LDAP and timeLimit Value

[Peter Schober]

* Ryan Tapp <Ryan.Tapp at csulb.edu> [2018-11-20 19:08]:
> b. when responseTimeout is changed to 30 seconds, I get the LDAP
> server only waiting 4 seconds before sending back searchResDone
> timeLimitExceeded to the IdP.  The IdP doesn't log any error, I just
> get no attributes back.

That doesn't sound right, on multiple levels.
If the server uses a different timeout config than the client
seemingly requested then either the server has its own limit (besides
the self-inflicted limit a client may chose) or (as Scott often says)
your configuration is not what you think it is.

> Example searchRequest from IdP to LDAP:
> 
> searchRequest
>     baseObject: ou=Active,ou=People,dc=example,dc=domain,dc=com
>     scope: wholeSubtree (2)
>     derefAliases: neverDerefAliases (0)
>     sizeLimit: 1
>     timeLimit: 4

A packet trace showing the IDP actually sends a 4 second time limit
would strongly indicate the latter (your 30 seconds don't make it from
the config to the LDAP protocol layer, it seems).

-peter