-
Title
mod_auth_vas LDAP_OPERATIONS_ERROR -
Description
LDAP errors causing Apache to hang. The process count will increase until the server becomes unresponsive. Need to stop and start the Apache server. A restart does not get rid of all of the stale processes
-
Cause
Product Defect: 23459
Issue occurs with QAS 3.5.2.80 and lower and QAS 4.0.1
What is happening is QAS code is establishing a connection to AD we call an LD. It is an encrypted connectiont that can be re-used. And QAS will re-use it. But this issue is when AD closes the connection on its end. W2008 does that more often. Older windows did it as well, but not as frequently. QAS wasn't handling the error properly. It was returing the LDAP operation issue, while now it re-establishes the connection on error. QAS itself (vasd) had its own old LD cleanup code so didn't suffer from this. It preemtivily closed down connections ( LDs ) that hadn't been used in the last two minutes.We have seen this issue with Mod-Auth-Vas (MAV) for use with Apache Server and then this case with the proxy -
Resolution
WORKAROUND:
1 - Edit the mod_auth_vas.c file in the source and change the "return" to "goto finish" like in the below:
diff --git a/mod_auth_vas.c b/mod_auth_vas.c
index 0ba17a3..abf23bd 100644
--- a/mod_auth_vas.c
+++ b/mod_auth_vas.c
@@ -2616,11 +2616,11 @@ set_remote_user_attr(request_rec *r, const char *attr)
LOG_RERROR(APLOG_DEBUG, 0, r,
"%s: reinitializing server credentials", __func__);
if (get_server_creds(r->server) != OK)
- return;
+ goto finish;
}
if (set_user_obj(r))
- return;
+ goto finish;
/* Look for attributes that are likely to be in the vas cache */
{2 - Then compile MAVRESOLUTIONUpgrade to 3.5.2 maintenance release or 4.0.3 maintenance releaseMAV and all One Identity open source projects are supported through One Identity GitHub issues and the One Identity Community. For assistance with any One Identity GitHub project, please raise a new Issue on the One Identity GitHub project page. You may also visit the One Identity Community to ask questions. Requests for assistance made through official One Identity Support will be referred back to GitHub and the One Identity Community forums where those requests can benefit all users.
Main MAV GitHub page:
https://github.com/OneIdentity/mod_auth_vas
Latest MAV Packages:
https://github.com/OneIdentity/mod_auth_vas/releases
Open a MAV Issue:
https://github.com/OneIdentity/mod_auth_vas/issues
MAV Wiki:
https://github.com/OneIdentity/mod_auth_vas/wiki -
Change Request
RC bug 794