title: Connection Timeout using LdapExtLoginModule
body: <p>I am attempting to authenticate users against an existing LDAP server (Active-Directory) using the LdapExtLoginModule provided by JBoss 4.2.3.  I have had some success connecting, but the LDAP server seems to be somewhat slow, and at certain times of the day I get consistent timeout issues.  I don't mind making my users wait for a while to be authenticated, but I haven't been able to increase the timeout duration.  See below for a list of settings I have tried in this vein.  Note that this is a web application built using Seam 2.</p>
  
  <p>Here is the relevant section of login-config.xml</p>
  
  <pre><code>&lt;application-policy name="LdapToActiveDirectory"&gt;
    &lt;authentication&gt;
      &lt;login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required"&gt;
  
        &lt;module-option name="debug"&gt;true&lt;/module-option&gt;
        &lt;module-option name="trace"&gt;true&lt;/module-option&gt;
  
        &lt;module-option name="java.naming.provider.url"&gt;ldap://domain.mycompany.net:389/&lt;/module-option&gt;
  
        &lt;module-option name="bindDN"&gt;CN=rsauth - RS Authentication Binding,OU=Service Accounts,OU=City,OU=US,DC=Domain,DC=MyCompany,DC=net&lt;/module-option&gt;
        &lt;module-option name="bindCredential"&gt;asdfjkl;&lt;/module-option&gt;
  
        &lt;module-option name="baseCtxDN"&gt;DC=Domain,DC=MyCompany,DC=net&lt;/module-option&gt;
        &lt;module-option name="baseFilter"&gt;(sAMAccountName={0})&lt;/module-option&gt;
  
        &lt;module-option name="rolesCtxDN"&gt;DC=Domain,DC=MyCompany,DC=net&lt;/module-option&gt;
        &lt;module-option name="roleFilter"&gt;(sAMAccountName={0})&lt;/module-option&gt;
        &lt;module-option name="roleAttributeID"&gt;memberOf&lt;/module-option&gt;
        &lt;module-option name="roleAttributeIsDN"&gt;true&lt;/module-option&gt;
        &lt;module-option name="roleNameAttributeID"&gt;cn&lt;/module-option&gt;
  
        &lt;module-option name="searchTimeLimit"&gt;100000&lt;/module-option&gt;
  
        &lt;module-option name="allowEmptyPasswords"&gt;false&lt;/module-option&gt;
  
        &lt;module-option name="java.naming.referral"&gt;follow&lt;/module-option&gt;
      &lt;/login-module&gt;
    &lt;/authentication&gt;
  &lt;/application-policy&gt;
  </code></pre>
  
  <p>Notice the "searchTimeLimit" option is set to 100,000 milliseconds.  However, when a timeout does occur, it seems to do so after only 20 seconds - way below the time limit specified.  Here is an example stack trace and log excerpt:</p>
  
  <pre><code>2011-07-08 12:50:31,692 TRACE [org.jboss.security.auth.spi.LdapExtLoginModule:122] initialize, instance=@1270783
  2011-07-08 12:50:31,692 TRACE [org.jboss.security.auth.spi.LdapExtLoginModule:125] Security domain: LdapToActiveDirectory
  2011-07-08 12:50:31,692 TRACE [org.jboss.security.auth.spi.LdapExtLoginModule:166] login
  2011-07-08 12:50:52,710 DEBUG [org.jboss.security.auth.spi.LdapExtLoginModule:216] Bad password for username=myuser
  javax.naming.CommunicationException: domain.mycompany.net:389 [Root exception is java.net.ConnectException: Connection timed out: connect]
      at com.sun.jndi.ldap.Connection.&lt;init&gt;(Connection.java:210)
      at com.sun.jndi.ldap.LdapClient.&lt;init&gt;(LdapClient.java:118)
      at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1580)
      at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2652)
      at com.sun.jndi.ldap.LdapCtx.&lt;init&gt;(LdapCtx.java:293)
      at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
      at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
      at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
      at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
      at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
      at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
      at javax.naming.InitialContext.init(InitialContext.java:223)
      at javax.naming.ldap.InitialLdapContext.&lt;init&gt;(InitialLdapContext.java:134)
      at org.jboss.security.auth.spi.LdapExtLoginModule.constructInitialLdapContext(LdapExtLoginModule.java:544)
      at org.jboss.security.auth.spi.LdapExtLoginModule.createLdapInitContext(LdapExtLoginModule.java:342)
      at org.jboss.security.auth.spi.LdapExtLoginModule.validatePassword(LdapExtLoginModule.java:232)
      at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:210)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
      at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
      at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
      at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
      at org.jboss.seam.security.Identity.authenticate(Identity.java:344)
      at org.jboss.seam.security.Identity.authenticate(Identity.java:332)
      at org.jboss.seam.security.Identity.login(Identity.java:259)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:335)
      at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:348)
      at org.jboss.el.parser.AstPropertySuffix.invoke(AstPropertySuffix.java:58)
      at org.jboss.el.parser.AstValue.invoke(AstValue.java:96)
      at org.jboss.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:276)
      at com.sun.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:68)
      at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:88)
      at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102)
      at javax.faces.component.UICommand.broadcast(UICommand.java:387)
      at org.ajax4jsf.component.AjaxViewRoot.processEvents(AjaxViewRoot.java:321)
      at org.ajax4jsf.component.AjaxViewRoot.broadcastEvents(AjaxViewRoot.java:296)
      at org.ajax4jsf.component.AjaxViewRoot.processPhase(AjaxViewRoot.java:253)
      at org.ajax4jsf.component.AjaxViewRoot.processApplication(AjaxViewRoot.java:466)
      at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:82)
      at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
      at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118)
      at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
      at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:40)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:178)
      at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:290)
      at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:368)
      at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:495)
      at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:56)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:60)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.jboss.seam.web.HotDeployFilter.doFilter(HotDeployFilter.java:53)
      at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
      at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:432)
      at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
      at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
      at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
      at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
      at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
      at java.lang.Thread.run(Thread.java:619)
  Caused by: java.net.ConnectException: Connection timed out: connect
      at java.net.PlainSocketImpl.socketConnect(Native Method)
      at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:333)
      at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:195)
      at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:182)
      at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:366)
      at java.net.Socket.connect(Socket.java:529)
      at java.net.Socket.connect(Socket.java:478)
      at java.net.Socket.&lt;init&gt;(Socket.java:375)
      at java.net.Socket.&lt;init&gt;(Socket.java:189)
      at com.sun.jndi.ldap.Connection.createSocket(Connection.java:352)
      at com.sun.jndi.ldap.Connection.&lt;init&gt;(Connection.java:187)
      ... 91 more
  2011-07-08 12:50:52,913 TRACE [org.jboss.security.auth.spi.LdapExtLoginModule:240] abort
  </code></pre>
  
  <p>In addition to the "searchTimeLimit" module option mentioned above, I have also tried setting some properties as command line arguments (reference <a href="http://download.oracle.com/javase/tutorial/jndi/newstuff/readtimeout.html" rel="nofollow">here</a>):</p>
  
  <pre><code>-Dcom.sun.jndi.ldap.read.timeout=100000
  -Dcom.sun.jndi.ldap.connect.timeout=100000
  </code></pre>
  
  <p>These also seemed to have no effect.</p>