LDAP connections pooling questions

[Guillaume Rousse]

Hello list.

With Shibboleth IdP 3.4.4, the default LDAP connector configuration 
triggers regular warnings in our logs:
org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 1fe12a85 
failed validation

The issue is probably coming either from our LDAP server, either from an 
intermediate network equipment shutting down connections considered as 
idle. Despite what ldaptive documentation says about periodic validation 
mechanism ("This functionality can also serve as a keep-alive for long 
lived connections"), this is obviously not working here, and we have to 
investigate. However, before we change our infrastructure just to match 
default IdP expectations, we are trying to figure out actual pros and 
cons of pooling connections.

While pooling LDAP connections is probably a good strategy for heavily 
used IdP servers, I don't think it has much interest for test IdPs, only 
used periodically by a limited number of peoples. In that case, it seems 
more adequate to disable pooling, rather to ensure it is working 
correctly, by removing the <ConnectionPool> element in IdP 
configuration. In that case, the IdP will lazily open LDAP connections 
when required, and close them immediatly thereafter. No problem should 
arise here.

However, when pooling is considered desirable, I guess validation is 
needed to ensure pooled connections are actually usable. There isn't 
much detail about what is going to happen if the IdP tries to use a 
non-functional connection, but I guess it will just block until timeout 
occurs, and then fails.

So, I'd say than anyone wanting to use pooling should either:
1) ensure its LDAP server will never close connections, whatever the 
activity of this connection
2) ensure its LDAP server will never close *idle* connections, and 
consider connections with regular search operations as *active*
3) configure expirationTime duration in accordance with the maximum 
connection duration on LDAP side
4) enable periodic validation to regulary prune unusable connections, 
and face log flooding with invalidation messages

Is that a correct summary ?

Regards
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20190829/21175aee/attachment.p7s>