<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Times New Roman","serif";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">Here is an example of my ldap connector with failover that works.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">I have a myLDAP, my2LDAP and my3LDAP, that failover on connection failure or with the noResultIsError flag, if the OU is wrong returning no result. I can then check OUs in other trees.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">Hope this helps.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">~lennyK<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">ldapURL="ldaps://xxx.xxx.xxx.xxx ldaps://xxx.xxx.xxx.xxx"
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">baseDN="ou=Wizard,dc=umassb,dc=net"
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">principal="xxooxxoo@umassb.net"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">principalCredential="wwweeerrr"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">lowercaseAttributeNames="true"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:red">noResultIsError="true"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue">searchScope="SUBTREE"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:red"><resolver:FailoverDataConnector ref="my2LDAP" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><dc:FilterTemplate><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"> <![CDATA[<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"> (mail=$requestContext.principalName)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"></dc:FilterTemplate><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><ReturnAttributes>title samaccountname userprincipalname mail cn givenname sn</ReturnAttributes>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><LDAPProperty name="java.naming.referral" value="follow"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"></resolver:DataConnector><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt;color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Dan McLaughlin<br>
<b>Sent:</b> Friday, October 19, 2012 10:21 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: LDAP failover on error<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I ended up disabling failover at the connection and moved to multiple sufficient ldap handlers in the login.config and dataconnector failover in the attribute-resolver and this works. It would have been nice to have all this handled at
a lower level, but this will work. <br>
<br>
On Friday, October 19, 2012, Daniel Fisher wrote:<o:p></o:p></p>
<p class="MsoNormal">On Thu, Oct 18, 2012 at 7:53 PM, Dan McLaughlin<br>
<<a href="javascript:;">dmclaughlin@tech-consortium.com</a>> wrote:<br>
> We are trying to configure our LDAP Data Connector and Login.config so that<br>
> LDAP connections failover if the LDAP server returns an error OR is down.<br>
> Based on the exception below it would seem that the LDAP code as it stands<br>
> today is not able to failover if LDAP queries return errors, only if the<br>
> connection can't be established. Is this correct?<br>
><br>
<br>
You can configure operation retries based on a specific naming<br>
exception, but I'm not sure if that will provide the behavior you<br>
want:<br>
<br>
edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient<br>
ldapUrl="ldap://server-hq8.mydomain.local:636<br>
ldap://hq8.mydomain.local:636 ldap://server-hq5.mydomain.local:636"<br>
ssl="true"<br>
connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"<br>
operationRetryExceptions="javax.naming.NamingException"<br>
timeout="1000"<br>
baseDn="T=MYTREE"<br>
subtreeSearch="true"<br>
derefAliases="never"<br>
userFilter="(&(cn={0})(objectclass=person))";<br>
<br>
If reopening the connection does not resolve the issue, then we're<br>
probably looking at a custom connection handler to solve this problem.<br>
<br>
--Daniel Fisher<br>
--<br>
To unsubscribe from this list send an email to <a href="javascript:;">users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
<p class="MsoNormal"><br>
<br>
-- <br>
<br>
--<br>
<br>
Thanks,<br>
<br>
Dan McLaughlin<br>
Technology Consortium, LLC<br>
<a href="mailto:dmclaughlin@tech-consortium.com" target="_blank">dmclaughlin@tech-consortium.com</a><br>
mobile: 512.633.8086<br>
<a href="http://www.tech-consortium.com" target="_blank">http://www.tech-consortium.com</a><br>
<br>
NOTICE: This e-mail message and all attachments transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is strictly prohibited. The
contents of this e-mail are confidential and may be subject to work product privileges. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.<br>
<br>
Need to schedule a meeting??? <a href="http://www.tungle.me/DanMcLaughlin" target="_blank">http://www.tungle.me/DanMcLaughlin</a><o:p></o:p></p>
</div>
</body>
</html>