<div dir="ltr">I didn't think Active Directory counted LDAP BIND requests counted against failed logins. I thought it was only Kerberos requests that failed that counted?</div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Jul 23, 2013 at 11:29 AM, Yusuf Tran <span dir="ltr"><<a href="mailto:Yusuf.Tran@kaplan.com" target="_blank">Yusuf.Tran@kaplan.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Hi Guys,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The problem is it appears as though each login request is actually 2 or x, x being the amount of idp nodes.<u></u><u></u></p>
<p class="MsoNormal">In active directory, the lockout threshold is 3, we intentionally want to lock the user out after 3 failed attempts, but they get locked out after 2! We increased the number to 10 to see what’s going on and it locks them out after 5, it
appears as though there’s two requests per login try?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This sounds strange and only affects our live environment as our dev and test IDP’s are not load balanced.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have the resolver in attribute-resolver.xml configured like so:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<u></u><u></u></p>
<p class="MsoNormal"> ldapURL="ldaps://<a href="http://192.168.148.134:636" target="_blank">192.168.148.134:636</a> ldaps://<a href="http://192.168.148.210:636" target="_blank">192.168.148.210:636</a>"<u></u><u></u></p>
<p class="MsoNormal"> baseDN="ou=Students,dc=kicds,dc=com"<u></u><u></u></p>
<p class="MsoNormal"> principal="<a href="mailto:idp.ldap@kicds.com" target="_blank">idp.ldap@kicds.com</a>"<u></u><u></u></p>
<p class="MsoNormal"> principalCredential="areallygoodpassword!!!"<u></u><u></u></p>
<p class="MsoNormal"> connectionStrategy="ROUND_ROBIN"><u></u><u></u></p>
<p class="MsoNormal"> <dc:FilterTemplate><u></u><u></u></p>
<p class="MsoNormal"> <![CDATA[<u></u><u></u></p>
<p class="MsoNormal"> (sAMAccountName=$requestContext.principalName)<u></u><u></u></p>
<p class="MsoNormal"> ]]><u></u><u></u></p>
<p class="MsoNormal"> </dc:FilterTemplate><u></u><u></u></p>
<p class="MsoNormal"> </resolver:DataConnector><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">login.config<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<u></u><u></u></p>
<p class="MsoNormal"> ldapURL="ldaps://<a href="http://192.168.148.134:636" target="_blank">192.168.148.134:636</a> ldaps://<a href="http://192.168.148.210:636" target="_blank">192.168.148.210:636</a>"<u></u><u></u></p>
<p class="MsoNormal"> baseDN="ou=Students,dc=kicds,dc=com"<u></u><u></u></p>
<p class="MsoNormal"> principal="<a href="mailto:idp.ldap@kicds.com" target="_blank">idp.ldap@kicds.com</a>"<u></u><u></u></p>
<p class="MsoNormal"> principalCredential="areallygoodpassword!!!"<u></u><u></u></p>
<p class="MsoNormal"> connectionStrategy="ROUND_ROBIN"><u></u><u></u></p>
<p class="MsoNormal"> <dc:FilterTemplate><u></u><u></u></p>
<p class="MsoNormal"> <![CDATA[<u></u><u></u></p>
<p class="MsoNormal"> (sAMAccountName=$requestContext.principalName)<u></u><u></u></p>
<p class="MsoNormal"> ]]><u></u><u></u></p>
<p class="MsoNormal"> </dc:FilterTemplate><u></u><u></u></p>
<p class="MsoNormal"> </resolver:DataConnector><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I one login session and tailed the logs into a file, see attached, would appreciate the community’s input.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Regards</span><span class="HOEnZb"><font color="#888888"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u><u></u></span></font></span></p>
<span class="HOEnZb"><font color="#888888">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Yusuf<u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></b></p>
</font></span></div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>