Added LDAP authentication timeout

Details

Detail name Value
Changelog Number 4873
Type Bug
Status Resolved
Affected Versions
Fix Versions EXASOL 6.0.3
Resolution Date 2017-08-22

Bug

If a database user tries to login with LDAP authentication and the LDAP server/network/firewall causes the login process to hang, then, after some time, all other login attempts (not limited to LDAP authentication) will also hang until the LDAP authentication times out.

How To Reproduce

Simulate slow network
  1. Configure your firewall to drop (not reject) LDAP and LDAPS traffic from the database server to the LDAP server.
  2. Try to login with LDAP authentication.
Simulate slow LDAP server
  1. Run a network utility which accepts network connections but does not send a response, e.g. nc -l.
  2. Using the IP address and the port of the network utility, start the database with -LDAPServer=ldap://IP:PORT or with -LDAPServer=ldaps://IP:PORT.
  3. Try to login with LDAP authentication.

Workaround

Fix LDAP server/network/firewall.

How to identify

LDAP login attempts take a long time and fail eventually. Simultaneous non-LDAP login attempts take a long time and succeed eventually.

Fix

  • Issue mitigated by limiting the time a login attempt can take and thus block other login attempts.
  • No customer action necessary due to new default timeout.

Changed behavior

The database now supports a configurable LDAP authentication timeout. The default timeout value is 5 seconds. The timeout can be modified using the parameter -LDAPTimeoutInSeconds. A value of -1 disables the timeout (equivalent to the behavior of previous database versions). There is a new EXAoperation warning "LDAP bind failed" which is issued each time an LDAP authentication fails due to an unreachable server or a timeout.