Disable LDAP Pooling

Tue Jan 14 13:49:24 EST 2020

We are seeing the following in our LDAP logs which seems to indicate that it's using a pool (All the same connection). This is just a snippet but note the search base of "" and the objectClass=* searches in between:

Jan 14 09:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2418 SEARCH RESULT tag=101 err=0 qtime=0.000058 etime=0.470019 nentries=1 text=
Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2419 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2419 SEARCH RESULT tag=101 err=0 qtime=0.000057 etime=0.015062 nentries=1 text=
Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2420 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2420 SEARCH RESULT tag=101 err=0 qtime=0.000072 etime=0.058399 nentries=1 text=
Jan 14 09:57:41 iam-ed-t02 slapd[20805]: conn=1551805 op=2421 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
Jan 14 09:57:41 iam-ed-t02 slapd[20805]: conn=1551805 op=2421 SEARCH RESULT tag=101 err=0 qtime=0.000069 etime=0.048988 nentries=1 text=
Jan 14 09:57:47 iam-ed-t02 slapd[20805]: conn=1551805 op=2422 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
Jan 14 09:57:47 iam-ed-t02 slapd[20805]: conn=1551805 op=2422 SEARCH RESULT tag=101 err=0 qtime=0.000115 etime=0.386680 nentries=1 text=
Jan 14 10:07:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2423 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Jan 14 10:07:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2423 SRCH attr=1.1
Jan 14 10:07:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2423 SEARCH RESULT tag=101 err=0 qtime=0.000093 etime=0.470235 nentries=1 text=
Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2424 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2424 SEARCH RESULT tag=101 err=0 qtime=0.000067 etime=0.917766 nentries=1 text=
Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2425 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2425 SEARCH RESULT tag=101 err=0 qtime=0.000069 etime=0.959024 nentries=1 text=
Jan 14 10:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2426 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Jan 14 10:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2426 SRCH attr=1.1
Jan 14 10:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2426 SEARCH RESULT tag=101 err=0 qtime=0.000043 etime=0.469710 nentries=1 text=
Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2427 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opussa1)"
Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2427 SEARCH RESULT tag=101 err=0 qtime=0.000052 etime=0.801628 nentries=1 text=
Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2428 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opussa1)"
Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2428 SEARCH RESULT tag=101 err=0 qtime=0.000090 etime=0.919629 nentries=1 text=
Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2429 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2429 SEARCH RESULT tag=101 err=0 qtime=0.000427 etime=0.872264 nentries=1 text=
Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2430 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2430 SEARCH RESULT tag=101 err=0 qtime=0.000041 etime=0.923690 nentries=1 text=
Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2431 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2431 SEARCH RESULT tag=101 err=0 qtime=0.000078 etime=0.132187 nentries=1 text=
Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2432 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2432 SEARCH RESULT tag=101 err=0 qtime=0.000043 etime=0.194771 nentries=1 text=
Jan 14 10:46:09 iam-ed-t02 slapd[20805]: conn=1551805 op=2433 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
Jan 14 10:46:09 iam-ed-t02 slapd[20805]: conn=1551805 op=2433 SEARCH RESULT tag=101 err=0 qtime=0.000027 etime=0.435241 nentries=1 text=

On 1/14/20, 10:34 AM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    On 1/14/20, 1:16 PM, "users on behalf of Crawford, Jeffrey" <users-bounces at shibboleth.net on behalf of jcrawford at it.ucla.edu> wrote:

    > We tried commenting out the section:
    > But that seems to revert pooling to default values, is there a flag of some sort that disables pooling altogether?

    The code is:

            final BeanDefinition connectionPool = v2Parser.createConnectionPool(connectionFactory.getBeanDefinition());
            BeanDefinitionBuilder pooledConnectionFactory = null;
            if (connectionPool != null) {
                pooledConnectionFactory = BeanDefinitionBuilder.genericBeanDefinition(PooledConnectionFactory.class);
                pooledConnectionFactory.addConstructorArgValue(connectionPool);
                builder.addPropertyValue("connectionFactory", pooledConnectionFactory.getBeanDefinition());
            } else {
                builder.addPropertyValue("connectionFactory", connectionFactory.getBeanDefinition());
            }

    With no element connectionPool is null, and it shouldn't be using a pooled connection factory, so my read is it wouldn't be pooling.

    -- Scott

    -- 
    For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net