<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I’m getting an odd LDAP error after a 3.4.8 -> 4.1.5 upgrade. The error only occurs when a user types an incorrect password. All other LDAP related functions are working as I would expect.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:202] - Credential Validator ldap: Login by ******** failed<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">org.ldaptive.LdapException: LDAPException(resultCode=85 (timeout),
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">errorMessage='A client-side timeout was encountered while waiting 3000ms for a response to simple bind request with message ID 7284 for user ****** from server ********.',<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate(LDAPCredentialValidator.java:198)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The other odd thing is it’s not even really timing out as the response is nearly instant.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Our LDAP is backed by a load balanced set of eDirectory servers
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Our basic LDAP properties look like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.authn.LDAP.authenticator = bindSearchAuthenticator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.authn.LDAP.connectTimeout = PT3S<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.authn.LDAP.responseTimeout = PT3S<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.authn.LDAP.returnAttributes = passwordExpirationTime,loginGraceRemaining,loginGraceLimit<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.minSize = 3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.maxSize = 15<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.validateOnCheckout = false<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.validatePeriodically = true<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.validatePeriod = PT5M<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.prunePeriod = PT5M<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.idleTime = PT10M<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.blockWaitTime = PT3S<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">idp.pool.LDAP.failFastInitialize = false<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Any thoughts on how to resolve this or where I can dig further in?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">--Joel<o:p></o:p></span></p>
</div>
</body>
</html>