https://bugs.openldap.org/show_bug.cgi?id=9829

--- Comment #1 from Ondřej Kuzník ondra@mistotebe.net --- On Thu, Apr 21, 2022 at 02:57:23PM +0000, openldap-its@openldap.org wrote:

Currently, it seems there is no way to configure timeouts in the remoteauth overlay.

For example, if I define a remoteauth_mapping with a file containing a list of hostnames, the first one is checked first.

After "remoteauth_retry_count" * "connect_timeout" seconds, (210s on my system), remoteauth test the second server in the list.

In some circumstances, it could be nice to set the connect timeout lower (or higher).

Hi David, you'll have to be more specific about how you propose this to actually behave because in my view that's not obvious from your description.

https://bugs.openldap.org/show_bug.cgi?id=9829

Quanah Gibson-Mount quanah@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |2.7.0 Keywords|needs_review |

https://bugs.openldap.org/show_bug.cgi?id=9829

--- Comment #4 from slash@aceslash.net --- Hello,

I have also been bitten by this. This can actually create a situation where the whole server is unresponsive: if a remote system is down, all connections trying to use the remoteauth overlay will have to wait until the timeout (more than 2 minutes on my test system).

This situation can escalate quickly and block all connections on an OpenLDAP server, even the ones that don't use remoteauth.

I'm talking from experience here: both Active Directory servers were unavailable and it basically killed the whole OpenLDAP cluster for us.

The fix was to replace the addresses of the remote ADs with IPs that were responding, but had no LDAP port open, in this case the operation returns instantly.