<div dir="ltr"><span style="font-size:12.8px">Hi All, Long-time Lurker, First-Time Poster:</span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I'm in the process of moving UNCG from Shib v2 to v3 and we're encountering an intermittent issue in our development tier when attempting to resolve attributes from our LDAP environment after a successful MFA login.  As of yet, I cannot replicate it in validation with the same settings against our production LDAP.  From what I can tell so far, I don't believe it to be a Shibboleth issue, but wanted to post here first to make sure I wasn't missing something before jumping down another rabbit hole.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">When it happens, a <font face="monospace, monospace">'Profile Action ResolveAttributes: Error resolving attributes</font>' error is logged in Shibboleth.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div style="font-size:12.8px">My questions so far:</div><div style="font-size:12.8px">-Does this look to be an issue with the way Shibboleth is configured?</div><div style="font-size:12.8px">-Has anyone else ran into intermittent attribute resolution such as this?</div><div style="font-size:12.8px">-Are there better logs/log levels to look at for this sort of issue?</div><div style="font-size:12.8px">-Any other info I can provide to paint a clearer picture of what's going on?</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Here is our DataConnector info(some info redacted).  </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div><font face="monospace, monospace"><resolver:DataConnector id="devAD" xsi:type="resolver:<wbr>LDAPDirectory"</font></div><div><font face="monospace, monospace">    ldapURL="ldaps://<a href="http://redactedldapdevserver.uncg.edu:636/" target="_blank">redactedLDAPD<wbr>evServer.uncg.edu:636</a>"</font></div><div><font face="monospace, monospace">    baseDN="ou=accounts,o=uncg"</font></div><div><font face="monospace, monospace">    principal="cn=<wbr>redactedbindingCred,ou=<wbr>accounts,o=uncg"</font></div><div><font face="monospace, monospace">    principalCredential="<wbr>RedactedBindingCredential"</font></div><div><font face="monospace, monospace">    useStartTLS="false"</font></div><div><font face="monospace, monospace">    noResultIsError="false"</font></div><div><font face="monospace, monospace">    multipleResultsIsError="true"</font></div><div><font face="monospace, monospace">    searchScope="ONELEVEL"></font></div><div><font face="monospace, monospace">    <resolver:FilterTemplate></font></div><div><font face="monospace, monospace">        <![CDATA[</font></div><div><font face="monospace, monospace">            (uid=$resolutionContext.<wbr>principal)</font></div><div><font face="monospace, monospace">        ]]></font></div><div><font face="monospace, monospace">    </resolver:FilterTemplate></font></div><div><font face="monospace, monospace">    <!-- JFW: Not 100% that this is required or desired. It's preferred to dump all attributes back to shibboleth.</font></div><div><font face="monospace, monospace">    <resolver:ReturnAttributes>%{<wbr>idp.attribute.resolver.LDAP.<wbr>returnAttributes}</resolver:<wbr>ReturnAttributes></font></div><div><font face="monospace, monospace">        --></font></div><div><font face="monospace, monospace">      <resolver:LDAPProperty name="java.naming.referral" value="follow" /></font></div><div><font face="monospace, monospace">      <resolver:LDAPProperty name="java.naming.ldap.<wbr>attributes.binary" value="sourceObjectGuid"/></font></div><div><font face="monospace, monospace"></resolver:DataConnector></font></div></div><div style="font-size:12.8px"><font face="monospace, monospace"><br></font></div><div style="font-size:12.8px"><span style="font-family:monospace,monospace">also from ldap.properties:</span><br></div><div style="font-size:12.8px"><font face="monospace, monospace"><div>idp.authn.LDAP.authenticator                   = directAuthenticator</div><div>idp.authn.LDAP.useSSL                          = true</div><div><br></div><div><span style="font-family:arial,sans-serif">We specifically use SSL and not startTLS in our connect.  However useSSL is expressly not allowed as an attribute.  If there is a better way for us to specify an SSL connection to our ldap server, let me know.</span><br></div><div><br></div></font></div><div style="font-size:12.8px">I've turned up logging on org.ldaptive to DEBUG and receive the following eye-chart upon erring out:<br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div><font face="monospace, monospace">2017-03-08 13:37:18,355 - DEBUG [org.ldaptive.BindOperation:<wbr>138] - execute request=[org.ldaptive.<wbr>BindRequest@14779970::bindDn=<wbr>cn=bindingcred,ou=accounts,o=<wbr>uncg, saslConfig=null, controls=null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@853915943::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>253115005::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@4917fc1e]</font></div><div><font face="monospace, monospace">2017-03-08 13:37:18,378 - DEBUG [org.ldaptive.BindOperation:<wbr>168] - execute response=[org.ldaptive.<wbr>Response@<a href="tel:(201)%20201-7299" value="+12012017299" target="_blank">2012017299</a>::result=<wbr>null, resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.<wbr>BindRequest@14779970::bindDn=<wbr>cn=bindingcred,ou=accounts,o=<wbr>uncg, saslConfig=null, controls=null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@853915943::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>253115005::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@4917fc1e]</font></div><div><font face="monospace, monospace">2017-03-08 13:37:18,379 - DEBUG [org.ldaptive.SearchOperation:<wbr>138] - execute request=[org.ldaptive.<wbr>SearchRequest@<a href="tel:(213)%20279-8348" value="+12132798348" target="_blank">2132798348</a>::<wbr>baseDn=ou=accounts,o=uncg, searchFilter=[org.ldaptive.<wbr>SearchFilter@-2119651592::<wbr>filter=(uid=UNCG_Username), parameters={}], returnAttributes=[], searchScope=ONELEVEL, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.<wbr>ldaptive.handler.<wbr>DnAttributeEntryHandler@-<wbr>1580910376::dnAttributeName=<wbr>entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=<wbr>null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@853915943::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>253115005::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@4917fc1e]</font></div><div><font face="monospace, monospace">2017-03-08 13:37:21,405 - DEBUG [org.ldaptive.provider.jndi.<wbr>NamingExceptionUtils:358] - naming exception class javax.naming.NamingException is ambiguous, maps to multiple result codes: [OPERATIONS_ERROR, ALIAS_PROBLEM, ALIAS_DEREFERENCING_PROBLEM, LOOP_DETECT, AFFECTS_MULTIPLE_DSAS, OTHER]</font></div><div><font face="monospace, monospace">2017-03-08 13:37:21,429 - ERROR [net.shibboleth.idp.profile.<wbr>impl.ResolveAttributes:299] - Profile Action ResolveAttributes: Error resolving attributes</font></div><div><font face="monospace, monospace">net.shibboleth.idp.attribute.<wbr>resolver.ResolutionException: Data Connector 'devAD': Unable to execute LDAP search</font></div><div><font face="monospace, monospace">        at net.shibboleth.idp.attribute.<wbr>resolver.dc.ldap.impl.<wbr>LDAPDataConnector.<wbr>retrieveAttributes(<wbr>LDAPDataConnector.java:170)</font></div><div><font face="monospace, monospace">Caused by: org.ldaptive.LdapException: javax.naming.NamingException: LDAP response read timed out, timeout used:3000ms.; remaining name 'ou=accounts,o=uncg'</font></div><div><font face="monospace, monospace">        at org.ldaptive.provider.<wbr>ProviderUtils.<wbr>throwOperationException(<wbr>ProviderUtils.java:77)</font></div><div><font face="monospace, monospace">Caused by: javax.naming.NamingException: LDAP response read timed out, timeout used:3000ms.</font></div><div><font face="monospace, monospace">        at com.sun.jndi.ldap.Connection.<wbr>readReply(Connection.java:490)</font></div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">***********</div><div style="font-size:12.8px">For comparison, a successful resolution:</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">2017-03-08 15:26:39,791 - DEBUG [org.ldaptive.BindOperation:<wbr>138] - execute request=[org.ldaptive.<wbr>BindRequest@536187249::bindDn=<wbr>cn=bindingcred,ou=accounts,o=<wbr>uncg, saslConfig=null, controls=null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@608981075::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>1343346746::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@cf1cab5]</div><div style="font-size:12.8px">2017-03-08 15:26:39,927 - DEBUG [org.ldaptive.BindOperation:<wbr>168] - execute response=[org.ldaptive.<wbr>Response@1060940867::result=<wbr>null, resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.<wbr>BindRequest@536187249::bindDn=<wbr>cn=bindingcred,ou=accounts,o=<wbr>uncg, saslConfig=null, controls=null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@608981075::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>1343346746::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@cf1cab5]</div><div style="font-size:12.8px">2017-03-08 15:26:39,928 - DEBUG [org.ldaptive.SearchOperation:<wbr>138] - execute request=[org.ldaptive.<wbr>SearchRequest@<a href="tel:(201)%20423-3177" value="+12014233177" target="_blank">2014233177</a>::<wbr>baseDn=ou=accounts,o=uncg, searchFilter=[org.ldaptive.<wbr>SearchFilter@37997637::filter=<wbr>(uid=user), parameters={}], returnAttributes=[], searchScope=ONELEVEL, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.<wbr>ldaptive.handler.<wbr>DnAttributeEntryHandler@-<wbr>1580910376::dnAttributeName=<wbr>entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=<wbr>null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@608981075::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>1343346746::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@cf1cab5]</div><div style="font-size:12.8px">2017-03-08 15:26:40,461 - DEBUG [org.ldaptive.SearchOperation:<wbr>168] - execute response=[org.ldaptive.<wbr>Response@658143803::result=[<wbr>org.ldaptive.SearchResult@<wbr>2011471914::entries=[redacted attributes/values pair list], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.<wbr>SearchRequest@<a href="tel:(201)%20423-3177" value="+12014233177" target="_blank">2014233177</a>::<wbr>baseDn=ou=accounts,o=uncg, searchFilter=[org.ldaptive.<wbr>SearchFilter@37997637::filter=<wbr>(uid=user), parameters={}], returnAttributes=[], searchScope=ONELEVEL, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.<wbr>ldaptive.handler.<wbr>DnAttributeEntryHandler@-<wbr>1580910376::dnAttributeName=<wbr>entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=<wbr>null] with connection=[org.ldaptive.<wbr>DefaultConnectionFactory$<wbr>DefaultConnection@608981075::<wbr>config=[org.ldaptive.<wbr>ConnectionConfig@842588842::<wbr>ldapUrl=ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.<wbr>uncg.edu:636</a>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.<wbr>SslConfig@746436902::<wbr>credentialConfig=org.ldaptive.<wbr>ssl.CredentialConfigFactory$2@<wbr>2577a95d, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=<wbr>null], useSSL=false, useStartTLS=false, connectionInitializer=[org.<wbr>ldaptive.<wbr>BindConnectionInitializer@<wbr>375951774::bindDn=cn=<wbr>bindingcred,ou=accounts,o=<wbr>uncg, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[<wbr>org.ldaptive.provider.jndi.<wbr>JndiConnectionFactory@<wbr>1343346746::metadata=[ldapUrl=<wbr>ldaps://<a href="http://ldapdevserver.uncg.edu:636/" target="_blank">ldapDevServer.uncg.<wbr>edu:636</a>, count=1], environment={java.naming.ldap.<wbr>factory.socket=org.ldaptive.<wbr>ssl.<wbr>ThreadLocalTLSSocketFactory, java.naming.referral=follow, com.sun.jndi.ldap.connect.<wbr>timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=<wbr>com.sun.jndi.ldap.<wbr>LdapCtxFactory, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid, com.sun.jndi.ldap.read.<wbr>timeout=3000}, providerConfig=[org.ldaptive.<wbr>provider.jndi.<wbr>JndiProviderConfig@1518011879:<wbr>:<wbr>operationExceptionResultCodes=<wbr>[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.<wbr>referral=follow, java.naming.ldap.attributes.<wbr>binary=sourceObjectGuid}, connectionStrategy=org.<wbr>ldaptive.provider.<wbr>ConnectionStrategies$<wbr>ActivePassiveConnectionStrateg<wbr>y@233db8e9, controlProcessor=org.ldaptive.<wbr>provider.ControlProcessor@<wbr>56244b7c, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_<wbr>LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.<wbr>ldaptive.provider.jndi.<wbr>JndiConnection@cf1cab5]</div><div style="font-size:12.8px">2017-03-08 15:26:40,469 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.<wbr>AbstractDataConnector:139] - Data Connector 'dataConnector': produced the following 56 attributes during resolution [redacted attributes list]</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">***************************</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Final note on our environment, if it helps:</div><div style="font-size:12.8px">Our v3 dev environment consists of 2 RHEL 7.3 VM's running the Unicon v3.3.0 docker image with university-specific customizations being pulled at runtime from our Stash server.  A Netscaler VIP sits in front of them in Active/Passive with SSL offloading (we also have certs in the containers themselves for individual testing.</div><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">Jeffrey Williams, SQL Server 2012 MCSA, Windows Server 2012 MCSA<br>Identity Management Specialist <br>Identity Architecture, ITS<br>University of North Carolina at Greensboro<br>256-TECH (256-8324)</div></div></div></div></div></div>
</div>