<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi Guys,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The problem is it appears as though each login request is actually 2 or x, x being the amount of idp nodes.<o:p></o:p></p>
<p class="MsoNormal">In active directory, the lockout threshold is 3, we intentionally want to lock the user out after 3 failed attempts, but they get locked out after 2! We increased the number to 10 to see what’s going on and it locks them out after 5, it
appears as though there’s two requests per login try?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This sounds strange and only affects our live environment as our dev and test IDP’s are not load balanced.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have the resolver in attribute-resolver.xml configured like so:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal"> ldapURL="ldaps://192.168.148.134:636 ldaps://192.168.148.210:636"<o:p></o:p></p>
<p class="MsoNormal"> baseDN="ou=Students,dc=kicds,dc=com"<o:p></o:p></p>
<p class="MsoNormal"> principal="idp.ldap@kicds.com"<o:p></o:p></p>
<p class="MsoNormal"> principalCredential="areallygoodpassword!!!"<o:p></o:p></p>
<p class="MsoNormal"> connectionStrategy="ROUND_ROBIN"><o:p></o:p></p>
<p class="MsoNormal"> <dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal"> (sAMAccountName=$requestContext.principalName)<o:p></o:p></p>
<p class="MsoNormal"> ]]><o:p></o:p></p>
<p class="MsoNormal"> </dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> </resolver:DataConnector><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">login.config<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal"> ldapURL="ldaps://192.168.148.134:636 ldaps://192.168.148.210:636"<o:p></o:p></p>
<p class="MsoNormal"> baseDN="ou=Students,dc=kicds,dc=com"<o:p></o:p></p>
<p class="MsoNormal"> principal="idp.ldap@kicds.com"<o:p></o:p></p>
<p class="MsoNormal"> principalCredential="areallygoodpassword!!!"<o:p></o:p></p>
<p class="MsoNormal"> connectionStrategy="ROUND_ROBIN"><o:p></o:p></p>
<p class="MsoNormal"> <dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal"> (sAMAccountName=$requestContext.principalName)<o:p></o:p></p>
<p class="MsoNormal"> ]]><o:p></o:p></p>
<p class="MsoNormal"> </dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> </resolver:DataConnector><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I one login session and tailed the logs into a file, see attached, would appreciate the community’s input.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black;mso-fareast-language:EN-GB">Regards</span><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black;mso-fareast-language:EN-GB">Yusuf<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black;mso-fareast-language:EN-GB"><o:p> </o:p></span></b></p>
</div>
</body>
</html>