We had similar, but slightly different behavior with the Optional *cas.authn.ldap[0].pool-passivator* property. https://apereo.github.io/cas/7.3.x/authentication/LDAP-Authentication.html
I see you have: #cas.authn.ldap[0].pool-passivator=NONE If I read the documentation correctly, you are not actually setting the property, but you could try activating it and switching it to BIND from NONE. With it not actually set due to the leading, #, it should be BIND by default. This may be different enough from our situation that it's a red herring, but worth a shot. -Mike On Thu, Jul 2, 2026 at 11:13 AM 'Ray Bon' via CAS Community < [email protected]> wrote: > William, > > Is your ldap be behind a load balancer? > Perhaps one host has incorrect data. > We have not experienced any problems with the upgrade. > > Ray > ------------------------------ > *From:* [email protected] <[email protected]> on behalf of William > Vincent (Wix31) <[email protected]> > *Sent:* July 2, 2026 02:47 > *To:* CAS Community <[email protected]> > *Subject:* [cas-user] CAS 7.3.x - Intermittent Unable to resolve user dn > errors during LDAP authentication after migrating from CAS 6.x > > You don't often get email from [email protected]. Learn why this is > important <https://aka.ms/LearnAboutSenderIdentification> > Hello, > > I am currently migrating from CAS 6.x to CAS 7.3.x and I am facing > intermittent LDAP authentication failures. > > Even though the LDAP server is up and the users exist in the directory, I > regularly get the following error: > > *[LdapAuthenticationHandler]: > [javax.security.auth.login.AccountNotFoundException: Unable to resolve user > dn for xxx/ Unable to resolve user dn for xxx]* > > In the logs even with DEBUG level, I only see: > > resultCode=NO_SUCH_OBJECT > > This happens randomly. Sometimes the same user can authenticate > successfully a few seconds later. > > Has anyone experienced similar intermittent NO_SUCH_OBJECT errors when > migrating to CAS 7.x? > Is there a recommended way to configure the LDAP connection pool in CAS > 7.3 to make it more resilient > > - I tried to configure the LDAP connection pool properly - I tried to > enabled `validate-periodically`, `prune-period`, and different validators. > - I also tried changing the LDAP authentication type from AUTHENTICATED to > DIRECT > > Thank you in advance for your help. > Best regards, > > My cas.properties ( i use CAS Overlay docker image ) : > > #======================================= > # Global > #======================================= > > # PRODUCTION > cas.host.name=x > cas.server.name=https://${cas.host.name} > cas.server.prefix=https://${cas.host.name}/cas > cas.logout.redirect-url=https://${cas.host.name}/cas/login > cas.audit.engine.alternate-client-addr-header-name=X-Forwarded-For > > logging.config=file:/etc/cas/config/log4j2_custom.xml > cas.authn.accept.enabled=false > cas.locale.default-value=fr > cas.logout.follow-service-redirects=true > cas.logout.redirect-parameter=service > cas.logout.confirm-logout=false > > #======================================== > # LDAP connection pool configuration > #======================================== > > # Credential to connect to LDAP > > # Ldap configuration > cas.authn.ldap[0].type=AUTHENTICATED > cas.authn.ldap[0].bind-dn=cn=x > cas.authn.ldap[0].bind-credential=x > cas.authn.ldap[0].ldap-url=ldaps://ldap.x > cas.authn.ldap[0].base-dn=ou=People,x > cas.authn.ldap[0].subtree-search=true > cas.authn.ldap[0].search-filter=uid={user} > > cas.authn.ldap[0].principal-attribute-list=cn,givenName,mail,sn,uid,displayName > # Pool > #cas.authn.ldap[0].pool-passivator=NONE > #cas.authn.ldap[0].disable-pooling=true > #cas.authn.ldap[0].max-pool-size=15 > #cas.authn.ldap[0].min-pool-size=3 > #cas.authn.ldap[0].block-wait-time=PT5S > # > ## Validation des connexions du pool > #cas.authn.ldap[0].validate-on-checkout=true > #cas.authn.ldap[0].validate-periodically=true > #cas.authn.ldap[0].validate-period=PT30S > #cas.authn.ldap[0].validate-timeout=PT5S > #cas.authn.ldap[0].validator.type=SEARCH > #cas.authn.ldap[0].validator.base-dn=ou=People,x > #cas.authn.ldap[0].validator.search-filter=(objectClass=*) > #cas.authn.ldap[0].validator.scope=OBJECT > # > ## Pruning > #cas.authn.ldap[0].idle-time=PT3M > #cas.authn.ldap[0].prune-period=PT2M > > > #======================================== > # Attribute Repository (Person Directory) > #======================================== > cas.authn.attribute-repository.ldap[0].ldap-url=ldaps://ldap.x > cas.authn.attribute-repository.ldap[0].bind-dn=cn=x > cas.authn.attribute-repository.ldap[0].bind-credential=x > cas.authn.attribute-repository.ldap[0].base-dn=ou=People,x > cas.authn.attribute-repository.ldap[0].search-filter=uid={user} > cas.authn.attribute-repository.ldap[0].attributes.cn=cn > cas.authn.attribute-repository.ldap[0].attributes.givenName=givenName > cas.authn.attribute-repository.ldap[0].attributes.mail=mail > cas.authn.attribute-repository.ldap[0].attributes.sn=sn > cas.authn.attribute-repository.ldap[0].attributes.uid=uid > cas.authn.attribute-repository.ldap[0].attributes.displayName=displayName > #pool > cas.authn.attribute-repository.ldap[0].validate-on-checkout=true > cas.authn.attribute-repository.ldap[0].validate-periodically=true > cas.authn.attribute-repository.ldap[0].validate-period=PT30S > cas.authn.attribute-repository.ldap[0].validator.base-dn=ou=x > cas.authn.attribute-repository.ldap[0].validator.type=SEARCH > > cas.authn.attribute-repository.ldap[0].validator.search-filter=(objectClass=*) > cas.authn.attribute-repository.ldap[0].validator.scope=OBJECT > # Pruning > cas.authn.attribute-repository.ldap[0].idle-time=PT3M > cas.authn.attribute-repository.ldap[0].prune-period=PT2M > #======================================== > # Sécurité DDOS / Brute force > #======================================== > > cas.authn.throttle.schedule.enabled=true > cas.authn.throttle.schedule.start-delay=PT10S > cas.authn.throttle.schedule.repeat-interval=PT60S > > # throttle Brute Force (pour limiter le nombre de tentative > d'authentification) > cas.authn.throttle.failure.threshold=1 > cas.authn.throttle.failure.range-seconds=3 > # pour throttle sur IP et l'username > # cas.authn.throttle.core.username-parameter=username > > # Throttle DDOS > cas.authn.throttle.bucket4j.blocking=true > cas.authn.throttle.bucket4j.enabled=true > cas.authn.throttle.bucket4j.bandwidth[0].duration=PT60S > cas.authn.throttle.bucket4j.bandwidth[0].capacity=50 > > #======================================== > # Old protocol > #======================================== > cas.view.cas2.v3-forward-compatible=true > > > #======================================== > # Authentication > #======================================== > password.policy.warnAll=false > cas.authn.policy.any.tryall=false > > > #======================================== > # Gestion des sessions > #======================================== > > ## Web Application Session > # server.servlet.session.timeout=PT30S > server.servlet.session.cookie.http-only=true > server.servlet.session.tracking-modes=COOKIE > > #======================================== > # Gestion des services > #======================================== > > cas.service-registry.json.location=file:/etc/cas/services > cas.service-registry.schedule.enabled=true > cas.service-registry.schedule.repeat-interval=PT30s > cas.service-registry.schedule.start-delay=PT15S > > #======================================== > # Gestion des tickets > #======================================== > > # stockage des tickets > cas.ticket.registry.redis.host=redis > cas.ticket.registry.redis.database=0 > cas.ticket.registry.redis.port=6379 > cas.ticket.registry.redis.timeout=2000 > cas.ticket.registry.redis.password=x > > # Temps de session > # 72000 = 20H / 36000 = 10H > # Ticket Granting Ticket (TGT) > cas.ticket.tgt.primary.max-time-to-live-in-seconds=72000 > cas.ticket.tgt.primary.time-to-kill-in-seconds=36000 > # remember me > cas.ticket.tgt.remember-me.enabled=true > cas.ticket.tgt.remember-me.time-to-kill-in-seconds=72000 > > > cas.tgc.crypto.enabled=true > #cas.tgc.crypto.encryption.key=x > #cas.tgc.crypto.signing.key=x > cas.tgc.crypto.encryption.key=x > cas.tgc.crypto.signing.key=x > cas.tgc.pin-to-session=true > cas.tgc.remember-me-max-age=-1 > cas.tgc.auto-configure-cookie-path=true > > cas.webflow.crypto.enabled=true > #cas.webflow.crypto.signing.key=x > #cas.webflow.crypto.encryption.key=x > cas.webflow.crypto.signing.key=x > cas.webflow.crypto.encryption.key=x > > cas.webflow.crypto.signing.keySize=512 > cas.webflow.crypto.encryption.keySize=16 > cas.webflow.crypto.alg=AES > > #======================================== > # OpenID Connect > #======================================== > > cas.authn.oidc.core.issuer=https://${cas.host.name}/cas/oidc > > cas.authn.oidc.jwks.file-system.jwks-file=file:///etc/cas/openid_connect_keystore.jwks > cas.authn.oauth.crypto.encryption.key=x > cas.authn.oauth.crypto.signing.key=x > cas.authn.oauth.access-token.crypto.encryption.key=x > cas.authn.oauth.access-token.crypto.signing.key=x > cas.authn.oauth.session-replication.cookie.crypto.enabled=true > cas.authn.oauth.session-replication.cookie.crypto.signing.key=x > cas.authn.oauth.session-replication.cookie.crypto.encryption.key=x > > #======================================== > # Theme Dev > #======================================== > cas.theme.default-theme-name=default > # décommenter pour tester le modifs html sans redémarrer tomcat > # spring.thymeleaf.cache=false > > #======================================== > # Monitoring / Actuator / Endpoint > #======================================== > > # on desactive tout par default > management.endpoints.access.default=none > > # On active les modules > management.endpoints.web.exposure.include=status > management.endpoint.status.enabled=true > > # Configuration URL + identifiants > management.endpoints.web.base-path=/xxxx > > #management.endpoints.web.exposure.include=health,info,metrics,prometheus,env,loggers,status > cas.monitor.endpoints.endpoint.status.access=AUTHENTICATED > cas.monitor.endpoints.endpoint.status.required-ip-addresses=xxxx > spring.security.user.name=xxx > spring.security.user.password=xxx > > #======================================== > # User Self MGT > #======================================== > #CasFeatureModule.AccountManagement.enabled=true > > > > > > -- > - Website: https://apereo.github.io/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/4903a35f-8a3b-44cf-a9d1-413c69bf977en%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/4903a35f-8a3b-44cf-a9d1-413c69bf977en%40apereo.org?utm_medium=email&utm_source=footer> > . > > -- > - Website: https://apereo.github.io/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB0081DD7D28F3A7EF57EC8439CEF52%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB0081DD7D28F3A7EF57EC8439CEF52%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM?utm_medium=email&utm_source=footer> > . > -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAEdMQHXhSXXrpmTXP8kFDpPr9VS2m9X_GB%3Dh4G_AfKOUR5VxNQ%40mail.gmail.com.
