On Fri, Feb 15, 2013 at 02:26:14PM +0100, Olivier wrote:
Hello,
in the case I was not knocking at the right door, please accept my apologies,
but I suspect that some of you may provide some advices that would help me
to avoid mistakes. The problem is : which mecanism would you recommand
to route ldap requests to the right ldap server.
Here is the situation :
My hosts and services are distributed in 3 distinct operationnal sites (site
A, site B, site C).
I have three ldap servers (one on each site), they are configured to be exact
replicate of the others (I use openldap syncrepl in multimaster mode).
Authentication on my hosts are based on ldap :
posixaccounts/nsswitch/pam/ldap.conf/sssd
I also have deployed things such as centralized sudoer rules in ldap.
At this stage, I have configured hosts so that ldap queries are sent to
the closer ldap server first, then to another one if the first one timeout
and so on:
Here is an extract of my ldap.conf for a host located in site A:
> URI ldap://ldapA.mydom.fr ldap://ldapB.mydom.fr ldap://ldapC.mydom.fr
Here is an extract of my sssd.conf:
> ldap_uri = ldap://ldapA.mydom.fr,ldap://ldapB.mydom.fr,ldap://ldapC.mydom.fr
For a host located in site C, I have declared this in ldap.conf:
> URI ldap://ldapC.mydom.fr ldap://ldapB.mydom.fr ldap://ldapA.mydom.fr
I would like to change that.
Rather than declaring three ldap server references in configurations on the
client side, I would like to implement some sort of mecanism to declare
only one reference (that route ldap queries to ldap service, not to ldap
servers).
I see different possibilities to do that, such as setting up some sort of
"heartbeat" or using some DNS trick such as multiple IN A for the same
DNS RR, sortlist option or _ldap._tcp. See:
http://www-01.ibm.com/software/network/directory/library/publications/jnd...
http://www.rjsystems.nl/en/2100-dns-discovery-openldap.php
http://www.ietf.org/proceedings/50/I-D/ldapext-locate-05.txt
http://ipamworldwide.com/bind-options/sortlist-option.html
Intuitively, my preference would go to use an "_ldap._tcp" srv
record, but I'm not sure that nsswitch or sssd would interpret
this kind of DNS responses correctly (what I mean by "correctly"
is "not sure that the client would query an up and running ldap
server found in the NS response list, and even better: would
query the faster one that respond" ).
Any advice ?
Hi Olivier,
I have two suggestions for you:
1) one possibility would be to keep using the client side configuration
but put the "remote" servers into ldap_backup_uri directive rather than
ldap_uri directive. The difference is that when SSSD falls over to
another server in the list, it keeps using that server until it is
restarted or the server misbehaves as well. On the other hand, the
ldap_backup_uri would only be used temporarily and SSSD would try to
reconnect periodically to one of the servers in the "primary" ldap_uri
list. The ldap_backup_uri feature is a new one in 1.9.x.
- OR -
2) Switch to using SRV records. The SSSD is able to resolve them, see
the "service discovery" footnote in the sssd-ldap man page. Then define
different priorities for "local" and "remote" servers so that the
SSSD
always tries to connect to the local ones. RFC 2782 has some nice
examples on the priority and weight fields is SRV records. Because each
of the three sites you are maintaining would be using different server
as "local" you might need to use something like DNS views or experiment
with CNAMEs to provide the correct order of servers on each site.
Hope this helps..