User-ID XML API Response Time-out

[Greg_Brooks]

I'm working with the new LDAP User-ID XML API and things are going fairly well except for getting the response back from the agent after I make my updates.  Looking in the "Monitor" section of the agent and the Palo Alto itself, it is clear that my updates are working properly.  I just don't get the response message back across the HTTPS connection immediately after my update - it seems to take 10 minutes (the timeout for no data coming in) before I see the <uid-response> message.

I've tried in .NET code with the standard HttpWebRequest and HttpWebResponse classes.  My authentication program sync program is actually written in .NET and pulls the login/logout infromation that is in a SQL database populated by an enterprise-wide login script in our AD.  Then I broken down and started sending various web requests with Fiddler so I could try different tweaks to the request to see if anything would make the request come back immediately.

I've tried using "PUT", "POST", specifying the "Connection: Close" header, HTTP versions 1, 1.1, and 0.9.  I tried some other headers like "Content-type: text/xml", etc., and appending a "\r\n\r\n" to my data and it didn't have any effect.

I even tried the exact XML message from DOC-1348 just to make sure it wasn't something I had overlooked in the way I was formatting the message.  The 3 login IDs are now on my agent, but I still didn't get the reply back immediately.

So my question is what is the trick?  Are you guys able to use Fiddler to send a request and get the response message back immediately?

Thanks in advance,

Greg

[nrice]

Our LDAP User-ID engineer explains the following:

"The User-ID API will send the response immediately after it receives a complete <uid-message>....</uid-message>; however, the User-ID API uses the simple SSL connection, not the https protocol; if using the https, you may wait for the https response and timeout. If you use .NET, you can use the SSlStream class to implement the ssl connection."

[Greg_Brooks]

Thanks for the response.  I'll use an SSLStream and see if that gets me what I need.

[Greg_Brooks]

Yep.  SSLStream works great and I'm getting the response back immediately now.  My application is humming along now.  Thank you guys for providing this API to supply our own user data - it's exactly what we needed.

[khaldeman]

I'm posting this c# code because I've been looking all over for it and couldn't find a good example.  This post lead me to the right SslStream concept to get this working.  Anyhow, here it is.