Edit : I confirm that Passivator set to BIND finally works well in 7.x! Thanks everyone. Have a good day!
Le vendredi 3 juillet 2026 à 03:12:32 UTC+2, Mike Osterman a écrit : > We had similar, but slightly different behavior with the Optional > *cas.authn.ldap[0].pool-passivator* property. > https://apereo.github.io/cas/7.3.x/authentication/LDAP-Authentication.html > > I see you have: > #cas.authn.ldap[0].pool-passivator=NONE > > If I read the documentation correctly, you are not actually setting the > property, but you could try activating it and switching it to BIND from > NONE. With it not actually set due to the leading, #, it should be BIND by > default. > > This may be different enough from our situation that it's a red herring, > but worth a shot. > > -Mike > > On Thu, Jul 2, 2026 at 11:13 AM 'Ray Bon' via CAS Community < > [email protected]> wrote: > >> William, >> >> Is your ldap be behind a load balancer? >> Perhaps one host has incorrect data. >> We have not experienced any problems with the upgrade. >> >> Ray >> ------------------------------ >> *From:* [email protected] <[email protected]> on behalf of William >> Vincent (Wix31) <[email protected]> >> *Sent:* July 2, 2026 02:47 >> *To:* CAS Community <[email protected]> >> *Subject:* [cas-user] CAS 7.3.x - Intermittent Unable to resolve user dn >> errors during LDAP authentication after migrating from CAS 6.x >> >> You don't often get email from [email protected]. Learn why this is >> important <https://aka.ms/LearnAboutSenderIdentification> >> Hello, >> >> I am currently migrating from CAS 6.x to CAS 7.3.x and I am facing >> intermittent LDAP authentication failures. >> >> Even though the LDAP server is up and the users exist in the directory, I >> regularly get the following error: >> >> *[LdapAuthenticationHandler]: >> [javax.security.auth.login.AccountNotFoundException: Unable to resolve user >> dn for xxx/ Unable to resolve user dn for xxx]* >> >> In the logs even with DEBUG level, I only see: >> >> resultCode=NO_SUCH_OBJECT >> >> This happens randomly. Sometimes the same user can authenticate >> successfully a few seconds later. >> >> Has anyone experienced similar intermittent NO_SUCH_OBJECT errors when >> migrating to CAS 7.x? >> Is there a recommended way to configure the LDAP connection pool in CAS >> 7.3 to make it more resilient >> >> - I tried to configure the LDAP connection pool properly - I tried to >> enabled `validate-periodically`, `prune-period`, and different validators. >> - I also tried changing the LDAP authentication type from AUTHENTICATED to >> DIRECT >> >> Thank you in advance for your help. >> Best regards, >> >> My cas.properties ( i use CAS Overlay docker image ) : >> >> #======================================= >> # Global >> #======================================= >> >> # PRODUCTION >> cas.host.name=x >> cas.server.name=https://${cas.host.name} >> cas.server.prefix=https://${cas.host.name}/cas >> cas.logout.redirect-url=https://${cas.host.name}/cas/login >> cas.audit.engine.alternate-client-addr-header-name=X-Forwarded-For >> >> logging.config=file:/etc/cas/config/log4j2_custom.xml >> cas.authn.accept.enabled=false >> cas.locale.default-value=fr >> cas.logout.follow-service-redirects=true >> cas.logout.redirect-parameter=service >> cas.logout.confirm-logout=false >> >> #======================================== >> # LDAP connection pool configuration >> #======================================== >> >> # Credential to connect to LDAP >> >> # Ldap configuration >> cas.authn.ldap[0].type=AUTHENTICATED >> cas.authn.ldap[0].bind-dn=cn=x >> cas.authn.ldap[0].bind-credential=x >> cas.authn.ldap[0].ldap-url=ldaps://ldap.x >> cas.authn.ldap[0].base-dn=ou=People,x >> cas.authn.ldap[0].subtree-search=true >> cas.authn.ldap[0].search-filter=uid={user} >> >> cas.authn.ldap[0].principal-attribute-list=cn,givenName,mail,sn,uid,displayName >> # Pool >> #cas.authn.ldap[0].pool-passivator=NONE >> #cas.authn.ldap[0].disable-pooling=true >> #cas.authn.ldap[0].max-pool-size=15 >> #cas.authn.ldap[0].min-pool-size=3 >> #cas.authn.ldap[0].block-wait-time=PT5S >> # >> ## Validation des connexions du pool >> #cas.authn.ldap[0].validate-on-checkout=true >> #cas.authn.ldap[0].validate-periodically=true >> #cas.authn.ldap[0].validate-period=PT30S >> #cas.authn.ldap[0].validate-timeout=PT5S >> #cas.authn.ldap[0].validator.type=SEARCH >> #cas.authn.ldap[0].validator.base-dn=ou=People,x >> #cas.authn.ldap[0].validator.search-filter=(objectClass=*) >> #cas.authn.ldap[0].validator.scope=OBJECT >> # >> ## Pruning >> #cas.authn.ldap[0].idle-time=PT3M >> #cas.authn.ldap[0].prune-period=PT2M >> >> >> #======================================== >> # Attribute Repository (Person Directory) >> #======================================== >> cas.authn.attribute-repository.ldap[0].ldap-url=ldaps://ldap.x >> cas.authn.attribute-repository.ldap[0].bind-dn=cn=x >> cas.authn.attribute-repository.ldap[0].bind-credential=x >> cas.authn.attribute-repository.ldap[0].base-dn=ou=People,x >> cas.authn.attribute-repository.ldap[0].search-filter=uid={user} >> cas.authn.attribute-repository.ldap[0].attributes.cn=cn >> cas.authn.attribute-repository.ldap[0].attributes.givenName=givenName >> cas.authn.attribute-repository.ldap[0].attributes.mail=mail >> cas.authn.attribute-repository.ldap[0].attributes.sn=sn >> cas.authn.attribute-repository.ldap[0].attributes.uid=uid >> cas.authn.attribute-repository.ldap[0].attributes.displayName=displayName >> #pool >> cas.authn.attribute-repository.ldap[0].validate-on-checkout=true >> cas.authn.attribute-repository.ldap[0].validate-periodically=true >> cas.authn.attribute-repository.ldap[0].validate-period=PT30S >> cas.authn.attribute-repository.ldap[0].validator.base-dn=ou=x >> cas.authn.attribute-repository.ldap[0].validator.type=SEARCH >> >> cas.authn.attribute-repository.ldap[0].validator.search-filter=(objectClass=*) >> cas.authn.attribute-repository.ldap[0].validator.scope=OBJECT >> # Pruning >> cas.authn.attribute-repository.ldap[0].idle-time=PT3M >> cas.authn.attribute-repository.ldap[0].prune-period=PT2M >> #======================================== >> # Sécurité DDOS / Brute force >> #======================================== >> >> cas.authn.throttle.schedule.enabled=true >> cas.authn.throttle.schedule.start-delay=PT10S >> cas.authn.throttle.schedule.repeat-interval=PT60S >> >> # throttle Brute Force (pour limiter le nombre de tentative >> d'authentification) >> cas.authn.throttle.failure.threshold=1 >> cas.authn.throttle.failure.range-seconds=3 >> # pour throttle sur IP et l'username >> # cas.authn.throttle.core.username-parameter=username >> >> # Throttle DDOS >> cas.authn.throttle.bucket4j.blocking=true >> cas.authn.throttle.bucket4j.enabled=true >> cas.authn.throttle.bucket4j.bandwidth[0].duration=PT60S >> cas.authn.throttle.bucket4j.bandwidth[0].capacity=50 >> >> #======================================== >> # Old protocol >> #======================================== >> cas.view.cas2.v3-forward-compatible=true >> >> >> #======================================== >> # Authentication >> #======================================== >> password.policy.warnAll=false >> cas.authn.policy.any.tryall=false >> >> >> #======================================== >> # Gestion des sessions >> #======================================== >> >> ## Web Application Session >> # server.servlet.session.timeout=PT30S >> server.servlet.session.cookie.http-only=true >> server.servlet.session.tracking-modes=COOKIE >> >> #======================================== >> # Gestion des services >> #======================================== >> >> cas.service-registry.json.location=file:/etc/cas/services >> cas.service-registry.schedule.enabled=true >> cas.service-registry.schedule.repeat-interval=PT30s >> cas.service-registry.schedule.start-delay=PT15S >> >> #======================================== >> # Gestion des tickets >> #======================================== >> >> # stockage des tickets >> cas.ticket.registry.redis.host=redis >> cas.ticket.registry.redis.database=0 >> cas.ticket.registry.redis.port=6379 >> cas.ticket.registry.redis.timeout=2000 >> cas.ticket.registry.redis.password=x >> >> # Temps de session >> # 72000 = 20H / 36000 = 10H >> # Ticket Granting Ticket (TGT) >> cas.ticket.tgt.primary.max-time-to-live-in-seconds=72000 >> cas.ticket.tgt.primary.time-to-kill-in-seconds=36000 >> # remember me >> cas.ticket.tgt.remember-me.enabled=true >> cas.ticket.tgt.remember-me.time-to-kill-in-seconds=72000 >> >> >> cas.tgc.crypto.enabled=true >> #cas.tgc.crypto.encryption.key=x >> #cas.tgc.crypto.signing.key=x >> cas.tgc.crypto.encryption.key=x >> cas.tgc.crypto.signing.key=x >> cas.tgc.pin-to-session=true >> cas.tgc.remember-me-max-age=-1 >> cas.tgc.auto-configure-cookie-path=true >> >> cas.webflow.crypto.enabled=true >> #cas.webflow.crypto.signing.key=x >> #cas.webflow.crypto.encryption.key=x >> cas.webflow.crypto.signing.key=x >> cas.webflow.crypto.encryption.key=x >> >> cas.webflow.crypto.signing.keySize=512 >> cas.webflow.crypto.encryption.keySize=16 >> cas.webflow.crypto.alg=AES >> >> #======================================== >> # OpenID Connect >> #======================================== >> >> cas.authn.oidc.core.issuer=https://${cas.host.name}/cas/oidc >> >> cas.authn.oidc.jwks.file-system.jwks-file=file:///etc/cas/openid_connect_keystore.jwks >> cas.authn.oauth.crypto.encryption.key=x >> cas.authn.oauth.crypto.signing.key=x >> cas.authn.oauth.access-token.crypto.encryption.key=x >> cas.authn.oauth.access-token.crypto.signing.key=x >> cas.authn.oauth.session-replication.cookie.crypto.enabled=true >> cas.authn.oauth.session-replication.cookie.crypto.signing.key=x >> cas.authn.oauth.session-replication.cookie.crypto.encryption.key=x >> >> #======================================== >> # Theme Dev >> #======================================== >> cas.theme.default-theme-name=default >> # décommenter pour tester le modifs html sans redémarrer tomcat >> # spring.thymeleaf.cache=false >> >> #======================================== >> # Monitoring / Actuator / Endpoint >> #======================================== >> >> # on desactive tout par default >> management.endpoints.access.default=none >> >> # On active les modules >> management.endpoints.web.exposure.include=status >> management.endpoint.status.enabled=true >> >> # Configuration URL + identifiants >> management.endpoints.web.base-path=/xxxx >> >> #management.endpoints.web.exposure.include=health,info,metrics,prometheus,env,loggers,status >> cas.monitor.endpoints.endpoint.status.access=AUTHENTICATED >> cas.monitor.endpoints.endpoint.status.required-ip-addresses=xxxx >> spring.security.user.name=xxx >> spring.security.user.password=xxx >> >> #======================================== >> # User Self MGT >> #======================================== >> #CasFeatureModule.AccountManagement.enabled=true >> >> >> >> >> >> -- >> - Website: https://apereo.github.io/cas >> - List Guidelines: https://goo.gl/1VRrw7 >> - Contributions: https://goo.gl/mh7qDG >> --- >> You received this message because you are subscribed to the Google Groups >> "CAS Community" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion visit >> https://groups.google.com/a/apereo.org/d/msgid/cas-user/4903a35f-8a3b-44cf-a9d1-413c69bf977en%40apereo.org >> >> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/4903a35f-8a3b-44cf-a9d1-413c69bf977en%40apereo.org?utm_medium=email&utm_source=footer> >> . >> >> -- >> - Website: https://apereo.github.io/cas >> - List Guidelines: https://goo.gl/1VRrw7 >> - Contributions: https://goo.gl/mh7qDG >> --- >> You received this message because you are subscribed to the Google Groups >> "CAS Community" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> > To view this discussion visit >> https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB0081DD7D28F3A7EF57EC8439CEF52%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM >> >> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB0081DD7D28F3A7EF57EC8439CEF52%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM?utm_medium=email&utm_source=footer> >> . >> > -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/eac01b69-eaa8-4229-a17b-5be433558479n%40apereo.org.
