<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Here's the scenario.<br>
We have 2 LDAPDirectory DataConnectors, one pointing to our LDAP
directory for all attributes except groups and the second pointing
to Active Directory just to get groups (config snippet below).
Groups is new to our configuration, so we only have one service that
the group attribute is released to. Authentication is only against
our LDAP directory.<br>
<br>
We had an issue yesterday where the Active Directory DC we were
connected to was rebooted unexpectedly. This resulted in the
following error:<br>
<blockquote>
<pre>2018-10-25 09:11:39,925 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:299] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'myAD': Unable to execute LDAP search
...
</pre>
</blockquote>
And users were receiving odd errors from all SAML and CAS integrated
services and did not successfully authenticate to these services.
None of these services in question have the group attribute
released. <br>
<br>
My assumption based on these results is that attribute resolution is
occurring for <b>all</b> attributes every time, not just for the
needed attributes. <br>
<br>
Is this the expected behavior? <br>
Is there a way to configure our AD DataConnector to fail more
gracefully?<br>
e.g. unable to connect or unable to search is equivalent to no
attributes returned.<br>
<br>
From attribute-resolver.xml:<br>
<blockquote><tt> <resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory" </tt><br>
<tt> ldapURL="@idp.ent.ldap.url@"
baseDN="@idp.ent.ldap.baseDN@" </tt><br>
<tt> principal="@idp.ent.ldap.principal@"</tt><br>
<tt> principalCredential="@idp.ent.ldap.credential@"></tt><br>
<tt> <dc:FilterTemplate></tt><br>
<tt> <![CDATA[</tt><br>
<tt>
(|(mail=$requestContext.principalName)(<a class="moz-txt-link-abbreviated" href="mailto:mail=$requestContext.principalName@calpoly.edu">mail=$requestContext.principalName@calpoly.edu</a>))</tt><br>
<tt> ]]></tt><br>
<tt> </dc:FilterTemplate></tt><br>
<tt> </resolver:DataConnector></tt><br>
<br>
<tt> <resolver:DataConnector id="myAD"
xsi:type="dc:LDAPDirectory" </tt><br>
<tt> ldapURL="@idp.ent.ad.url@"
baseDN="@idp.ent.ad.baseDN@" </tt><br>
<tt> principal="@idp.ent.ad.principal@"</tt><br>
<tt> principalCredential="@idp.ent.ad.credential@"></tt><br>
<tt> <dc:FilterTemplate></tt><br>
<tt> <![CDATA[</tt><br>
<tt>
(|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))</tt><br>
<tt> ]]></tt><br>
<tt> </dc:FilterTemplate></tt><br>
<tt> </resolver:DataConnector></tt><br>
</blockquote>
<br>
Thanks,<br>
Dan<br>
<br>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title></title>
Dan Malone<br>
<font color="#999999">Lead Identity Management Architect<br>
Information Technology Services<br>
California Polytechnic State University<br>
San Luis Obispo, California<br>
<br>
Direct 805-756-6326<br>
<a class="moz-txt-link-abbreviated" href="mailto:dmalone@calpoly.edu">dmalone@calpoly.edu</a></font><br>
</div>
</body>
</html>