SP-initiated SSO Setting up Single Sign-On Services

6-6 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Over time, the LDAP server may close some connections due to a long inactivity period, and if left unchecked, this can result in errors and a degradation of performance in Oracle Identity Federation. You can set an inactivity attribute that tells Oracle Identity Federation how long an LDAP connection should be kept in a pool before being removed due to inactivity. By default the inactivity timeout is set to 300 seconds. To set the inactivity settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation and set the following properties: ■ Set the ldapconnectioninactivitytimeout long property from the authnengines group to the inactivity timeout in seconds to configure the LDAP Authentication Engine Inactivity Timeout as in this example: setConfigPropertyauthnengines, ldapconnectioninactivitytimeout, 300, long ■ Set the userldapconnectioninactivitytimeout long property from the datastore group to the inactivity timeout in seconds to configure the LDAP user data store Inactivity Timeout as in this example: setConfigPropertydatastore, userldapconnectioninactivitytimeout, 300, long ■ Set the fedldapconnectioninactivitytimeout long property from the datastore group to the inactivity timeout in seconds to configure the LDAP Federation Data Store Inactivity Timeout as in this example: setConfigPropertydatastore, fedldapconnectioninactivitytimeout, 300, long

6.3.2 Configuring the LDAP Read Timeout Setting

When Oracle Identity Federation is integrated with LDAP servers for user data store, federation data store or LDAP authentication engine, the server communicates with the LDAP directory to retrieve user attributes, authenticate users, look up users and perform related operations. Sometimes, the LDAP server can become unresponsive, causing the threaduser to wait for a response or an error. To avoid waiting too long for an error when the server is not responding, Oracle Identity Federation sets a read timeout property on the LDAP connection: if the LDAP server does not respond before the read timeout period, an error is generated, Oracle Identity Federation closes the connection, opens a new one and re-issues the LDAP command. It is possible to set the read timeout setting to tell the Oracle Identity Federation server how long to wait for data from the LDAP server. By default the read timeout is set to 10 seconds. To set the read timeout settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation, and set the following properties if necessary examples are included: ■ Set the ldapconnectionreadtimeout long property from the authnengines group to the read timeout in seconds to configure the LDAP Authentication Engine Read Timeout: setConfigPropertyauthnengines, ldapconnectionreadtimeout, long, 10