Configuring LDAP Retry Policy in Identity Security Platform (IDSP)

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

When IDSP interacts with an LDAP directory, temporary network glitches or service interruptions can trigger retriable exceptions. Common indicators in the logs include:

• javax.naming.CommunicationException

• store.exceptions.RetriableException

By defining a retry policy, you can improve system resilience, allowing IDSP to automatically recover from these brief outages without manual intervention or service failure.

Environment

Identity Security Platform (IDSP)

Release: 4.0

Cause

LDAP Connection Pool Idle Timeout has expired.

Resolution

You can define the retry behavior by configuring specific environment parameters via Helm (the Kubernetes Package Manager). These parameters control how many times the system attempts to reconnect and the interval between those attempts.

Configuration Parameters

Update your values.yaml or use the --set flag during deployment to include the following variables:

Implementation Example

To configure the system to retry 5 times with a 3-second pause between attempts, apply the following settings:

1. RETRY_MAX_ATTEMPTS=5 If a retriable exception persists, IDSP will try the operation up to 5 times before officially reporting a failure.

2. RETRY_WAIT_DURATION_MILLIS=3000 The system will wait 3000ms (3 seconds) after a failure before triggering the next retry attempt.

Note: Ensure you restart the relevant pods after updating your Helm configuration to apply these changes.

Parameter	Description
RETRY_MAX_ATTEMPTS	The maximum number of times IDSP will re-attempt the LDAP operation.
RETRY_WAIT_DURATION_MILLIS	The wait time (in milliseconds) between each consecutive retry attempt.