LDAP works but after 5 minutes queries throw "The LDAP server is unavailable " #90024
Comments
|
Tagging subscribers to this area: @dotnet/area-system-directoryservices, @jay98014 Issue DetailsDescriptionI am trying to use the This was hard to test locally so I replicated the issue in a background service to test the behavior. What I see is initially a query works, then again after 5 minutes it still works, but then after 6 minutes it throws I have tried customizing the ldapConnection.SessionOptions.AutoReconnect = true;which immediately throws I also tried setting "connectionless" new LdapDirectoryIdentifier("dc.domani.net", fullyQualifiedDnsHostName: true, connectionless: true),which immediately throws If someone could fill me in on how I could get this to work for the lifetime of the app I would be grateful, Happy to provide any additional details as required. Reproduction Stepsusing System.DirectoryServices.Protocols;
using System.Net;
namespace Some.Api.BackgroundServices;
public class LdapBackgroundService : BackgroundService
{
private readonly ILogger<LdapBackgroundService> _logger;
public LdapBackgroundService(ILogger<LdapBackgroundService> logger)
{
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
}
protected override async Task ExecuteAsync(CancellationToken stoppingToken)
{
var ldapConnection = new LdapConnection(
new LdapDirectoryIdentifier("dc.domain.net"),
//new LdapDirectoryIdentifier("dc.domain.net", fullyQualifiedDnsHostName: true, connectionless: true), // immediately throws: A bad parameter was passed to a routine
new NetworkCredential(@"DOMAIN\user", "password"), AuthType.Basic);
ldapConnection.SessionOptions.ReferralChasing = ReferralChasingOptions.None;
//ldapConnection.SessionOptions.AutoReconnect = true; // immediately throws: The LDAP server is unavailable.
ldapConnection.Bind();
var t = TimeSpan.FromMinutes(5);
while (!stoppingToken.IsCancellationRequested)
{
string searchFilter = String.Format("(&(objectClass=user)(SamAccountName={0}))", "scottm");
string userStore = "OU=ProductionDev,OU=Development,OU=Standard,OU=Users,OU=Root,DC=domain,DC=net";
SearchRequest searchRequest = new SearchRequest
(userStore,
searchFilter,
System.DirectoryServices.Protocols.SearchScope.Subtree,
new string[] { "DistinguishedName" });
var response = (SearchResponse)ldapConnection.SendRequest(searchRequest);
string userDN = response.Entries[0].Attributes["DistinguishedName"][0].ToString();
_logger.LogWarning($"scottm is: {userDN}, waiting {t.TotalMinutes} mins");
await Task.Delay(t);
t = t.Add(TimeSpan.FromMinutes(1));
}
}
}Note this is running in docker on apt-get install -y krb5-user libldap-2.4-2Expected behaviorThe ldap connection should always work for any request coming into asp.net (or in the case of this reproduction for every iteration of the loop) Actual behaviorRegression?No response Known WorkaroundsNo response Configuration#cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
# dotnet --list-runtimes
Microsoft.AspNetCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]Other informationSimilar issues here was closed due to inactivity dotnet/aspnetcore#49105
|
|
Just for context, Here is where Bind is called in the Microsoft.AspNetCore.Authentication.Negotiate library. It will only ever be invoked once which suggests the connection should either persist or recover. |
|
Was Debian the only environment this was tested\failed on? Have any others been tried? Trying to narrow down the scope a bit. |
steveharter
added
needs-author-action
|
This issue has been marked |
|
I just tried the same test on This I imagine is expected. I will see If I can make a Dockerfile for another distro |
ghost
added
needs-further-triage
|
Looking in to building on alpine it seems that the only docker images available wont be able to install the required version of ldap. only 2.6+ is available https://pkgs.alpinelinux.org/packages?name=libldap&branch=v3.17&repo=&arch=&maintainer= likewise with ubuntu only 2.5-0 is available # apt-cache madison libldap-2.5-0
libldap-2.5-0 | 2.5.15+dfsg-0ubuntu0.22.04.1 | https://repo jammy-updates/main amd64 Packages
libldap-2.5-0 | 2.5.11+dfsg-1~exp1ubuntu3 | https://repo jammy/main amd64 Packages
# apt-cache madison libldap-2.4-2
#
|
@mrhockeymonkey looks your issue is related to #69456 which we resolved recently, the fix will be shipped in .NET 8, there is also workarounds you can find from the issue. Closing this issue as dup of #69456 |
|
Well that version issue isn't the issue I originally raised... that was just some related test to narrow down the problem. But I am happy to wait for a .NET 8 docker image and try my original problem (connection timing out and not being re-established) out again to see what happens. I can always reopen this is the issue persists. |
|
The original issue you raised doesn't look like directly related to runtime, thanks for narrowing down the problem. Yes, please reopen the issue or file a new issue with your findings if #69456 did not fix your original issue. |
ghost
locked as resolved and limited conversation to collaborators
Description
I am trying to use the
Microsoft.AspNetCore.Authentication.Negotiatelibrary in an asp.net application that runs on Debian. The setup works perfectly initially but after about 5 minutes any subsequent requests throwThis was hard to test locally so I replicated the issue in a background service to test the behavior. What I see is initially a query works, then again after 5 minutes it still works, but then after 6 minutes it throws
I have tried customizing the
LdapConnectionwith AutoReconnectwhich immediately throws
I also tried setting "connectionless"
which immediately throws
If someone could fill me in on how I could get this to work for the lifetime of the app I would be grateful, Happy to provide any additional details as required.
Reproduction Steps
Note this is running in docker on
aspnet:7.0-bullseye-slimwith these packages installed
Expected behavior
The ldap connection should always work for any request coming into asp.net (or in the case of this reproduction for every iteration of the loop)
Actual behavior
Regression?
No response
Known Workarounds
No response
Configuration
Other information
Similar issues here was closed due to inactivity dotnet/aspnetcore#49105
The text was updated successfully, but these errors were encountered: