<div dir="ltr">That's a good description of poor user experience needing to be addressed. I'm sorry I don't have an equally good resolution.<div>"Normal AD/LDAP queries" are what LDAP has, historically, been optimized for; traversing the directory structure (let alone recursively) isn't.</div><div><br></div><div>The example you cited from the Shibb wiki traverses the directory structure for recursively to determine eduPersonAffilation based on various group memberships, direct and implicit. The alternative to long searches would be to use that logic to populate the eduPersonAffiliation attribute for person directory entries, enabling the millisecond response time of "normal" queries. Apologies if that alternative is incompatible with your requirements or constraints.</div><div><br></div><div>David Bantz</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 28, 2016 at 5:10 PM, Mr. Christopher Bland <span dir="ltr"><<a href="mailto:chris@fdu.edu" target="_blank">chris@fdu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
Hi David,
<div><br>
</div>
<div>I think I need to give you a little more detail on why this is important to me, perhaps there’s another way to skin this cat. I have spent a lot of time recently tuning our system because response times were horrible. This 3-6 second delay is
often doubled because we have front ended a few SPs locally with pages we control and then forward to the actual SP which does a second auth and attribute pull (for example we have a local Webmail SP which determines Student/Employee and then forwards you
to Google or an on-premise mail application. Both of which authenticate & pull attributes). That 6-12 delay is just enough to cause my users to click the sign-in button again which results in an error. Normal AD/LDAP queries come back in microseconds. I
am using the Global Catalog so there are no referrals and everything is in right there.</div>
<div><br>
</div>
<div>So while it’s true that it may be an intensive search, the number of resulting failed logins make it a tough sell to management that the users are just impatient.</div>
<div><br>
</div>
<div>-Chris</div><div><div class="h5">
<div><br>
<div>
<blockquote type="cite">
<div>On Dec 28, 2016, at 8:28 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>> wrote:</div>
<br class="m_-8101804407378764641Apple-interchange-newline">
<div>
<div dir="ltr">Isn't that a pretty intensive sweep of the entire Directory structure for recursive group memberships? <br>
"<span style="color:rgb(42,42,42);font-family:"segoe ui","lucida grande",verdana,arial,helvetica,sans-serif">This rule is limited to filters that apply to the DN. This is a special "extended" match operator that walks the chain of ancestry in objects
all the way to the root until it finds a match." </span><font color="#2a2a2a" face="segoe ui, lucida grande, verdana, arial, helvetica, sans-serif"><a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475" target="_blank">https://msdn.<wbr>microsoft.com/en-us/library/<wbr>windows/desktop/aa746475</a></font>
<div>How fast would you expect that to be?
<div><br>
</div>
<div>David Bantz</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Dec 28, 2016 at 4:10 PM, Mr. Christopher Bland <span dir="ltr">
<<a href="mailto:chris@fdu.edu" target="_blank">chris@fdu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div style="word-wrap:break-word">
<div><br>
</div>
<div>HI All,</div>
<div><br>
</div>
<div>I am experiencing a weird delay between 3 and 6 seconds when using DataConnector shown below. My DataConnector is pretty much the same as Shibboleth Wiki "Generate eduPersonAffiliation based on recursive group membership in Active Directory”
example on <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples#ResolverScriptAttributeDefinitionExamples-GenerateeduPersonAffiliationbasedonrecursivegroupmembershipinActiveDirectory" target="_blank">Generate
eduPersonAffiliation based on recursive group membership in Active Directory</a>. I am running IDP v2.4 (planning to upgrade soon) I’ve tried cranking up logging but am not seeing the issue. Has anyone else had an issue like this? </div>
<div><br>
</div>
<div><br>
</div>
<div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><resolver:DataConnector id="ADgroupLDAP" xsi:type="dc:LDAPDirectory"</div>
<div> <span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>ldapURL="<a>ldaps://adserver_1:32<wbr>69</a> <a>
ldaps://adserver_2:3269</a> <a>ldaps://adserver_3:3269</a> <a>ldaps://adserver_4:3269</a>
<a>ldaps://adserver_5:3269</a> <a>ldaps://adserver_6:3269</a>"</div>
<div> <span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>baseDN=“AD_BASE_DN"</div>
<div> <span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>principal=“PRINCIPAL"</div>
<div> <span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>principalCredential=“PASSWORD"</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>maxResultSize="1000"</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>mergeResults="true"</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>searchTimeLimit="PT30.000S"</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>connectionStrategy="RANDOM"</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>></div>
<div><br>
</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><resolver:Dependency ref="scripted_distinguishedNam<wbr>e" /></div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><dc:FilterTemplate></div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><![CDATA[</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>(member:1.2.840.113556.1.4.194<wbr>1:=${scripted_distinguishedNam<wbr>e.get(0)})</div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>]]></div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span></dc:FilterTemplate></div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><dc:ReturnAttributes>distingui<wbr>shedName</dc:ReturnAttributes></div>
<div><span class="m_-8101804407378764641gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span></resolver:DataConnector></div>
</div>
<div><br>
</div>
<div>
<div><br>
</div>
<div>
<div>2016-12-27 00:00:02.383 - DEBUG [<a href="http://edu.vt.middleware.ldap.ssl.De">edu.vt.middleware.ldap.ssl.De</a><wbr>faultHostnameVerifier:210] - verifyDNS found hostname match: adserver_6</div>
<div>2016-12-27 00:00:02.436 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>93] - Search with the following parameters:</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>94] - dn = AD_BASE_DN</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>95] - filter = (member:1.2.840.113556.1.4.194<wbr>1:=USER_DN)</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>96] - filterArgs = []</div>
<div>2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>97] - searchControls = javax.naming.directory.SearchC<wbr>ontrols@12a0b94</div>
<div><font color="#ff2600">2016-12-27 00:00:02.438</font> - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>98] - handler = [edu.vt.middleware.ldap.handle<wbr>r.FqdnSearchResultHandler@144f<wbr>65b, edu.vt.middleware.ldap.handler<wbr>.EntryDnSearchResultHandler@8a<wbr>0a75,
edu.vt.middleware.ldap.handler<wbr>.MergeSearchResultHandler@b4bb<wbr>ea, edu.vt.middleware.ldap.handler<wbr>.BinarySearchResultHandler@19d<wbr>3974]</div>
<div><font color="#ff2600">2016-12-27 00:00:06.922 </font>- DEBUG [edu.internet2.middleware.shib<wbr>boleth.common.attribute.resolv<wbr>er.provider.dataConnector.Ldap<wbr>DataConnector:414] - LDAP data
connector ADgroupLDAP - Found the following attribute: entryDN[CN=Desktop-</div>
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>2016-12-28 00:03:54.382 - DEBUG [<a href="http://edu.vt.middleware.ldap.ssl.De">edu.vt.middleware.ldap.ssl.De</a><wbr>faultHostnameVerifier:210] - verifyDNS found hostname match: adserver_5</div>
<div>2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>93] - Search with the following parameters:</div>
<div>2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>94] - dn = AD_BASE_DN</div>
<div>2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>95] - filter = (member:1.2.840.113556.1.4.194<wbr>1:=USER_DN)</div>
<div>2016-12-28 00:03:54.441 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>96] - filterArgs = []</div>
<div>2016-12-28 00:03:54.441 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>97] - searchControls = javax.naming.directory.SearchC<wbr>ontrols@1a5793</div>
</div>
<div>
<div><font color="#ff2600">2016-12-28 00:03:54.441</font> - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>98] - handler = [edu.vt.middleware.ldap.handle<wbr>r.FqdnSearchResultHandler@144f<wbr>65b, edu.vt.middleware.ldap.handler<wbr>.EntryDnSearchResultHandler@8a<wbr>0a75,
edu.vt.middleware.ldap.handler<wbr>.MergeSearchResultHandler@b4bb<wbr>ea, edu.vt.middleware.ldap.handler<wbr>.BinarySearchResultHandler@19d<wbr>3974]</div>
<div><font color="#ff2600">2016-12-28 00:03:59.432</font> - INFO [Shibboleth-Access:73] - 20161228T050359Z|174.1.116.121<wbr>|<a href="http://idp.fdu.edu:443/" target="_blank">idp.fdu.edu:443</a>|/profile/SAML<wbr>2/Redirect/SSO|</div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>2016-12-28 00:06:44.514 - DEBUG [<a href="http://edu.vt.middleware.ldap.ssl.De">edu.vt.middleware.ldap.ssl.De</a><wbr>faultHostnameVerifier:210] - verifyDNS found hostname match: adserver_3</div>
<div>
<div>2016-12-28 00:06:44.576 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>93] - Search with the following parameters:</div>
<div>2016-12-28 00:06:44.576 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>94] - dn = AD_BASE_DN</div>
<div>2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>95] - filter = (member:1.2.840.113556.1.4.194<wbr>1:=USER_DN)</div>
<div>2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>96] - filterArgs = []</div>
<div>2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>97] - searchControls = javax.naming.directory.SearchC<wbr>ontrols@f5e8c1</div>
<div><font color="#ff2600">2016-12-28 00:06:44.577</font> - DEBUG [edu.vt.middleware.ldap.Ldap:1<wbr>98] - handler = [edu.vt.middleware.ldap.handle<wbr>r.FqdnSearchResultHandler@144f<wbr>65b, edu.vt.middleware.ldap.handler<wbr>.EntryDnSearchResultHandler@8a<wbr>0a75,
edu.vt.middleware.ldap.handler<wbr>.MergeSearchResultHandler@b4bb<wbr>ea, edu.vt.middleware.ldap.handler<wbr>.BinarySearchResultHandler@19d<wbr>3974]</div>
<div><font color="#ff2600">2016-12-28 00:06:49.484</font> - DEBUG [edu.internet2.middleware.shib<wbr>boleth.common.attribute.resolv<wbr>er.provider.dataConnector.Ldap<wbr>DataConnector:414] -</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thank you in advance,</div>
<div><br>
</div>
<div>-Chris</div>
<div><br>
</div>
</div>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.n<wbr>et</a><br>
</blockquote>
</div>
<br>
</div>
</div>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.<wbr>net</a></div>
</blockquote>
</div>
<br>
</div>
</div></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>