<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi David,
<div class=""><br class="">
</div>
<div class="">I think I need to give you a little more detail on why this is important to me, perhaps there’s another way to skin this cat. I have spent a lot of time recently tuning our system because response times were horrible. This 3-6 second delay is
often doubled because we have front ended a few SPs locally with pages we control and then forward to the actual SP which does a second auth and attribute pull (for example we have a local Webmail SP which determines Student/Employee and then forwards you
to Google or an on-premise mail application. Both of which authenticate & pull attributes). That 6-12 delay is just enough to cause my users to click the sign-in button again which results in an error. Normal AD/LDAP queries come back in microseconds. I
am using the Global Catalog so there are no referrals and everything is in right there.</div>
<div class=""><br class="">
</div>
<div class="">So while it’s true that it may be an intensive search, the number of resulting failed logins make it a tough sell to management that the users are just impatient.</div>
<div class=""><br class="">
</div>
<div class="">-Chris</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 28, 2016, at 8:28 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" class="">dabantz@alaska.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">Isn't that a pretty intensive sweep of the entire Directory structure for recursive group memberships? <br class="">
"<span style="color:rgb(42,42,42);font-family:"segoe ui","lucida grande",verdana,arial,helvetica,sans-serif" class="">This rule is limited to filters that apply to the DN. This is a special "extended" match operator that walks the chain of ancestry in objects
all the way to the root until it finds a match." </span><font color="#2a2a2a" face="segoe ui, lucida grande, verdana, arial, helvetica, sans-serif" class=""><a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475" class="">https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475</a></font>
<div class="">How fast would you expect that to be?
<div class=""><br class="">
</div>
<div class="">David Bantz</div>
</div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Wed, Dec 28, 2016 at 4:10 PM, Mr. Christopher Bland <span dir="ltr" class="">
<<a href="mailto:chris@fdu.edu" target="_blank" class="">chris@fdu.edu</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div style="word-wrap:break-word" class="">
<div class=""><br class="">
</div>
<div class="">HI All,</div>
<div class=""><br class="">
</div>
<div class="">I am experiencing a weird delay between 3 and 6 seconds when using DataConnector shown below. My DataConnector is pretty much the same as Shibboleth Wiki "Generate eduPersonAffiliation based on recursive group membership in Active Directory”
example on <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples#ResolverScriptAttributeDefinitionExamples-GenerateeduPersonAffiliationbasedonrecursivegroupmembershipinActiveDirectory" target="_blank" class="">Generate
eduPersonAffiliation based on recursive group membership in Active Directory</a>. I am running IDP v2.4 (planning to upgrade soon) I’ve tried cranking up logging but am not seeing the issue. Has anyone else had an issue like this? </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><resolver:DataConnector id="ADgroupLDAP" xsi:type="dc:LDAPDirectory"</div>
<div class=""> <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>ldapURL="<a class="">ldaps://adserver_1:<wbr class="">3269</a> <a class="">
ldaps://adserver_2:3269</a> <a class="">ldaps://adserver_3:3269</a> <a class="">ldaps://adserver_4:3269</a>
<a class="">ldaps://adserver_5:3269</a> <a class="">ldaps://adserver_6:3269</a>"</div>
<div class=""> <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>baseDN=“AD_BASE_DN"</div>
<div class=""> <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>principal=“PRINCIPAL"</div>
<div class=""> <span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap">
</span>principalCredential=“PASSWORD"</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>maxResultSize="1000"</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>mergeResults="true"</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>searchTimeLimit="PT30.000S"</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>connectionStrategy="RANDOM"</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>></div>
<div class=""><br class="">
</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><resolver:Dependency ref="scripted_<wbr class="">distinguishedName" /></div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><dc:FilterTemplate></div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><![CDATA[</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>(member:1.2.840.113556.1.4.<wbr class="">1941:=${scripted_<wbr class="">distinguishedName.get(0)})</div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span>]]></div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span></dc:FilterTemplate></div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span><dc:ReturnAttributes><wbr class="">distinguishedName</dc:<wbr class="">ReturnAttributes></div>
<div class=""><span class="gmail-m_-8786284589242556973Apple-tab-span" style="white-space:pre-wrap"></span></resolver:DataConnector></div>
</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><br class="">
</div>
<div class="">
<div class="">2016-12-27 00:00:02.383 - DEBUG [edu.vt.middleware.ldap.ssl.<wbr class="">DefaultHostnameVerifier:210] - verifyDNS found hostname match: adserver_6</div>
<div class="">2016-12-27 00:00:02.436 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">193] - Search with the following parameters:</div>
<div class="">2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">194] - dn = AD_BASE_DN</div>
<div class="">2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">195] - filter = (member:1.2.840.113556.1.4.<wbr class="">1941:=USER_DN)</div>
<div class="">2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">196] - filterArgs = []</div>
<div class="">2016-12-27 00:00:02.437 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">197] - searchControls = javax.naming.directory.<wbr class="">SearchControls@12a0b94</div>
<div class=""><font color="#ff2600" class="">2016-12-27 00:00:02.438</font> - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">198] - handler = [edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">FqdnSearchResultHandler@<wbr class="">144f65b, edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">EntryDnSearchResultHandler@<wbr class="">8a0a75,
edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">MergeSearchResultHandler@<wbr class="">b4bbea, edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">BinarySearchResultHandler@<wbr class="">19d3974]</div>
<div class=""><font color="#ff2600" class="">2016-12-27 00:00:06.922 </font>- DEBUG [edu.internet2.middleware.<wbr class="">shibboleth.common.attribute.<wbr class="">resolver.provider.<wbr class="">dataConnector.<wbr class="">LdapDataConnector:414] - LDAP data
connector ADgroupLDAP - Found the following attribute: entryDN[CN=Desktop-</div>
</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">2016-12-28 00:03:54.382 - DEBUG [edu.vt.middleware.ldap.ssl.<wbr class="">DefaultHostnameVerifier:210] - verifyDNS found hostname match: adserver_5</div>
<div class="">2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">193] - Search with the following parameters:</div>
<div class="">2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">194] - dn = AD_BASE_DN</div>
<div class="">2016-12-28 00:03:54.440 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">195] - filter = (member:1.2.840.113556.1.4.<wbr class="">1941:=USER_DN)</div>
<div class="">2016-12-28 00:03:54.441 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">196] - filterArgs = []</div>
<div class="">2016-12-28 00:03:54.441 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">197] - searchControls = javax.naming.directory.<wbr class="">SearchControls@1a5793</div>
</div>
<div class="">
<div class=""><font color="#ff2600" class="">2016-12-28 00:03:54.441</font> - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">198] - handler = [edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">FqdnSearchResultHandler@<wbr class="">144f65b, edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">EntryDnSearchResultHandler@<wbr class="">8a0a75,
edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">MergeSearchResultHandler@<wbr class="">b4bbea, edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">BinarySearchResultHandler@<wbr class="">19d3974]</div>
<div class=""><font color="#ff2600" class="">2016-12-28 00:03:59.432</font> - INFO [Shibboleth-Access:73] - 20161228T050359Z|174.1.116.<wbr class="">121|<a href="http://idp.fdu.edu:443/" target="_blank" class="">idp.fdu.edu:443</a>|/profile/<wbr class="">SAML2/Redirect/SSO|</div>
<div class=""><br class="">
</div>
</div>
<div class=""><br class="">
</div>
<div class="">2016-12-28 00:06:44.514 - DEBUG [edu.vt.middleware.ldap.ssl.<wbr class="">DefaultHostnameVerifier:210] - verifyDNS found hostname match: adserver_3</div>
<div class="">
<div class="">2016-12-28 00:06:44.576 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">193] - Search with the following parameters:</div>
<div class="">2016-12-28 00:06:44.576 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">194] - dn = AD_BASE_DN</div>
<div class="">2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">195] - filter = (member:1.2.840.113556.1.4.<wbr class="">1941:=USER_DN)</div>
<div class="">2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">196] - filterArgs = []</div>
<div class="">2016-12-28 00:06:44.577 - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">197] - searchControls = javax.naming.directory.<wbr class="">SearchControls@f5e8c1</div>
<div class=""><font color="#ff2600" class="">2016-12-28 00:06:44.577</font> - DEBUG [edu.vt.middleware.ldap.Ldap:<wbr class="">198] - handler = [edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">FqdnSearchResultHandler@<wbr class="">144f65b, edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">EntryDnSearchResultHandler@<wbr class="">8a0a75,
edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">MergeSearchResultHandler@<wbr class="">b4bbea, edu.vt.middleware.ldap.<wbr class="">handler.<wbr class="">BinarySearchResultHandler@<wbr class="">19d3974]</div>
<div class=""><font color="#ff2600" class="">2016-12-28 00:06:49.484</font> - DEBUG [edu.internet2.middleware.<wbr class="">shibboleth.common.attribute.<wbr class="">resolver.provider.<wbr class="">dataConnector.<wbr class="">LdapDataConnector:414] -</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Thank you in advance,</div>
<div class=""><br class="">
</div>
<div class="">-Chris</div>
<div class=""><br class="">
</div>
</div>
<br class="">
--<br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.<wbr class="">net</a><br class="">
</blockquote>
</div>
<br class="">
</div>
</div>
-- <br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>