On Tue, Sep 20, 2011 at 12:34 PM, Mark Cairney <span dir="ltr"><<a href="mailto:Mark.Cairney@ed.ac.uk">Mark.Cairney@ed.ac.uk</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi Daniel,<br>
<div class="im"><br>
><br>
> Looks like a TimeLimitExceededException was thrown? Does your idp log<br>
> confirm that?<br>
><br>
> --Daniel Fisher<br>
><br>
<br>
</div>That's what we were seeing on Shib 2.1.5. Looking more closely at the<br>
LDAP query it appeared to be attempting alias dereferencing which was<br>
slowing down the search considerably. We've worked around it by upping<br>
the connection timeout and reducing the scope to ONELEVEL.<br>
<br>
I suppose there's now 2 questions outstanding:<br>
<br>
1. Is there any way to control this behaviour on the Shib side?<br></blockquote><div><br></div><div>Yes, try adding the property <span class="Apple-style-span" style="font-family: monospace; background-color: rgb(255, 255, 255); font-size: medium; ">java.naming.ldap.derefAliases=never</span></div>
<div><span class="Apple-style-span" style="background-color: rgb(255, 255, 255); "><font class="Apple-style-span" face="monospace" size="3"><a href="http://download.oracle.com/javase/jndi/tutorial/ldap/misc/aliases.html">http://download.oracle.com/javase/jndi/tutorial/ldap/misc/aliases.html</a></font></span></div>
<div><br></div><div>Pay attention to your search results, you may end up getting back multiple entries in some cases.</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
2. On the LDAP side, why are these searches taking so long (7 seconds in<br>
one case)?<br>
<div><div></div><div class="h5"><br></div></div></blockquote><div><br></div><div>That's a tough question.</div><div>Try raising the debug log level in OpenLDAP and see what that tells you.</div><div>Also see <a href="http://www.openldap.org/doc/admin24/tuning.html">http://www.openldap.org/doc/admin24/tuning.html</a></div>
<div><br></div><div>--Daniel Fisher</div><div><br></div></div>