LDAP connections pooling questions

[Etienne Dysli Metref]

On 29/08/2019 15.28, Guillaume Rousse wrote:
> So, I'd say than anyone wanting to use pooling should either:
> 1) ensure its LDAP server will never close connections, whatever the
> activity of this connection
> 2) ensure its LDAP server will never close *idle* connections, and
> consider connections with regular search operations as *active*
> 3) configure expirationTime duration in accordance with the maximum
> connection duration on LDAP side
> 4) enable periodic validation to regulary prune unusable connections,
> and face log flooding with invalidation messages

I would add connection validation on "check out", that is when a
connection is borrowed from the pool (`idp.pool.LDAP.validateOnCheckOut`
property). It has a slight performance cost, but ensures the pool always
hands out working connections.

IMHO, the LDAP server or a firewall in-between are all allowed to close
connections, as long as all parties agree on the connection state (TCP
RSTs are sent properly). The pool should then close and reopen the
connection.

  Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190829/a34ff491/attachment.sig>