<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 3/27/2014 1:25 PM, Joseph Lucia
wrote:<br>
</div>
<blockquote cite="mid:CF59E378.BFF9%25jlucia@cysd.k12.pa.us"
type="cite">
<pre wrap="">I built a new IDP from scratch, CentOS6.5/Apache Tomcat/Shib IDP 2.4.0 and
I get stuck for 5 seconds in the same spot. What is interesting is the
first time you log in after a reboot there is no delay. If you log out,
close the browser and wait about 2 minutes, then log in again, it has the
login delay.</pre>
</blockquote>
<br>
Have your tried getting a TRACE log rather then DEBUG log?<br>
<br>
<a href="http://marc.info/?t=134389983500001&r=1&w=2">The
message tread: Re: Extremely slow IdP login</a> <br>
<br>
<a class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/users/2012-August/005180.html">http://shibboleth.net/pipermail/users/2012-August/005180.html</a><br>
<br>
has a number of other suggestions.<br>
<br>
<br>
<a class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/users/2012-August/005193.html">http://shibboleth.net/pipermail/users/2012-August/005193.html</a><br>
<br>
Has a solution.<br>
<br>
<br>
Is your AD domain part of a forest? Is it the top domain?<br>
<br>
In your Wireshark trace, were you tracing everything, or just LDAP?<br>
<br>
<br>
<br>
<blockquote cite="mid:CF59E378.BFF9%25jlucia@cysd.k12.pa.us"
type="cite">
<pre wrap="">
13:58:27.103 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set
hostname verifier for ldaps
13:58:32.118 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75]
- invoking checkServerTrusted for
sun.security.ssl.X509TrustManagerImpl@3dbb2cc9
I added the global catalog port and changed the DN login to be
<a class="moz-txt-link-abbreviated" href="mailto:username@domain.com">username@domain.com</a> and still no luck. I don't have a different Active
Directory to connect to for testing although if it was getting stuck
connecting to the did, I should see that in the packet capture which I am
not.
Joseph Lucia
Information Systems Specialist
Central York School District
717-846-6789 x1211
<a class="moz-txt-link-abbreviated" href="mailto:jlucia@cysd.k12.pa.us">jlucia@cysd.k12.pa.us</a>
On Mar 27, 2014 ~ Mar 27, 2014 ~ 9:39 AM 9:39 AM, "Peter Schober"
<a class="moz-txt-link-rfc2396E" href="mailto:peter.schober@univie.ac.at"><peter.schober@univie.ac.at></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">* Peter Schober <a class="moz-txt-link-rfc2396E" href="mailto:peter.schober@univie.ac.at"><peter.schober@univie.ac.at></a> [2014-03-27 14:38]:
</pre>
<blockquote type="cite">
<pre wrap="">Servers being called dc (domain controller) is this MS-Active
Directory? Isn't there some issue with subtree searches from the
baseDN (and whether or not to connect to the Global Catalog port or
not)?
</pre>
</blockquote>
<pre wrap="">
Lots of stuff to check/try there:
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues">https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues</a>
-peter
--
To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
</pre>
</blockquote>
<pre wrap="">
--
CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="200">--
Douglas E. Engert <a class="moz-txt-link-rfc2396E" href="mailto:DEEngert@gmail.com"><DEEngert@gmail.com></a>
</pre>
</body>
</html>