{"id":46960,"date":"2026-09-22T15:21:39","date_gmt":"2026-09-22T13:21:39","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=46960"},"modified":"2026-09-22T15:21:41","modified_gmt":"2026-09-22T13:21:41","slug":"oracle-ldap-timeouts","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/oracle-ldap-timeouts\/","title":{"rendered":"Oracle LDAP Timeouts"},"content":{"rendered":"\n

Introduction, Setup<\/h2>\n\n\n\n

You are using 2 or more LDAP servers for Oracle name resolution to be highly available?
Do you kown what happens if an ldap server is down or not reachable? You probably expect that it tries the next one?<\/p>\n\n\n\n

Short answer: Yes, but probably not with a behavior you expect…<\/p>\n\n\n\n

Let’s see my test configuration There are 2 ldap servers ol9a and ol9b. For the setup, see my former blog post: Setup an LDAP server for Oracle naming on Enterprise Linux 9<\/a><\/p>\n\n\n\n

# ldap.ora\nDIRECTORY_SERVERS=(ol9a:389:636,ol9b:389:636)\nDEFAULT_ADMIN_CONTEXT = \"dc=dbi-services,dc=com\"\nDIRECTORY_SERVER_TYPE = OID<\/code><\/pre>\n\n\n\n
# sqlnet.ora\nNAMES.DEFAULT_DOMAIN=dbi-services.com\nNAMES.DIRECTORY_PATH=(LDAP)<\/code><\/pre>\n\n\n\n
With NAMES.DIRECTORY_PATH=(LDAP)<\/code> we enforce to only use LDAP. Often, you will allow other methods like (LDAP,TNSNAMES,EZCONNECT)<\/code>. Oracle tries the name resolution in this order. <\/p>\n\n\n\n
Tests with an Oracle client installation (tnsping)<\/h2>\n\n\n\n
Now let’s see what happens if ldap is not reachable. Note the difference: “server” refers to the ldap server process, “host” refers to the machine on which the ldap server runs (If the server is up, then logically the host is also up). “down” of a host is from the Oracle-client’s point of view and means that it is unreachable (will not respond), regardless of whether it is a host problem or just a network interruption. “1st” means the 1st host\/server in the DIRECTORY_SERVERS parameter (in the example ora9a).<\/p>\n\n\n
\ntime tnsping DB1970\n<\/pre><\/div>\n\n\n
We remember: the order is DIRECTORY_SERVERS=(ol9a:389:636,ol9b:389:636)<\/code><\/p>\n\n\n\n
Both up<\/h3>\n\n\n\n
If both ldap servers are up, we get an answer in a fraction of a second (as expected).<\/p>\n\n\n\n
2nd down<\/h3>\n\n\n\n
If the 2nd server\/host (ora9b) is down, we get an answer in a fraction of a second. I repeated this test several times, and it always responds immediately. That means, there is no round-robin selection of the servers in place.<\/p>\n\n\n\n
1st down<\/h3>\n\n\n\n
if the 1st ldap server on ora9a is down (the process, not the host), we get the answer within a fraction of a second from ora9b. the Oracle client immediately detects that there is no ldap server running (error “Connection refused” on ldap port). <\/p>\n\n\n\n
But if the host itself does not respond (stopped, network interruption), then the Oracle client has to wait for a timeout and that is usually more than 10 seconds. Did you expect that? Most customers have never noticed this problem as they have never had an LDAP host failure. <\/p>\n\n\n
\nUsed LDAP adapter to resolve the alias\nAttempting to contact (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=ltp14s-i)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=DB1970A.erfinder)))\nOK (30 msec)\n\nreal    0m15.090s\n<\/pre><\/div>\n\n\n
Is that acceptable for your application to wait for >10 seconds? For an interactive login once a day, it is annoying, but probably OK. But with applications that make thousands of short-term logins? In the worst case, the application will get a timeout.<\/p>\n\n\n\n
Configuration optimization<\/h2>\n\n\n\n
Can we get around this long timeout? Yes, we can. Add the following parameter to sqlnet.ora:<\/p>\n\n\n\n
NAMES.LDAP_CONN_TIMEOUT=1  #value in seconds<\/code><\/pre>\n\n\n
\ntime tnsping db1970\n\nTNS Ping Utility for Linux: Version 19.0.0.0.0 - Production on 18-SEP-2026 16:46:37\n\nCopyright (c) 1997, 2019, Oracle.  All rights reserved.\n\nUsed parameter files:\n\/u00\/app\/oracle\/network\/admin\/ldap\/sqlnet.ora\n\nUsed LDAP adapter to resolve the alias\nAttempting to contact (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=ltp14s-i)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=DB1970A)))\nOK (10 msec)\n\nreal    0m1.040s\n<\/pre><\/div>\n\n\n
Note: the timeouts may have some variations (after a few calls, the timeout was reduced to about 3 seconds for me). 
The value OK (10 msec)<\/code> refers only to the time for the listener connect, not for the name resolution. The output of time<\/code> includes the total time of the tnsping execution.<\/p>\n\n\n\n
Conclusion:<\/h3>\n\n\n\n