<div dir="ltr">I had a very similar issue a few weeks ago. We're running 4.3.3 on our end, not 4.2.1, but I don't think it had anything to do with Shibboleth.<div><br></div><div>For us, the problem ended up being an issue with the LDAP SSL certificate selection on the DCs. I'm still not 100% sure exactly what the issue was, but we found that the DC's which were acting up had just auto renewed a cert from AD CS. There were conflicting SSL certs between the service specific store and the machine store. We cleaned that up, restarted, and 30 minutes later everything cleared up. </div><div><br></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, 4 Feb 2025 at 11:44, Lee, Dong via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-298955373713213827">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_-298955373713213827WordSection1">
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal">Hello, we are running shib version 4.2.1 and had the following error last week. The understanding is exactly what the error message says, the connection to xxxxx-lb timed out after 3000 ms. We are trying to determine was this shibboleth
causing the problem, was this the load balancer, networking in general, something else? How would we determine where the issue was?<span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The second part of the question: if the search timed out, why did the assertion go across? It appears that with the double pipe, no attributes were sent? Should this be a fatal error?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">2025-01-28 12:07:32,096 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:317] - 10.226.70.238 - Profile Action ResolveAttributes: Error resolving attributes<u></u><u></u></p>
<p class="MsoNormal">net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'umbLDAP': Unable to execute LDAP search<u></u><u></u></p>
<p class="MsoNormal"> at net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:225)<u></u><u></u></p>
<p class="MsoNormal">Caused by: org.ldaptive.LdapException: LDAPException(resultCode=85 (timeout), numEntries=0, numReferences=0, diagnosticMessage='A client-side timeout was encountered while waiting 3000ms for a response to search request with message ID
140, base DN 'ou=xxxx,dc=xxxx,dc=xxxx,dc=xxxx', scope SUB, and filter '(uid=xxxxx)' from server xxxxx-lb.umaryland.edu:636.', ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb')<u></u><u></u></p>
<p class="MsoNormal"> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:55)<u></u><u></u></p>
<p class="MsoNormal">Caused by: com.unboundid.ldap.sdk.LDAPSearchException: A client-side timeout was encountered while waiting 3000ms for a response to search request with message ID 140, base DN 'ou=xxxx,dc=xxxx,dc=xxxx,dc=xxx', scope SUB, and filter '(uid=xxxx'
from server <a href="http://xxxxx-lb.umaryland.edu:636" target="_blank">xxxxx-lb.umaryland.edu:636</a>.<u></u><u></u></p>
<p class="MsoNormal"> at com.unboundid.ldap.sdk.SearchRequest.process(SearchRequest.java:1206)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">2025-01-28 12:07:32,104 - INFO [Shibboleth-Audit.SSO:283] - 10.226.70.238 - 10.226.70.238|2025-01-28T17:07:32.104614Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_950e5c979f28f73ec8be11f2f371332b|<a href="http://cfapps1.umaryland.edu/sp%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://webauth.umaryland.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f83d6656df4ec4106b5cf2f0a51f7350%7Cxxxxx%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" target="_blank">cfapps1.umaryland.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://webauth.umaryland.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f83d6656df4ec4106b5cf2f0a51f7350|xxxxx|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</a><span style="background:yellow">||</span>AAdzZWNyZXQx35m8zFPoeJJWUWJ1UMtFx3Gl6aLHuMVIWPa2V7XYWQSToThPHXqAwIJvjHJ8XOHjWGridsnLiIRi6bSOIf0Xhf23HVjOhbTd7FtqYPV46IWQ75l4WHw6/GKjFDtm|_db71f7d9698b8b52d5ac46cc06ac6887|<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal">Also is this related to search timeout?<span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal">2025-01-28 12:05:24,604 - WARN [org.ldaptive.pool.BlockingConnectionPool:784] - -
<a href="mailto:org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy@119e70d" target="_blank">
org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy@119e70d</a> failed validation<u></u><u></u></p>
<p class="MsoNormal">2025-01-28 12:05:24,853 - INFO [org.ldaptive.pool.BlockingConnectionPool:497] - - added available connection:
<a href="mailto:org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy@42b6aaa1" target="_blank">
org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy@42b6aaa1</a><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Dong Lee<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Identity Management & System Integration
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri Light",sans-serif;color:rgb(31,73,125)">Center for Information Technology Services
<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Calibri Light",sans-serif;color:rgb(31,73,125)">University of Maryland, Baltimore<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Aptos Display",sans-serif;color:rgb(14,40,65)">410-706-3027<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><a href="mailto:dlee@umaryland.edu" target="_blank"><span style="color:rgb(5,99,193)">dlee@umaryland.edu</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>