Odd LDAP error after 4.1.5 upgrade

[Herron, Joel D]

I’m getting an odd LDAP error after a 3.4.8 -> 4.1.5 upgrade. The error only occurs when a user types an incorrect password. All other LDAP related functions are working as I would expect.

INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:202] - Credential Validator ldap: Login by ******** failed
org.ldaptive.LdapException: LDAPException(resultCode=85 (timeout),
errorMessage='A client-side timeout was encountered while waiting 3000ms for a response to simple bind request with message ID 7284 for user ****** from server ********.',
ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb)
    at net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate(LDAPCredentialValidator.java:198)

The other odd thing is it’s not even really timing out as the response is nearly instant.

Our LDAP is backed by a load balanced set of eDirectory servers

Our basic LDAP properties look like this:

idp.authn.LDAP.authenticator                   = bindSearchAuthenticator
idp.authn.LDAP.connectTimeout              = PT3S
idp.authn.LDAP.responseTimeout            = PT3S
idp.authn.LDAP.returnAttributes              = passwordExpirationTime,loginGraceRemaining,loginGraceLimit
idp.pool.LDAP.minSize                                = 3
idp.pool.LDAP.maxSize                               = 15
idp.pool.LDAP.validateOnCheckout         = false
idp.pool.LDAP.validatePeriodically          = true
idp.pool.LDAP.validatePeriod                   = PT5M
idp.pool.LDAP.prunePeriod                       = PT5M
idp.pool.LDAP.idleTime                              = PT10M
idp.pool.LDAP.blockWaitTime                  = PT3S
idp.pool.LDAP.failFastInitialize                 = false


Any thoughts on how to resolve this or where I can dig further in?

Thanks,
--Joel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220307/f04b3c6e/attachment.htm>