<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)">Hello,<br><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)">We use Shib Idp 2.3, KERBEROS login handler for auth with AD, LDAPDirectory to look up attributes from AD. <br>
<br>For last few days we have been experiencing very slow response from AD during auth & attribute lookup. Few days back it was <1 sec.<br></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)">
e.g. <br><ul><li>it takes 10+ sec for auth</li></ul><div style="margin-left:80px"><font size="1"><i>07:51:19.278 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor:88] - Validating GSS token. Realm: <domain><br>
07:51:28.421 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor:146] - GSS context created.</i></font><br></div></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)"><ul><li>30+ sec for attribute lookup (usually not this bad but following was 1st login after server restart)</li>
</ul><div style="margin-left:80px"><i><font size="1">07:51:28.559 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the following parameters:<br>07:51:28.559 - DEBUG [edu.vt.middleware.ldap.Ldap:194] - dn = DC=<host>,DC=com<br>
07:51:28.559 - DEBUG [edu.vt.middleware.ldap.Ldap:195] - filter = (&(objectCategory=person)(objectClass=user)(|(userPrincipalName=<myusername>@<host>.COM)(sAMAccountName=<myusername>@<host>.COM)))<br>
07:51:28.560 - DEBUG [edu.vt.middleware.ldap.Ldap:196] - filterArgs = []<br>07:51:28.560 - DEBUG [edu.vt.middleware.ldap.Ldap:197] - searchControls = javax.naming.directory.SearchControls@e3d4817<br>07:51:28.560 - DEBUG [edu.vt.middleware.ldap.Ldap:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@5947e54e, edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler@7f1f91ac, edu.vt.middleware.ldap.handler.BinarySearchResultHandler@7194f467]<br>
07:52:05.674 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:414] - LDAP data connector GlobalLDAP - Found the following attribute: userPrincipalName[<myusername>@<host>.com]</font><br>
</i></div><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)">Tomorrow, we will be meeting with AD team to investigate this & know if anything, changed in AD in last few days.<br>
<br></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)"><b>Has anyone faced this issue before ? Can we give specific pointers to AD team so that they can debug in right direction ? Thanks for your help.</b><br>
<br></div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)">(<i>p.s. Currently we have not added derefAliases=never in attribute resolver, login config but we plan to add it in next release. But, I am not sure if it will make much difference because we had descent performance from few days back.</i>)<br>
</div><div class="gmail_default" style="font-family:verdana,sans-serif;color:rgb(0,0,102)"><br></div>-- <br><span style="color:rgb(0,0,102);font-family:trebuchet ms,sans-serif">Regards,</span><br style="color:rgb(0,0,102);font-family:trebuchet ms,sans-serif">
<span style="color:rgb(51,0,153);font-family:trebuchet ms,sans-serif"><span style="color:rgb(0,0,102)"> Vish</span><br style="color:rgb(0,0,102)"><br></span>
</div>