On Mon, Aug 1, 2011 at 10:46 AM, Manuel Haim <span dir="ltr"><<a href="mailto:haim@hrz.uni-marburg.de">haim@hrz.uni-marburg.de</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Chad,<br>
<br>
thank you for your response and helpful recommendations.<br>
<div class="im"><br>
> I *strongly* discourage people from simply creating the DN from given<br>
> input from the user. It's a very brittle setup and I would remove any<br>
> such suggestion added to the wiki. If that extra search, done via<br>
> pooled connections, is such a onerous amount of work then the problem<br>
> is with your LDAP.<br>
<br>
</div>Well, yes. However, it seems that the SearchDnResolver does not make use<br>
of pooled connections yet. In our setup, this not only impaired the<br>
latency, but also resulted in less logins per second (compared to using<br>
a static DN). Is connection pooling planned here for a future release?<br><font class="Apple-style-span" color="#888888"><br></font></blockquote><div><br></div><div>Early versions of the 2.x IDP attempted to use connection pooling for DN resolution, with mixed results due to some bugs. Ultimately we decided it simply violated the stateless nature of JAAS and moved to the current implementation which opens and closes a connection for every DN lookup. Open a feature request for this, it's a good time for me to review this again.</div>
<div><br></div><div>--Daniel Fisher</div><div><br></div></div>