# Read\_timeout setting for LDAP doesn't seem to change the read timeout
**URL:** https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [February 15, 2016, 9:14pm UTC](https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820 "2016-02-15T21:14:31Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@wnagy](https://discuss.elastic.co/u/wnagy)
#### Post date: [February 15, 2016, 9:14pm UTC](https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820/1 "2016-02-15T21:14:31Z")
I encountered a timeout with the LDAP server that I'm using when Shield is attempting to fetch the groups (the user lookup functions properly.) I attempted to increase the timeout to see if that would fix my issue, but it seems that the setting is being ignored (each time the error message says 5000ms, no matter what I attempt to configure it as.)
Here is the error that I'm seeing:
[2016-02-15 10:30:01,849][WARN][shield.authc.ldap] [Cecilia Reyes] authentication failed for user [xxx]: could not search for LDAP groups for DN [uid=aaaa,c=bb,ou=cccc,o=ddd]
cause: com.unboundid.ldap.sdk.LDAPSearchException: A client-side timeout was encountered while waiting 5000ms for a response to search request with message ID 1, base DN 'ou=eeee,ou=ffff,o=ddd', scope SUB, and
filter '(&(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=group))(|(uniqueMember=uid=aaaa,c=bb,ou=cccc,o=ddd)(member=uid=aaaa,c=bb,ou=cccc,o=ddd)))' from server yyyy:636.
and here is the relevant section from my elasticsearch.yml file:
shield:
authc:
realms:
ldap1:
type: ldap
order: 0
url: "ldaps://yyyy:636"
connect\_timeout: 30s
read\_timeout: 30s
user\_search:
base\_dn: "ou=cccc, o=ddd"
attribute: mail
pool:
health\_check:
enabled: false
group\_search:
base\_dn: "ou=eeee,ou=ffff,o=ddd"
unmapped\_groups\_as\_roles: false
I'm running ES 2.2.0 with the latest Shield plugin.
Thanks.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [February 16, 2016, 2:16pm UTC](https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820/2 "2016-02-16T14:16:04Z")
I believe we may have the settings documented incorrectly. Can you try:
`timeout.tcp_read` instead of read\_timeout and `timeout.tcp_connect` instead of connect\_timeout.
---
### Author:  [@wnagy](https://discuss.elastic.co/u/wnagy)
#### Post date: [February 16, 2016, 6:28pm UTC](https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820/3 "2016-02-16T18:28:45Z")
Thanks. Using those parameters appears to have eliminated that particular error message, although I'm now getting a
[2016-02-16 11:09:49,125][WARN][shield.authc.ldap] [Scrier] authentication failed for user [xxx]: could not search for LDAP groups for DN [uid=aaaa,c=bb,ou=cccc,o=ddd]
cause: com.unboundid.ldap.sdk.LDAPSearchException: time limit exceeded
, but I suspect that's coming from the server and not the client.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [February 16, 2016, 9:22pm UTC](https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820/4 "2016-02-16T21:22:40Z")
We ask the server to restrict the length of ldap search requests by default to 5s. You should be able to specify `timeout.ldap_search` to control this behavior
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/read-timeout-setting-for-ldap-doesnt-seem-to-change-the-read-timeout/41820/5 "2017-07-06T13:46:46Z")