Handling empty LDAP connection pools on IdP start-up

[Daniel Fisher]

On Thu, Mar 9, 2017 at 11:02 AM, Wessel, Keith <kwessel at illinois.edu> wrote:

> All,
>
> We recently added connection pooling to our LDAP data connectors to speed
> thing sup. I was hoping, based on past experience with database connection
> pooling, to allow the IdP to go about its business if it started up and
> couldn't create any connections in the pool. That is, if the LDAP server
> was unavailable, it would go ahead and start and keep trying to create LDAP
> connections. This shouldn't happen since our LDAP server is clustered, but
> I'm all for making things as fault-proof as possible.
>
> Yesterday morning, our test LDAP cluster was down when our test IdP nodes
> restarted, and they all reported not being able to initialize the LDAP
> connection pool.
>
> I have this in my LDAP data connectors:
>         <ConnectionPool maxPoolSize="20" blockWaitTime="PT5S"
>             expirationTime="PT10M" failFastInitialize="false"
>             validatePeriodically="true" validateTimerPeriod="PT10M"
>             validateDN="%{idp.attribute.resolver.LDAP.bindDN" />
>
> I left out the min pool size with the impression that it defaults to 0. I
> also didn't' see any params discussing an initial pool size, assuming that
> it was the ame as the min pool size.
>

Correct, it defaults to 0.


>
> Am I overlooking something? How do I get the pool to initialize even if it
> can't create connections?
>

 The failFastInitialize attribute is the key piece and you've correctly set
it to false for the behavior you want. The IDP should successfully start
even though the connection pool is empty. Can you share some logs from this
event?

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170309/9bf5d381/attachment-0001.html>