After our 2.0 release, the javax.naming.ServiceUnavailableException has become more common.

As a workaround we've been suggesting the following configuration in the Crowd JAVA_OPTS (apache-tomcat/bin/setenv.sh).

-Dcom.sun.jndi.ldap.connect.pool.timeout=3

The fact that it has been working, points that the problem may be in the connection pool (or connections individually).

Another workaround that solved the problem was to start 'TCPMon' on AD-Server and listens on port 390 and pass the data to port 389 (use x.x.x.x:390 as URL in the Crowd-Directory Setup).

Unfortunately, I couldn't reproduce the problem locally.