com.sun.jndi.ldap.Connection.readReply(Connection.java:490)
>
>
Set the following property to increase the response timeout in the resolver:
idp.attribute.resolver.LDAP.responseTimeout=PT5S
The default value is 3 seconds.


> ***********
> For comparison, a successful resolution:
>

Your successful result appears to be searching for a different user. You
may want to compare the response times for various users in your directory.
I'm not sure what would cause such a slow response, but maybe your
directory administrator will have some ideas. 3 seconds should be plenty of
time.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170308/75bc572f/attachment-0001.html>