<html><head><style data-externalstyle="true">
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst, p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle, p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
</style><style><!--
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in 0in 0pt;
font-family:"Calibri","sans-serif";
font-size:11pt;
}
a:link, span.MsoHyperlink {
color:blue;
text-decoration:underline;
}
span.MsoHyperlinkFollowed {
color:purple;
text-decoration:underline;
}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText {
margin:0in 0in 0pt;
font-family:"Calibri","sans-serif";
font-size:11pt;
}
span.EmailStyle17 {
color:windowtext;
font-family:"Calibri","sans-serif";
}
span.PlainTextChar {
font-family:"Calibri","sans-serif";
}
.MsoChpDefault {
font-family:"Calibri","sans-serif";
}
div.WordSection1 {
}
--></style></head><body><div data-externalstyle="false" style="font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic','Khmer UI','Nirmala UI',Tunga,'Lao UI',Ebrima,sans-serif;font-size:16px;"><div>are you sure it was your domain controllers that were slow to respond and not a consequence of the load balancer?</div><div><br>randy</div><div data-signatureblock="true"> </div> <div style="border-top-color: rgb(225, 225, 225); border-top-width: 1px; border-top-style: solid;"> <strong>From:</strong> Wessel, Keith<br> <strong>Sent:</strong> June 28, 2013 10:14 AM<br> <strong>To:</strong> users@shibboleth.net<br> <strong>Subject:</strong> LDAP data connector timeouts<br> </div> <div> </div>
<div class=" WordSection1">
<p class=" MsoNormal">We had a situation last week when our Active Directory was hanging on queries resulting in a connection timed out rather than just a connection refused. Attributes were still being returned from our IBM LDAP, but not from AD obviously.
And because the timeout was longer than our 15 second Apache mod_jk timeout, users were getting a gateway timed out message from Apache instead of getting most of their attributes returned to their SP.</p>
<p class=" MsoNormal"> </p>
<p class=" MsoNormal">We’re just using a single hostname for AD since it’s a load balanced hostname. I realize we could add additional names, but it appears the entire AD cluster was responding this way, so that wouldn’t have helped.</p>
<p class=" MsoNormal"> </p>
<p class=" MsoNormal">So, I’m looking at the settings for the LDAP data connector and wondering if the search time limit query option would help in this case. Does that apply to the entire TCP connection, or does that timer just start running after the connection
is established and the query sent?</p>
<p class=" MsoNormal"> </p>
<p class=" MsoNormal">Thanks,</p>
<p class=" MsoNormal">Keith</p>
<p class=" MsoNormal"> </p>
</div>
</div></body></html>