[SOLVED] LDAP autofailover configuration

custangro · 05-13-2009, 01:18 PM

Hello,

So I've set up an LDAP enviroment (using Fedora Directory Server....they are going to call it 389 Directory Server now for some reason...but anyway) for my servers to get login information...

I used the authconfig command to set this up...

Code:

root@host# authconfig --enableldap --enableldapauth --enablemkhomedir --ldapserver=ldap1.example.com --ldapbasedn="dc=example,dc=com" --update

This works perfectly and all machines (about 25) are using this LDAP server for login information.

So since 25 machines are depending on this ldap server I decided to put ldap2.example.com into production and I have a replication working (and all that is working fine).

So here is my question:

What if ldap1.example.com where to fail (as all machines do fail at one point or another)?

I would have too manually go to each machine and change LDAP server.

Is there anyway to have an "auto failover"? i.e. If ldap1.example.com would to go "offline" the host would "automagically" look for ldap2.example.com

Is this possible?

(I'm using Centos 5.3 with Fedora Directory Server...aka CDS)

-C

custangro · 05-13-2009, 01:53 PM

Looks like I should have RTFM...

(man ldap.conf)

Code:

OPTIONS
       The configuration options are case-insensitive; their value, on a case by case basis, may be case-sensitive.  The different con-
       figuration options are:

       URI <ldap[s]://[name[:port]] ...>
              Specifies the URI(s) of an LDAP server(s) to which the LDAP library should connect.  The URI scheme may be either ldap or
              ldaps  which  refer  to  LDAP  over  TCP  and LDAP over SSL (TLS) respectively.  Each server’s name can be specified as a
              domain-style name or an IP address literal.  Optionally, the server’s name can followed by a ’:’ and the port number  the
              LDAP  server  is  listening on.  If no port number is provided, the default port for the scheme is used (389 for ldap://,
              636 for ldaps://).  A space separated list of URIs may be provided.

I will play with this for a while and post my results since I'm probably not the only one with this question

-C

acid_kewpie · 05-13-2009, 01:55 PM

guess who....?

Just specify multiple servers in your ldap.conf. Off hand I think you just separate them with spaces on a single line.

If you don't want that then you'd want to look at a vip across the two boxes, or a load balancer out front, but with this lower level sort of access i'd encourage pushing the resiliency as far back to the client as possible, even though it will cause some slightly undesirable delays during the failover and such, as it makes the architecture much simpler.

acid_kewpie · 05-13-2009, 01:58 PM

I quite like the name change actually, not that i'd heard about it until now. means CentOS won't rebrand at all, etc.

custangro · 05-13-2009, 02:02 PM

Quote:

Originally Posted by acid_kewpie

guess who....?

Just specify multiple servers in your ldap.conf. Off hand I think you just separate them with spaces on a single line.

If you don't want that then you'd want to look at a vip across the two boxes, or a load balancer out front, but with this lower level sort of access i'd encourage pushing the resiliency as far back to the client as possible, even though it will cause some slightly undesirable delays during the failover and such, as it makes the architecture much simpler.

Thanks!

Actually I'm not interested in "load balancing"...just the failover.

I will play around with some scenarios and see if I get the desired results...

-C

custangro · 05-13-2009, 02:03 PM

Quote:

Originally Posted by acid_kewpie

I quite like the name change actually, not that i'd heard about it until now. means CentOS won't rebrand at all, etc.

Yeah, now that I think about it...the rebranding will be easier...since there won't be a need to rebrand

custangro · 05-13-2009, 02:05 PM

Quote:

Originally Posted by acid_kewpie

guess who....?

Just specify multiple servers in your ldap.conf. Off hand I think you just separate them with spaces on a single line.

If you don't want that then you'd want to look at a vip across the two boxes, or a load balancer out front, but with this lower level sort of access i'd encourage pushing the resiliency as far back to the client as possible, even though it will cause some slightly undesirable delays during the failover and such, as it makes the architecture much simpler.

Quick question...

Is it possible to specify more than one ldap server in the authconfig command? Or am I better off manually editing the /etc/ldap.conf file?

-C

acid_kewpie · 05-13-2009, 02:21 PM

both is fine, it's a direct string replacement from the tool, really dumb.

ramram29 · 05-14-2009, 03:24 PM

Quote:

Originally Posted by custangro

Thanks!

Actually I'm not interested in "load balancing"...just the failover.

I will play around with some scenarios and see if I get the desired results...

-C

Use heartbeat

acid_kewpie · 05-14-2009, 04:09 PM

Quote:

Originally Posted by custangro

Thanks!

Actually I'm not interested in "load balancing"...just the failover.

I will play around with some scenarios and see if I get the desired results...

-C

Load balancing stuff like this is nice. It proves that all available instances of a service are functional. What use is a failover scenario if the box you fail over to is broked, but you don't know because nothing has used it for months? It's not always about handling large volumes.

custangro · 05-14-2009, 04:39 PM

Quote:

Originally Posted by acid_kewpie

Load balancing stuff like this is nice. It proves that all available instances of a service are functional. What use is a failover scenario if the box you fail over to is broked, but you don't know because nothing has used it for months? It's not always about handling large volumes.

I know it's probably worth looking into...

We have a F5 BigIP...I wonder if that will do it? I'll talk to my networking guy for some more info...

-C

acid_kewpie · 05-15-2009, 04:27 AM

Oh man, i live for F5's... hell yeah that'll do an awesome job, network admins shouldn't own them though... have it doing a search against both servers every minute or so with observed load balancing, lovely. Exactly what we have where I work.

custangro · 05-16-2009, 11:06 AM

Quote:

Originally Posted by acid_kewpie

Oh man, i live for F5's... hell yeah that'll do an awesome job, network admins shouldn't own them though... have it doing a search against both servers every minute or so with observed load balancing, lovely. Exactly what we have where I work.

Sorry, I can't do it all you know

So I did some tests...and just an FYI...this syntax works perfectly...

Code:

authconfig --enableldap --enableldapauth --enablemkhomedir --ldapserver=ldap1.example.com,ldap2.example.com --ldapbasedn="dc=example,dc=com" --update

Anyway; So I used the above on my client and I shutdown ldap1.example.com and it took...I dunno...half a second (and I'm rounding it up) to "failover". Which isn't bad...but I think that I will still utilize the F5 (since it's there and I can use it...I might as well do it "right" on roll-out

)

Anyway so this is my plan...

2 LDAP servers (with replication) behind a load balancer and home directories on an NFS share on my NetApp.

Now if I can only get sudo into ldap (still can't get that working right lol

)

-C

acid_kewpie · 05-16-2009, 12:41 PM

As above I would probably steer clear of appliances for loadbalancing here. F5's are THE best in the market by a long way, and at £40k per box, you'd hope so, but doing it via a them adds additional hops on your network which is not ideal for something that low level. Load balancers DO fail, but what can't fail is not-a-load-balancer. use them for higher level services, e.g. commercial websites, MQ proxying, citrix LB etc... but not for things like this.

custangro · 05-16-2009, 10:09 PM

Quote:

Originally Posted by acid_kewpie

As above I would probably steer clear of appliances for loadbalancing here. F5's are THE best in the market by a long way, and at £40k per box, you'd hope so, but doing it via a them adds additional hops on your network which is not ideal for something that low level. Load balancers DO fail, but what can't fail is not-a-load-balancer. use them for higher level services, e.g. commercial websites, MQ proxying, citrix LB etc... but not for things like this.

Thanks for the info

The "failover" doesn't take that long and I'm still weighing my options...so I'll post what I end up doing.

-C