<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p style="margin-top: 0px; margin-bottom: 0px;">Vince,<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">I think if I remember correctly it is was firewall and bigip tcp closing idle connections. Java is not informed of the tcp reset which results in users utilizing the effected pooled connections authentication
to fail. I have learned this lesson twice at two different universities. You can detect the resets using tcpdump.<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"> <span style="color: rgb(34, 34, 34); font-family: MuseoSans, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 14px; background-color: rgb(255, 255, 255);">tcpdump
-n -v 'tcp[tcpflags] & (tcp-rst) != 0'</span>​<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">Check the tcp idle parameters in this document might help. <br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><a href="http://markgamache.blogspot.com/2010/12/tuning-f5-big-ip-performance-to-ruin.html" id="LPlnk872595">http://markgamache.blogspot.com/2010/12/tuning-f5-big-ip-performance-to-ruin.html</a><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<div id="Signature"><style type="text/css" style="display:none"> <!-- p {margin-top:0px; margin-bottom:0px} --> </style>
<div id="divtagdefaultwrapper" style="background-color:rgb(255,255,255)">
<div name="divtagdefaultwrapper" style="margin:0px">
<div style="background-color:rgb(255,255,255)">
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Rhian Resnick</span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 16px; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Assistant Director Middleware and HPC</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 16px; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Office of Information Technology​</span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"><br>
</span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">​Florida Atlantic University</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">777 Glades Road, CM22, Rm 218</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Boca Raton, FL 33431</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Phone 561.297.2647</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Fax 561.297.0222</span></p>
<p class="x_MsoNormal" style="color: rgb(33, 33, 33); font-family: 'Times New Roman', serif; font-size: 12pt; margin: 0px 0in; background-color: rgb(255, 255, 255);">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"> </span><span style="color:rgb(31,73,125); font-family:Calibri,sans-serif; font-size:11pt">​<a href="https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg" style="border:0px; font-family:Arial,Helvetica,sans-serif; font-size:13px; line-height:21px; margin:0px; padding:0px; vertical-align:baseline; color:rgb(0,102,204); text-decoration:none; background-color:rgb(239,239,239)" id="LPNoLP"></a></span></p>
</div>
</div>
</div>
</div>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users-bounces@shibboleth.net <users-bounces@shibboleth.net> on behalf of Esquivel, Vince <Esquivelv@uhd.edu><br>
<b>Sent:</b> Tuesday, February 17, 2015 4:36 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: sporadic user authenication issues</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">Thank you Rhian</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">Any chance you can share what you had to adjust?</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">Vince</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Rhian Resnick<br>
<b>Sent:</b> Tuesday, February 17, 2015 3:17 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: sporadic user authenication issues</span></p>
</div>
</div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
We have had similar issues with cas and shibboleth. We needed to adjust the connection pooling in the bigip. </p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Rhian Resnick</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Fau</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:7.0pt; color:#575757">Sent via the Samsung GALAXY SŪ4 Active™, an AT&T 4G LTE smartphone</span></p>
</div>
</div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
-------- Original message --------</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
From: "Esquivel, Vince" </p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Date:02/17/2015 3:30 PM (GMT-05:00) </p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
To: Shib Users </p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Subject: RE: sporadic user authenication issues </p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">The LDAP sources are in an F5 load balancer pool, which we changed our configuration to point at. Is there a setting on the shibboleth config to increase this setting? Could
the load balancer be the issue?</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">Thanks</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">Vince
</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">
<a href="mailto:users-bounces@shibboleth.net" style="color: blue; text-decoration: underline;">
users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net" style="color: blue; text-decoration: underline;">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>IAM David Bantz<br>
<b>Sent:</b> Tuesday, February 17, 2015 1:33 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: sporadic user authenication issues</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
<div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
On Tue, Feb 17, 2015 at 10:09 AM, Esquivel, Vince <<a href="mailto:Esquivelv@uhd.edu" target="_blank" style="color: blue; text-decoration: underline;">Esquivelv@uhd.edu</a>> wrote:</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
LDAP: error code 3 - Timelimit Exceeded</p>
</div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br>
The error in the quoted log messages is explicit:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-top:5.0pt; margin-right:0in; margin-bottom:5.0pt">
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">LDAP: error code 3 - Timelimit Exceeded</span></p>
</blockquote>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">That's AFTER authenticating the user with a bind with the user's submitted credentials,</span></p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">and AFTER the IdP successfully bound to the ldap and searched for user's attributes.</span></p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
After a few seconds, the directory aborted the ldap search for user's attributes with the timeout,</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
which is completely different from the message in previous post indicating incorrect password for the user.</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
</p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>