<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 2, 2016, at 10:36 PM, Daniel Fisher <<a href="mailto:dfisher@vt.edu" class="">dfisher@vt.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote">On Wed, Jun 1, 2016 at 4:04 PM, IAM David Bantz <span dir="ltr" class=""><<a href="mailto:dabantz@alaska.edu" target="_blank" class="">dabantz@alaska.edu</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div class=""><div class=""> - I understand there's delay entailed between in waiting for a failed attempt to authN at one directory before attempting another, but that seems to be << 1 sec; is there some further cascading effect or different sort of performance hit to be concerned about?</div></div></div></blockquote><div class=""><br class=""></div><div class="">I don't think so. Opening new connections is the most expensive activity. Assuming your directory is properly indexed, pooling connections is where you're going to get the most benefit.</div><div class=""> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div class=""><div class="">- I've configured several steps of fail-over (in the v2 attribute-resolver data connectors as well as login.config for authN). Are you saying that with similar levels of redundancy using v3 aggregate resolver I may be establishing concurrent connections with 3 - 5 LDAP directories? Wouldn't THAT entail a performance hit of some sort?</div></div></div></blockquote><div class=""><br class=""></div><div class="">Only on IDP startup. Assuming your pools are tuned to keep connections alive, the work required to keep pools healthy is minimal compared to opening and closing connections.</div><div class=""><br class=""></div><div class="">--Daniel Fisher</div><div class=""><br class=""></div></div></div></div></div></blockquote><br class=""></div><div>If one does aggregate DN resolvers/authn handlers, what happens if the user is found in both, but authentication succeeds in one and fails in the other? </div><div apple-content-edited="true" class=""><br class="">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.
</div>
<br class=""></body></html>