<div dir="ltr"><div>Teresa,</div><div><br></div><div>Your configuration looks okay to me and I would expect a faster transaction than several minutes. Have you tried watching the IdP's idp-process.log to see precisely where the waiting is happening? Each log entry will have a timestamp.</div><div><br></div><div>Take care,</div><div>Nate.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 7, 2018 at 11:38 AM, Teresa Fasano <span dir="ltr"><<a href="mailto:t.fasano@cineca.it" target="_blank">t.fasano@cineca.it</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
I configured an Idp v3 that uses two Active Directory for login and to retrieve the attributes.<br>
<br>
The configuration of the jaas.config is<br>
ldapUrl = "ldaps://dc1 ldaps://dc2<br>
<br>
The configuration of the attribute-resolver.xml is<br>
<DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br>
ldapURL="%{idp.attribute.resol<wbr>ver.LDAP.ldapURL}"<br>
baseDN="%{idp.attribute.resolv<wbr>er.LDAP.baseDN}"<br>
principal="%{idp.attribute.res<wbr>olver.LDAP.bindDN}"<br>
principalCredential="%{idp.att<wbr>ribute.resolver.LDAP.bindDNCre<wbr>dential}"<br>
useStartTLS="%{idp.attribute.r<wbr>esolver.LDAP.useStartTLS:true}<wbr>"<br>
connectTimeout="%{idp.attribut<wbr>e.resolver.LDAP.connectTimeout<wbr>}"<br>
responseTimeout="%{idp.attribu<wbr>te.resolver.LDAP.responseTimeo<wbr>ut}"<br>
validatorRef="shibboleth.NonFa<wbr>ilFastValidator" ><br>
<FailoverDataConnector ref="failoverFakeConnector" /><br>
<FilterTemplate><br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.<wbr>searchFilter}<br>
]]><br>
</FilterTemplate><br>
<ConnectionPool<br>
minPoolSize="%{idp.pool.LDAP.m<wbr>inSize:3}"<br>
maxPoolSize="%{idp.pool.LDAP.m<wbr>axSize:10}"<br>
blockWaitTime="%{idp.pool.LDAP<wbr>.blockWaitTime:PT3S}"<br>
validatePeriodically="%{idp.po<wbr>ol.LDAP.validatePeriodically:<wbr>true}"<br>
validateTimerPeriod="%{idp.poo<wbr>l.LDAP.validatePeriod:PT5M}"<br>
expirationTime="%{idp.pool.LDA<wbr>P.idleTime:PT10M}"<br>
failFastInitialize="%{idp.pool<wbr>.LDAP.failFastInitialize:false<wbr>}" /><br>
</DataConnector><br>
<br>
Finally, in the ldap.properties I have:<br>
idp.authn.LDAP.ldapURL <wbr> = ldaps://dc1 ldaps://dc2<br>
idp.authn.LDAP.connectTimeout <wbr> = 3000<br>
<a href="http://idp.attribute.resolver.LDAP.co">idp.attribute.resolver.LDAP.co</a><wbr>nnectTimeout = %{idp.authn.LDAP.connectTimeou<wbr>t:PT3S}<br>
<a href="http://idp.attribute.resolver.LDAP.re">idp.attribute.resolver.LDAP.re</a><wbr>sponseTimeout = %{idp.authn.LDAP.responseTimeo<wbr>ut:PT3S}<br>
<br>
We performed a test where the first dc1 was disconnected, making it unavailable and leaving only the dc2 active.<br>
The test was used to verify whether authentication continued to work with dc2.<br>
The result was that the authentication and the attribute release has become very slow (several minutes) because probably the idp check the connection of the first AD before to use the second one.<br>
<br>
I have read that it is possible to use the connectTimeout = "3000" parameter in the jaas.config<br>
<br>
Can you recommend a configuration to make fast authentication in case the first Active Directory is not available?<br>
Thank you,<br>
T.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</font></span></blockquote></div><br></div>