[closed] Logging into JTS, RTC, RQM using LDAP authentication takes about 10 mins

Sorry for reviving this old thread but I would like to add it here for other users searching for this as this was the only post found with this issue. 

Thank you Enrique for your reply.

Our solution:
We have used jumbo frames in this problematic environment running in docker. We have downsized it back to 1500 MTU and now it works as it should.

I don't see this behavior for my dozens of Jazz applications also authenticating to the same LDAP.   LDAP really ought to be configured to LDAPS ( port 636 ).  One cannot infer your choice of J2EE container from the above (i.e. Tomcat, WAS or WAS Liberty ) so I can't advise further except to verify that you use these settings for lookups

This is a summary of LDAP Realm configured in WebSphere ( Security / Global Security )

Type: Custom
Host: bluepages.ibm.com
Port: 636

SSL Enabled: checked

Base DN: o=ibm.com

User Filter: (&(preferredIdentity=%v)(objectclass=ePerson))
Group Filter: (&(cn=%v)(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)))
User ID Map: :preferredIdentity
Group ID Map: :cn
Group Member ID Map: ibm-allGroups:member;ibm-allGroups:uniqueMember

The server.xml is basically identical to the server.xml from other RTC servers not having this issue.  Here are the relevant contents of my server.xml:
<!-- Define a non-SSL HTTP/1.1 Connector on port 9080 -->
    <Connector URIEncoding="UTF-8" acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" port="9080" redirectPort="9443" sslEnabledProtocols="${jazz.connector.sslEnabledProtocols}"/>

<!-- Define a SSL HTTP/1.1 Connector on port 9443 -->
 <Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" algorithm="${jazz.connector.algorithm}" clientAuth="false" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" keystoreFile="ibm-team-ssl.keystore" keystorePass="ibm-team" maxHttpHeaderSize="8192" maxThreads="500" minSpareThreads="25" port="9443" scheme="https" secure="true" sslEnabledProtocols="${jazz.connector.sslEnabledProtocols}"/>

<!-- Define an AJP 1.3 Connector on port 9009 -->
    <Connector enableLookups="false" port="9009" protocol="AJP/1.3" redirectPort="9443" sslEnabledProtocols="${jazz.connector.sslEnabledProtocols}"/>

<Realm adCompat="true" className="org.apache.catalina.realm.JNDIRealm" connectionURL="ldap://bluepages.ibm.com:389" debug="9" digest="SHA-1" digestEncoding="UTF-8" roleBase="ou=memberlist,ou=ibmgroups,o=ibm.com" roleName="cn" roleSearch="(uniquemember={0})" roleSubtree="false" userBase="ou=bluepages,o=ibm.com" userSearch="(mail={0})" userSubtree="true"/>


Here's the output from Catalina.out.   I restarted the Tomcat server at 11:36am and by 1:48pm the ServiceUnavailableException shows up.
Jul 07, 2017 11:36:02 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 49427 ms
Jul 07, 2017 1:48:17 PM org.apache.catalina.realm.JNDIRealm authenticate
INFO: Exception performing authentication. Retrying...
javax.naming.ServiceUnavailableException: bluepages.ibm.com:389; socket closed; remaining name 'ou=bluepages,o=ibm.com'
        at com.sun.jndi.ldap.Connection.readReply(Connection.java:479)
        at com.sun.jndi.ldap.LdapClient.getSearchReply(LdapClient.java:651)
        at com.sun.jndi.ldap.LdapClient.search(LdapClient.java:574)
        at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1999)
        at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1861)
        at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1786)
        at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:399)
        at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:369)
        at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:352)
        at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:279)
        at org.apache.catalina.realm.JNDIRealm.getUserBySearch(JNDIRealm.java:1490)
        at org.apache.catalina.realm.JNDIRealm.getUser(JNDIRealm.java:1326)
        at org.apache.catalina.realm.JNDIRealm.getUser(JNDIRealm.java:1274)
        at org.apache.catalina.realm.JNDIRealm.authenticate(JNDIRealm.java:1215)
        at org.apache.catalina.realm.JNDIRealm.authenticate(JNDIRealm.java:1073)
        at org.apache.catalina.authenticator.FormAuthenticator.authenticate(FormAuthenticator.java:294)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:452)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:312)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1157)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:627)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:809)

Looking back to a now ancient (circa 2011) Tomcat Jazz configuration, this is the Realm snippet in use then:

         <Realm className="org.apache.catalina.realm.JNDIRealm"
           debug="9"
           protocol="ssl"
           connectionURL="ldaps://bluepages.ibm.com:636"
           userBase="ou=bluepages,o=ibm.com"
           userSearch="(emailaddress={0})"
           userSubtree="true"
           roleBase="ou=memberlist,ou=ibmgroups,o=ibm.com"
           roleSubtree="false"
           roleSearch="(uniquemember={0})"
           roleName="cn"
          />

There are security requirements that state LDAPS must be used in authentication step.  

 Hello,

Have you been able to solve this issue please?
We are facing the same issues at our customers.
We have multiples environments, some with JAS some not.
One environment has the same configuration as others yet it takes like 1-2 minutes until the user get authenticated and logged in.