How To: Override the Default LDAP Communication Timeout Values

Version Affected: 19.07.01 HF32+, 20.06 HF8+, 21.04 HF2+, 22.02 and later

 

Overview

This article explains how to change the default LDAP communication timeout values used when Identity Provider (IdP) calls an Active Directory (AD) domain controller for authentication or to retrieve profile data.

Each call only waits a limited amount of time before it times out and cancels the request. The default values are:

• Client Timeout: 2 seconds
• Retry Attempts: 3
• Retry Interval: 1 second between attempts

In slower environments, network configuration or domain controller configuration can cause communication between IdP and the LDAP server to exceed these default values, causing a timeout error. The default LDAP settings are sufficient for almost all scenarios and should only be changed in specific situations where the cause of the delay and the effect of changing the defaults are both understood — do not change them otherwise.

Override the Default LDAP Timeout Values

The timeout values can only be changed per-realm, in that realm's web.config — not globally. Add the following entries (replacing x with a valid integer; clientTimeout and retryInterval are in milliseconds) to both the LDAP Profile Provider and the Membership Provider sections of the realm's web.config, anywhere after the opening <add:

clientTimeout="x"
connectionAttempts="x"
retryInterval="x"

Membership Provider example:

<add LDAPServer="LDAP://domain.local/" connectionDN="DC=domain,DC=local"
userGroups="" connectionDomain="@domain.local" connectionUsername="idpservice@domain.local"
connectionPassword="...."
searchFilter="(&(samAccountName=%v)(objectclass=*))" searchAttribute="samAccountName"
anonymousLookUp="False" LDAPName="Active Directory (sAMAccountName)"
adAcctCheck="False" connectionProtection="SECURE" excReadOnly="False"
groupListField="memberOf" LDAPBindType="0" denyGroup="False"
disableNestedGroupSearch="True" readOnlyAccount="True" maxInvalidPasswordAttempts="10"
passwordVaultProvider="0" protocolVersion="3" name="LDAPMembershipProvider" clientTimeout="5000"
connectionAttempts="5" retryInterval="2000"
type="MFA.SecureAuth.LDAPProvider.LDAPMembershipProvider, MFA.SecureAuth.LDAPProvider" />

Profile Provider example:

<add LDAPServer="LDAP://domain.local/" connectionDN="DC=domain,DC=local"
connectionUsername="idpservice@domain.local" connectionPassword="...."
connectionProtection="SECURE" searchFilter="(&(samAccountName=%v)(objectclass=*))"
useMembershipCreds="True" getGroupData="True" disableNestedGroupSearch="True"
searchAttribute="samAccountName" clientTimeout="5000" connectionAttempts="5" retryInterval="2000"
IOSDevicesWrite="False" IOSDevicesEncrypt="0" ... />

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.