<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>I changed the timeout with no additional success. My domain also does not have any child domains.</div>
<div><br>
</div>
<div>As a test I changed from SSL true to TLS true, it still hangs after the first quick login. So as an additional test I removed the bind username and password, rebooted, first login failed, but failed quickly the logs show that it needs the bind authentication,
which I knew. So I closed the browser, waited couple of minutes, then tried to login again, this time it got stuck in the same place as normal for the 5 seconds before saying bad username and password.</div>
<div><br>
</div>
<div>
<div>09:20:32.478 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:131] - authtype = simple</div>
<div>09:20:32.478 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:132] - dn = null</div>
<div>09:20:32.479 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:139] - credential = <suppressed></div>
<div><span class="Apple-style-span">09:20:32.479 - TRACE [edu.vt.middleware.ldap.handler.TlsConnectionHandler:143] - env = {java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.provider.url=ldap://</span>dc3.example.com<span class="Apple-style-span">,
java.naming.dns.url=dc3.example.com}</span></div>
<div>09:20:37.740 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:164] - Error occured attempting authentication</div>
</div>
<div><br>
</div>
<div>So when I use SSL, I get stuck at the Hostname verification (per the logs) and with TLS, I get stuck at the [edu.vt.middleware.ldap.handler.TlsConnectionHandler:143].</div>
<div><br>
</div>
<div>I removed all attributes that use LDAP to rule them out, I am simply authenticating my user to Active Directory and my issue must be in login.config, but I have tried many different options, settings per the documentation and it just doesn't seem to get
beyond the 5 second delay after the first login after a reboot.</div>
<div><br>
</div>
<div>I have the logs set to ALL for ldap, but I don't think there are any additional logging parameters I can set to see what is happening during that delay.</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>
<div>
<div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-family: Calibri; font-size: medium; ">
<font class="Apple-style-span" face="Calibri" size="3">Joseph Lucia</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-family: Calibri; font-size: medium; ">
<font class="Apple-style-span" face="Calibri" size="3">Information Systems Specialist</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-family: Calibri; font-size: medium; ">
<font class="Apple-style-span" face="Calibri" size="3">Central York School District</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-family: Calibri; font-size: medium; ">
<font class="Apple-style-span" face="Calibri" size="3">717-846-6789 x1211</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; font-family: Calibri; font-size: medium; ">
<font class="Apple-style-span" face="Calibri" size="3">jlucia@cysd.k12.pa.us</font></div>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Douglas E Engert <<a href="mailto:deengert@gmail.com">deengert@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>March 27, 2014 Mar 27, 2014 ~ 3:25 PM<br>
<span style="font-weight:bold">To: </span>Joseph Lucia <<a href="mailto:jlucia@cysd.k12.pa.us">jlucia@cysd.k12.pa.us</a>><br>
<span style="font-weight:bold">Subject: </span>Re: IDP Login Delay Question<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF"><br>
<div class="moz-cite-prefix">On 3/27/2014 2:08 PM, Joseph Lucia wrote:<br>
</div>
<blockquote cite="mid:CF59EE56.C017%25jlucia@cysd.k12.pa.us" type="cite">
<div>
<div>
<div>I have IDP and LDAP logs set for trace, there are no additional details for that delay outside what I have copied, I was hoping it would shed some light. I tried using those parameters from that previous thread with no luck, but I am also not using aliases
and I think that was their issue, plus I am only 5 seconds compared to their 60 seconds. My wireshark is logging all traffic from the IDP server to the DC. The DC is the top domain.</div>
<div><br>
</div>
</div>
</div>
</blockquote>
<br>
When I was trying to debug ldap to AD, I had set in logging.conf:<br>
<br>
<logger name="edu.vt.middleware.ldap" level="ALL"/><br>
And if I recall, TRACE messages showed up.<br>
<br>
Are there child domains?<br>
You may handling referrals to sub-domains. <br>
<br>
in login.config you may want to add:<br>
<br>
referral="throw"<br>
handlerIgnoreExceptions="javax.naming.LimitExceededException,javax.naming.ReferralException"<br>
<br>
In a data connector in attribute-resolver.xml , you may want add something like this:<br>
<br>
<br>
<!-- With AD DC, we throw referrals, so as not to pick up sub-domains in the forest.<br>
See: <a class="moz-txt-link-freetext" href="http://code.google.com/p/vt-middleware/wiki/vtldapAD">
http://code.google.com/p/vt-middleware/wiki/vtldapAD</a> --><br>
<dc:LDAPProperty name="edu.vt.middleware.ldap.referral" value="throw"/> <br>
<dc:LDAPProperty name="edu.vt.middleware.ldap.handlerIgnoreExceptions" value="javax.naming.LimitExceededException,javax.naming.ReferralException"/><br>
<br>
<br>
<br>
<br>
<blockquote cite="mid:CF59EE56.C017%25jlucia@cysd.k12.pa.us" type="cite">
<div>
<div>
<div></div>
<div>Thanks,</div>
<div><br>
</div>
<div>
<div>
<div>
<div style="margin-top: 0px; margin-right: 0px;
margin-bottom: 0px; margin-left: 0px; font: normal
normal normal 12px/normal Helvetica; font-family:
Calibri; font-size: medium; ">
<font class="Apple-style-span" size="3" face="Calibri">Joseph Lucia</font></div>
<div style="margin-top: 0px; margin-right: 0px;
margin-bottom: 0px; margin-left: 0px; font: normal
normal normal 12px/normal Helvetica; font-family:
Calibri; font-size: medium; ">
<font class="Apple-style-span" size="3" face="Calibri">Information Systems Specialist</font></div>
<div style="margin-top: 0px; margin-right: 0px;
margin-bottom: 0px; margin-left: 0px; font: normal
normal normal 12px/normal Helvetica; font-family:
Calibri; font-size: medium; ">
<font class="Apple-style-span" size="3" face="Calibri">Central York School District</font></div>
<div style="margin-top: 0px; margin-right: 0px;
margin-bottom: 0px; margin-left: 0px; font: normal
normal normal 12px/normal Helvetica; font-family:
Calibri; font-size: medium; ">
<font class="Apple-style-span" size="3" face="Calibri">717-846-6789 x1211</font></div>
<div style="margin-top: 0px; margin-right: 0px;
margin-bottom: 0px; margin-left: 0px; font: normal
normal normal 12px/normal Helvetica; font-family:
Calibri; font-size: medium; ">
<font class="Apple-style-span" size="3" face="Calibri"><a class="moz-txt-link-abbreviated" href="mailto:jlucia@cysd.k12.pa.us">jlucia@cysd.k12.pa.us</a></font></div>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt;
text-align:left; color:black; BORDER-BOTTOM: medium none;
BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT:
0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;
BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Douglas E Engert <<a moz-do-not-send="true" href="mailto:deengert@gmail.com">deengert@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a moz-do-not-send="true" href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>March 27, 2014 Mar 27, 2014 ~ 2:55 PM<br>
<span style="font-weight:bold">To: </span>"<a moz-do-not-send="true" href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a moz-do-not-send="true" href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: IDP Login Delay Question<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF"><br>
<div class="moz-cite-prefix">On 3/27/2014 1:25 PM, Joseph Lucia wrote:<br>
</div>
<blockquote cite="mid:CF59E378.BFF9%25jlucia@cysd.k12.pa.us" type="cite">
<pre wrap="">I built a new IDP from scratch, CentOS6.5/Apache Tomcat/Shib IDP 2.4.0 and
I get stuck for 5 seconds in the same spot. What is interesting is the
first time you log in after a reboot there is no delay. If you log out,
close the browser and wait about 2 minutes, then log in again, it has the
login delay.</pre>
</blockquote>
<br>
Have your tried getting a TRACE log rather then DEBUG log?<br>
<br>
<a moz-do-not-send="true" href="http://marc.info/?t=134389983500001&r=1&w=2">The message tread: Re: Extremely slow IdP login</a><br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/users/2012-August/005180.html">http://shibboleth.net/pipermail/users/2012-August/005180.html</a><br>
<br>
has a number of other suggestions.<br>
<br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/users/2012-August/005193.html">http://shibboleth.net/pipermail/users/2012-August/005193.html</a><br>
<br>
Has a solution.<br>
<br>
<br>
Is your AD domain part of a forest? Is it the top domain?<br>
<br>
In your Wireshark trace, were you tracing everything, or just LDAP?<br>
<br>
<br>
<br>
<blockquote cite="mid:CF59E378.BFF9%25jlucia@cysd.k12.pa.us" type="cite">
<pre wrap="">13:58:27.103 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set
hostname verifier for ldaps
13:58:32.118 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75]
- invoking checkServerTrusted for
sun.security.ssl.X509TrustManagerImpl@3dbb2cc9
I added the global catalog port and changed the DN login to be
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:username@domain.com">username@domain.com</a> and still no luck. I don't have a different Active
Directory to connect to for testing although if it was getting stuck
connecting to the did, I should see that in the packet capture which I am
not.
Joseph Lucia
Information Systems Specialist
Central York School District
717-846-6789 x1211
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:jlucia@cysd.k12.pa.us">jlucia@cysd.k12.pa.us</a>
On Mar 27, 2014 ~ Mar 27, 2014 ~ 9:39 AM 9:39 AM, "Peter Schober"
<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:peter.schober@univie.ac.at"><peter.schober@univie.ac.at></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">* Peter Schober <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:peter.schober@univie.ac.at"><peter.schober@univie.ac.at></a> [2014-03-27 14:38]:
</pre>
<blockquote type="cite">
<pre wrap="">Servers being called dc (domain controller) is this MS-Active
Directory? Isn't there some issue with subtree searches from the
baseDN (and whether or not to connect to the Global Catalog port or
not)?
</pre>
</blockquote>
<pre wrap="">Lots of stuff to check/try there:
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues">https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues</a>
-peter
--
To unsubscribe from this list send an email to
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<pre wrap="">--
CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
--
To unsubscribe from this list send an email to <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="200">--
Douglas E. Engert <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:DEEngert@gmail.com"><DEEngert@gmail.com></a>
</pre>
</div>
</div>
</span><font size="2">-- <br>
CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you
are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
</font><br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="200">--
Douglas E. Engert <a class="moz-txt-link-rfc2396E" href="mailto:DEEngert@gmail.com"><DEEngert@gmail.com></a>
</pre>
</div>
</div>
</span><font size="2">-- <br>
CONFIDENTIALITY NOTICE – This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you
are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
</font>
</body>
</html>