Disable LDAP Pooling
Michael A Grady
mgrady at unicon.net
Tue Jan 14 13:53:09 EST 2020
There is pooling for authentication (on by default) and pooling for the resolver (not on by default). I've not tried to "turn it off" for authenticaiton, but ath is where you'd still have pooling (authn/ldap-authn-config.xml)
> On Jan 14, 2020, at 12:49 PM, Crawford, Jeffrey <jcrawford at it.ucla.edu> wrote:
>
> We are seeing the following in our LDAP logs which seems to indicate that it's using a pool (All the same connection). This is just a snippet but note the search base of "" and the objectClass=* searches in between:
>
> Jan 14 09:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2418 SEARCH RESULT tag=101 err=0 qtime=0.000058 etime=0.470019 nentries=1 text=
> Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2419 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
> Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2419 SEARCH RESULT tag=101 err=0 qtime=0.000057 etime=0.015062 nentries=1 text=
> Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2420 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
> Jan 14 09:50:18 iam-ed-t02 slapd[20805]: conn=1551805 op=2420 SEARCH RESULT tag=101 err=0 qtime=0.000072 etime=0.058399 nentries=1 text=
> Jan 14 09:57:41 iam-ed-t02 slapd[20805]: conn=1551805 op=2421 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
> Jan 14 09:57:41 iam-ed-t02 slapd[20805]: conn=1551805 op=2421 SEARCH RESULT tag=101 err=0 qtime=0.000069 etime=0.048988 nentries=1 text=
> Jan 14 09:57:47 iam-ed-t02 slapd[20805]: conn=1551805 op=2422 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
> Jan 14 09:57:47 iam-ed-t02 slapd[20805]: conn=1551805 op=2422 SEARCH RESULT tag=101 err=0 qtime=0.000115 etime=0.386680 nentries=1 text=
> Jan 14 10:07:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2423 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
> Jan 14 10:07:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2423 SRCH attr=1.1
> Jan 14 10:07:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2423 SEARCH RESULT tag=101 err=0 qtime=0.000093 etime=0.470235 nentries=1 text=
> Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2424 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
> Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2424 SEARCH RESULT tag=101 err=0 qtime=0.000067 etime=0.917766 nentries=1 text=
> Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2425 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
> Jan 14 10:35:14 iam-ed-t02 slapd[20805]: conn=1551805 op=2425 SEARCH RESULT tag=101 err=0 qtime=0.000069 etime=0.959024 nentries=1 text=
> Jan 14 10:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2426 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
> Jan 14 10:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2426 SRCH attr=1.1
> Jan 14 10:37:40 iam-ed-t02 slapd[20805]: conn=1551805 op=2426 SEARCH RESULT tag=101 err=0 qtime=0.000043 etime=0.469710 nentries=1 text=
> Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2427 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opussa1)"
> Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2427 SEARCH RESULT tag=101 err=0 qtime=0.000052 etime=0.801628 nentries=1 text=
> Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2428 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opussa1)"
> Jan 14 10:38:46 iam-ed-t02 slapd[20805]: conn=1551805 op=2428 SEARCH RESULT tag=101 err=0 qtime=0.000090 etime=0.919629 nentries=1 text=
> Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2429 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
> Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2429 SEARCH RESULT tag=101 err=0 qtime=0.000427 etime=0.872264 nentries=1 text=
> Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2430 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=opusadmin)"
> Jan 14 10:43:19 iam-ed-t02 slapd[20805]: conn=1551805 op=2430 SEARCH RESULT tag=101 err=0 qtime=0.000041 etime=0.923690 nentries=1 text=
> Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2431 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
> Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2431 SEARCH RESULT tag=101 err=0 qtime=0.000078 etime=0.132187 nentries=1 text=
> Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2432 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
> Jan 14 10:46:03 iam-ed-t02 slapd[20805]: conn=1551805 op=2432 SEARCH RESULT tag=101 err=0 qtime=0.000043 etime=0.194771 nentries=1 text=
> Jan 14 10:46:09 iam-ed-t02 slapd[20805]: conn=1551805 op=2433 SRCH base="ou=people,dc=edtest,dc=ucla,dc=edu" scope=2 deref=0 filter="(uclaLogonID=jeffreycrawford)"
> Jan 14 10:46:09 iam-ed-t02 slapd[20805]: conn=1551805 op=2433 SEARCH RESULT tag=101 err=0 qtime=0.000027 etime=0.435241 nentries=1 text=
>
> On 1/14/20, 10:34 AM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net <mailto:users-bounces at shibboleth.net> on behalf of cantor.2 at osu.edu <mailto:cantor.2 at osu.edu>> wrote:
>
> On 1/14/20, 1:16 PM, "users on behalf of Crawford, Jeffrey" <users-bounces at shibboleth.net on behalf of jcrawford at it.ucla.edu> wrote:
>
>> We tried commenting out the section:
>> But that seems to revert pooling to default values, is there a flag of some sort that disables pooling altogether?
>
> The code is:
>
> final BeanDefinition connectionPool = v2Parser.createConnectionPool(connectionFactory.getBeanDefinition());
> BeanDefinitionBuilder pooledConnectionFactory = null;
> if (connectionPool != null) {
> pooledConnectionFactory = BeanDefinitionBuilder.genericBeanDefinition(PooledConnectionFactory.class);
> pooledConnectionFactory.addConstructorArgValue(connectionPool);
> builder.addPropertyValue("connectionFactory", pooledConnectionFactory.getBeanDefinition());
> } else {
> builder.addPropertyValue("connectionFactory", connectionFactory.getBeanDefinition());
> }
>
> With no element connectionPool is null, and it shouldn't be using a pooled connection factory, so my read is it wouldn't be pooling.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
>
> ----------
>
> This email has been scanned for spam and viruses by Proofpoint Essentials. Visit the following link to report this email as spam:
> https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1579027808-CzI7pduSZIp7&r_address=mgrady%40unicon.net&report= <https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1579027808-CzI7pduSZIp7&r_address=mgrady%40unicon.net&report=>
--
Michael A. Grady
IAM Architect, Unicon, Inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200114/ed40605b/attachment.html>
More information about the users
mailing list