Chun Tat David Chu wrote:
Aaron,
I read thru the e-mail chain but perhaps I missed it. What exactly is
the issue you are having regarding startTLS, ABANDON request and 389
Directory? Is it causing some unexpected behavior?
I too use startTLS in my JNDI client but I don't recall seeing
anything that you are experiencing except the persistent search that
Rich was talking about.
FYI (For your information), I narrowed down what triggers an ABANDON
request within JNDI for persistent search by tracing the JNDI code
that came as part of OpenJDK.
From looking at the code, it looks as though the
only way the error 1
LDAP_OPERATIONS_ERROR Other operations are still pending on the
connection can be returned is if there are pending operations that have
not completed sending results to the client. In this case, it looks as
though new InitialLdapContext() with a
javax.naming.Context.SECURITY_AUTHENTICATION of "simple", and a
javax.naming.Context.SECURITY_PRINCIPAL of a valid DN, and a
javax.naming.Context.SECURITY_CREDENTIALS of a valid password does an
LDAP BIND operation, which could be the operation still incomplete when
the server receives the startTLS request.
Is it possible that tomcat is accessing the JNDI ldap context from more
than one thread at once? One way this might happen is if one thread is
attempting to complete reading the bind response, but is swapped out,
and another thread issues the starttls request on the same connection.
I have not been able to reproduce this. I've tried python-ldap and a
small test program using JNDI, to hammer the server with new
InitialLdapContext + starttls requests - running up to 100 at the same
time in separate threads. I have not been able to reproduce the error.
According to
http://www.ietf.org/rfc/rfc4513.txt, it is recommended that
the client _not_ send a bind request, that the first operation on the
connection should be the startTLS operation. However, I don't know very
much about JNDI - I don't know how to turn off that implicit bind operation.
- David
2010/4/15 Aaron Hagopian <airhead1(a)gmail.com <mailto:airhead1@gmail.com>>
I am having a hard time programmatically getting the ABANDON
requests to show up. In my local environment I cannot reproduce
at all (Fedora 12 x86_64) but on all our server environments I see
these in the logs. The oddest thing about it is I only see these
when running in tomcat on either our CentOS or RHEL machines
(i386 and x86_64 platforms). Running a standalone java program
does not create the ABANDON requests, only in tomcat. A little
research shows that tomcat does have its own implementation of
JNDI but that doesn't then explain why in my local environment
(running same versions of java/tomcat/389ds) this does not happen.
I will try to find any further relevant differences between my
local environment and the servers where the messages show up.
For now we are just going SSL all the time on our connections
which seems to fix the problem since we no longer need the startTLS.
On Wed, Apr 14, 2010 at 5:57 PM, Rich Megginson
<rmeggins(a)redhat.com <mailto:rmeggins@redhat.com>> wrote:
Aaron Hagopian wrote:
>
>
> It's JNDI itself. JNDI uses ABANDON requests. Are you
using
> persistent
> search at all? Another 389 user reported similar
problems caused by
> improper handling of JNDI persistent searches + ABANDON
requests.
> Although this looks different, both issues have JNDI and
ABANDON
> in common.
>
>
> We are not using persistent search at all. I will try to
track down
> what in our code creates the ABANDON requests but might take
me a bit.
I think it's JNDI itself - you probably won't find anything
explicitly
calling an ABANDON request in your code.
> Once successfull I'll get you something that causes the
ABANDON to
> show up followed by a startTLS.
>
------------------------------------------------------------------------
>
> --
> 389 users mailing list
> 389-users(a)lists.fedoraproject.org
<mailto:389-users@lists.fedoraproject.org>
>
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users(a)lists.fedoraproject.org
<mailto:389-users@lists.fedoraproject.org>
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users(a)lists.fedoraproject.org
<mailto:389-users@lists.fedoraproject.org>
https://admin.fedoraproject.org/mailman/listinfo/389-users
------------------------------------------------------------------------
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users