<div dir="ltr">Isn't that a pretty intensive sweep of the entire Directory structure for recursive group memberships? <br>"<span style="color:rgb(42,42,42);font-family:"segoe ui","lucida grande",verdana,arial,helvetica,sans-serif">This rule is limited to filters that apply to the DN. This is a special "extended" match operator that walks the chain of ancestry in objects all the way to the root until it finds a match." </span><font color="#2a2a2a" face="segoe ui, lucida grande, verdana, arial, helvetica, sans-serif"><a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475">https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475</a></font><div>How fast would you expect that to be?<div><br></div><div>David Bantz</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 28, 2016 at 4:10 PM, Mr. Christopher Bland <span dir="ltr"><<a href="mailto:chris@fdu.edu" target="_blank">chris@fdu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">



<div style="word-wrap:break-word">
<div><br>
</div>
<div>HI All,</div>
<div><br>
</div>
<div>I am experiencing a weird delay between 3 and 6 seconds when using DataConnector shown below.  My DataConnector is pretty much the same as Shibboleth Wiki "Generate eduPersonAffiliation based on recursive group membership in Active Directory”
 example on <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples#ResolverScriptAttributeDefinitionExamples-GenerateeduPersonAffiliationbasedonrecursivegroupmembershipinActiveDirectory" target="_blank">Generate eduPersonAffiliation
 based on recursive group membership in Active Directory</a>.  I am running IDP v2.4 (planning to upgrade soon)  I’ve tried cranking up logging but am not seeing the issue.  Has anyone else had an issue like this? </div>
<div><br>
</div>
<div><br>
</div>
<div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><resolver:DataConnector id="ADgroupLDAP" xsi:type="dc:LDAPDirectory"</div>
<div>        <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>ldapURL="<a>ldaps://adserver_1:<wbr>3269</a>
<a>ldaps://adserver_2:3269</a> <a>
ldaps://adserver_3:3269</a> <a>ldaps://adserver_4:3269</a>
<a>ldaps://adserver_5:3269</a> <a>
ldaps://adserver_6:3269</a>"</div>
<div>        <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>baseDN=“AD_BASE_DN"</div>
<div>        <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>principal=“PRINCIPAL"</div>
<div>        <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>principalCredential=“PASSWORD"</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>maxResultSize="1000"</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>mergeResults="true"</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>searchTimeLimit="PT30.000S"</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>connectionStrategy="RANDOM"</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>></div>
<div><br>
</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><resolver:Dependency ref="scripted_<wbr>distinguishedName" /></div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><dc:FilterTemplate></div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><![CDATA[</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>(member:1.2.840.113556.1.4.<wbr>1941:=${scripted_<wbr>distinguishedName.get(0)})</div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>]]></div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span></dc:FilterTemplate></div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><dc:ReturnAttributes><wbr>distinguishedName</dc:<wbr>ReturnAttributes></div>
<div><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span></resolver:DataConnector></div>
</div>
<div><br>
</div>
<div>
<div><br>
</div>
<div>
<div>2016-12-27 00:00:02.383 - DEBUG [edu.vt.middleware.ldap.ssl.<wbr>DefaultHostnameVerifier:210] - verifyDNS found hostname match: adserver_6</div>
<div>2016-12-27 00:00:02.436 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>193] - Search with the following parameters:</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>194] -   dn = AD_BASE_DN</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>195] -   filter = (member:1.2.840.113556.1.4.<wbr>1941:=USER_DN)</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>196] -   filterArgs = []</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>197] -   searchControls = javax.naming.directory.<wbr>SearchControls@12a0b94</div>
<div><font color="#ff2600">2016-12-27 00:00:02.438</font> - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>198] -   handler = [edu.vt.middleware.ldap.<wbr>handler.<wbr>FqdnSearchResultHandler@<wbr>144f65b, edu.vt.middleware.ldap.<wbr>handler.<wbr>EntryDnSearchResultHandler@<wbr>8a0a75,
 edu.vt.middleware.ldap.<wbr>handler.<wbr>MergeSearchResultHandler@<wbr>b4bbea, edu.vt.middleware.ldap.<wbr>handler.<wbr>BinarySearchResultHandler@<wbr>19d3974]</div>
<div><font color="#ff2600">2016-12-27 00:00:06.922 </font>- DEBUG [edu.internet2.middleware.<wbr>shibboleth.common.attribute.<wbr>resolver.provider.<wbr>dataConnector.<wbr>LdapDataConnector:414] - LDAP data connector ADgroupLDAP - Found the following attribute:
 entryDN[CN=Desktop-</div>
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>2016-12-28 00:03:54.382 - DEBUG [edu.vt.middleware.ldap.ssl.<wbr>DefaultHostnameVerifier:210] - verifyDNS found hostname match: adserver_5</div>
<div>2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>193] - Search with the following parameters:</div>
<div>2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>194] -   dn = AD_BASE_DN</div>
<div>2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>195] -   filter = (member:1.2.840.113556.1.4.<wbr>1941:=USER_DN)</div>
<div>2016-12-28 00:03:54.441 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>196] -   filterArgs = []</div>
<div>2016-12-28 00:03:54.441 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>197] -   searchControls = javax.naming.directory.<wbr>SearchControls@1a5793</div>
</div>
<div>
<div><font color="#ff2600">2016-12-28 00:03:54.441</font> - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>198] -   handler = [edu.vt.middleware.ldap.<wbr>handler.<wbr>FqdnSearchResultHandler@<wbr>144f65b, edu.vt.middleware.ldap.<wbr>handler.<wbr>EntryDnSearchResultHandler@<wbr>8a0a75,
 edu.vt.middleware.ldap.<wbr>handler.<wbr>MergeSearchResultHandler@<wbr>b4bbea, edu.vt.middleware.ldap.<wbr>handler.<wbr>BinarySearchResultHandler@<wbr>19d3974]</div>
<div><font color="#ff2600">2016-12-28 00:03:59.432</font> - INFO [Shibboleth-Access:73] - 20161228T050359Z|174.1.116.<wbr>121|<a href="http://idp.fdu.edu:443" target="_blank">idp.fdu.edu:443</a>|/profile/<wbr>SAML2/Redirect/SSO|</div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>2016-12-28 00:06:44.514 - DEBUG [edu.vt.middleware.ldap.ssl.<wbr>DefaultHostnameVerifier:210] - verifyDNS found hostname match: adserver_3</div>
<div>
<div>2016-12-28 00:06:44.576 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>193] - Search with the following parameters:</div>
<div>2016-12-28 00:06:44.576 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>194] -   dn = AD_BASE_DN</div>
<div>2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>195] -   filter = (member:1.2.840.113556.1.4.<wbr>1941:=USER_DN)</div>
<div>2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>196] -   filterArgs = []</div>
<div>2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>197] -   searchControls = javax.naming.directory.<wbr>SearchControls@f5e8c1</div>
<div><font color="#ff2600">2016-12-28 00:06:44.577</font> - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr>198] -   handler = [edu.vt.middleware.ldap.<wbr>handler.<wbr>FqdnSearchResultHandler@<wbr>144f65b, edu.vt.middleware.ldap.<wbr>handler.<wbr>EntryDnSearchResultHandler@<wbr>8a0a75,
 edu.vt.middleware.ldap.<wbr>handler.<wbr>MergeSearchResultHandler@<wbr>b4bbea, edu.vt.middleware.ldap.<wbr>handler.<wbr>BinarySearchResultHandler@<wbr>19d3974]</div>
<div><font color="#ff2600">2016-12-28 00:06:49.484</font> - DEBUG [edu.internet2.middleware.<wbr>shibboleth.common.attribute.<wbr>resolver.provider.<wbr>dataConnector.<wbr>LdapDataConnector:414] -</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thank you in advance,</div>
<div><br>
</div>
<div>-Chris</div>
<div><br>
</div>
</div>

<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div></div>