LDAP connections pooling questions

[Daniel Fisher]

On Thu, Aug 29, 2019 at 9:28 AM Guillaume Rousse <
guillaume.rousse at renater.fr> wrote:

> With Shibboleth IdP 3.4.4, the default LDAP connector configuration
> triggers regular warnings in our logs:
>
> org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 1fe12a85
> failed validation
>

If you turn on DEBUG you should see the cause. Your assumption is likely
correct, network disruption. The warn logs are indicators that you should
tune your pool.


>
> The issue is probably coming either from our LDAP server, either from an
> intermediate network equipment shutting down connections considered as
> idle. Despite what ldaptive documentation says about periodic validation
> mechanism ("This functionality can also serve as a keep-alive for long
> lived connections"), this is obviously not working here, and we have to
> investigate.


You need to tune the validation period. It's likely longer than whatever
idle connection timeout your LDAP administrator has configured. Set your
validation period shorter than that timeout.


> However, when pooling is considered desirable, I guess validation is
> needed to ensure pooled connections are actually usable. There isn't
> much detail about what is going to happen if the IdP tries to use a
> non-functional connection, but I guess it will just block until timeout
> occurs, and then fails.
>

If a broken connection is handed out by the pool, your connection will most
likely wait until the responseTimeout occurs and then the connection will
be reopened. So tune the responseTimeout parameter for your needs.


>
> So, I'd say than anyone wanting to use pooling should either:
> 1) ensure its LDAP server will never close connections, whatever the
> activity of this connection
> 2) ensure its LDAP server will never close *idle* connections, and
> consider connections with regular search operations as *active*
>

These are unreasonable requirements for any server. The LDAP connection
handling should be robust enough to handle dropped connections. AFAIK
that's the case, if you see otherwise please file a bug.



> 3) configure expirationTime duration in accordance with the maximum
> connection duration on LDAP side
>

I'm not sure what you're getting at here, you'll need to elaborate.

4) enable periodic validation to regulary prune unusable connections,
> and face log flooding with invalidation messages
>

Pool validation messages are simply an indicator of the health of your
pool. If your LDAP servers are reliable and you keep your connections
alive, you'll likely never notice these messages. If your LDAP server
undergoes lots of maintenance or your network is generally unreliable you
will see these warnings in your logs. Regardless, these warn messages don't
indicate a broken system, just one that needs tuning or can't be tuned.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190829/1ce7257a/attachment.html>