LDAP timeout errors

[Christopher Bongaarts]

On 2/4/2025 10:43 AM, Lee, Dong via users wrote:
> Hello, we are running shib version 4.2.1 and had the following error 
> last week.    The understanding is exactly what the error message 
> says, the connection to xxxxx-lb timed out after 3000 ms.     We are 
> trying to determine was this shibboleth causing the problem, was this 
> the load balancer, networking in general, something else? How would we 
> determine where the issue was?

Check your LDAP server logs to find out why the search took so long.

Check any load balancing devices between your IdP and the LDAP server(s) 
for signs of instability/failovers/montior failures.

If the problem happens rarely, it's probably not worth digging too 
deeply.  If it's happening often, there may be an issue with specific 
LDAP servers like the issue Matt brought up with SSL certificates.  LDAP 
server logs might help here too.

If your LDAP server just happens to be slow sometimes, you can raise 
that timeout.  The one you're hitting here is searchTimeLimit or 
responseTimeout on the DataConnector (the latter can be set via the 
idp.attribute.resolver.LDAP.responseTimeout property, which defaults to 
the idp.authn.LDAP.responseTimeout  property.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%