[midPoint] Using Active Directory with Virtual IP for Failover

Mon Feb 23 20:51:10 CET 2015

Ok thanks for the notes, I am going to setup another test DC VM on my
workstation and add it to the test domain so I can test it out but it will
have to wait until another date as I am trying to get this going before the
next semester comes around, I realllyyyyy do not want to have to create
another 300 students one at a time in excel then use powershell to import
them...

I will let you know how it turns out though!

JASON

On Mon, Feb 23, 2015 at 1:39 PM, Ivan Noris <ivan.noris at evolveum.com> wrote:

>  Hi Jason,
>
> this seems to be pretty similar to our configuration. Some notes below.
>
> 1. To use serverless binding on the AD connector you don't need to specify
> the LDAPHostName. In my production resource it's commented:
>
> <!--<icfcad:LDAPHostName>localhost</icfcad:LDAPHostName>-->
>
> ADSI calls in the connector will discover and use whatever DC is
> available. Of course if you wish your CS to use specific DC, you can use
> the LDAPHostName resource configuration attribute. This may influence how
> soon you see the replicated data in the domain.
>
> 2. On customer machines, connectorserver.ifaddress is set to 0.0.0.0
> (default).
>
> From the midPoint point of view, only ldap.test.local exists and midPoint
> connects to 8759 port of the Connector Server service running on the
> virtual IP address corresponding to ldap.test.local.
>
> I confirm that we're also using failover and not balancer.
>
> Just remember - this customer is using only provisioning and not LiveSync
> from AD.
> (the following attributes are null for us, because we don't need them
>
> <icfcad:SyncGlobalCatalogServer>null</icfcad:SyncGlobalCatalogServer>
>
> <icfcad:SyncDomainController>null</icfcad:SyncDomainController>
> )
>
>
> Regards,
> Ivan
>
>
> On 02/23/2015 08:16 PM, Jason Everling wrote:
>
> Yeah so I am using the serverless binding with the connector server
> installed on each DC and if I am getting what you mean correct, I was
> imagining it would look something like this:
>
>  Virtual IP going through Citrix Netscaler: 10.10.20.10 which in DNS is
> LDAP.TEST.LOCAL
>
>  DC1 - Connector Server Installed using local IP <add
> key="connectorserver.ifaddress" value="10.20.10.5" />
> DC2- Connector Server Installed using local IP <add
> key="connectorserver.ifaddress" value="10.50.10.5" />
>
>
>  midPoint Connector Host would use the virtual DNS ldap.test.local
>
>  <connectorHost xmlns="
> http://midpoint.evolveum.com/xml/ns/public/common/common-3">
>     <name>Active Directory</name>
>     <hostname>LDAP.TEST.LOCAL</hostname>
>     <port>8759</port>
>     <sharedSecret>SECRET</sharedSecret>
> </connectorHost>
>
>  AD Resource would use the virtual DNS ldap.test.local
>
>
> <icfcad:LDAPHostName>ldap.test.local</icfcad:LDAPHostName>
>
> <icfcad:SearchChildDomains>false</icfcad:SearchChildDomains>
>                 <icfcad:DomainName>test.local</icfcad:DomainName>
>
> <icfcad:SyncGlobalCatalogServer>ldap.test.local</icfcad:SyncGlobalCatalogServer>
>
> <icfcad:SyncDomainController>ldap.test.local</icfcad:SyncDomainController>
>
>  Citrix Netscaler IP would be setup using Primary/Secondary and NOT load
> balanced.
>
>  JASON
>
>
> On Mon, Feb 23, 2015 at 12:24 PM, Ivan Noris <ivan.noris at evolveum.com>
> wrote:
>
>>  Hi Jason,
>>
>> we have a customer where we provision from midPoint to Active Directory
>> consisting of multiple domain controllers. The AD/Exchange connector is
>> making serverless bind unless you specify IP/hostname. But the connector
>> server itself is specified by IP/hostname, so if you want to have failover
>> for connector server, you need to have proper infrastructure.
>>
>> The customer is using this for provisioning, not synchronization.
>>
>> If you are using provisioning to AD, and you can ensure the machine with
>> connector server is (almost) always running, the serverless bind should do
>> the trick even if the DC are restarting (because I suppose at least one is
>> always up and running).
>>
>> Regards,
>> I.
>>
>>
>> On 02/23/2015 04:42 PM, Jason Everling wrote:
>>
>>  Now that all my resources, Active Directory, 3 databases, and CSV are
>> syncing properly, I was thinking about using our AD virtual ip for failover
>> in midPoint instead of connecting to only 1 Domain Controller. Midpoint
>> would connect to the virtual IP and if the primary domain controller goes
>> down then the 2nd Domain controller would be used.
>>
>>  Is this OK to use? The sync task stops in a failed state if the DC is
>> not reachable and this way the task would continue to run. Our DCs are
>> rebooted 1 at a time regularly for updates and was just wondering if this
>> would work or if there are any known issues doing this. I know that I would
>> more than likely need to modify the site replication time in AD so that
>> user info is updated more frequently but I could not think of anything else
>> that could cause an issue.
>>
>>  JASON
>>
>>
>>
>> CONFIDENTIALITY NOTICE:
>> This e-mail together with any attachments is proprietary and
>> confidential; intended for only the recipient(s) named above and may
>> contain information that is privileged. You should not retain, copy or use
>> this e-mail or any attachments for any purpose, or disclose all or any part
>> of the contents to any person. Any views or opinions expressed in this
>> e-mail are those of the author and do not represent those of the Baptist
>> School of Health Professions. If you have received this e-mail in error, or
>> are not the named recipient(s), you are hereby notified that any review,
>> dissemination, distribution or copying of this communication is prohibited
>> by the sender and to do so might constitute a violation of the Electronic
>> Communications Privacy Act, 18 U.S.C. section 2510-2521. Please immediately
>> notify the sender and delete this e-mail and any attachments from your
>> computer.
>>
>>
>> _______________________________________________
>> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>> --
>>   Ing. Ivan Noris
>>   Senior Identity Management Engineer & IDM Architect
>>   evolveum.com                     evolveum.com/blog/
>>   ___________________________________________________
>>   "Semper Id(e)M Vix."
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
>
>
> CONFIDENTIALITY NOTICE:
> This e-mail together with any attachments is proprietary and confidential;
> intended for only the recipient(s) named above and may contain information
> that is privileged. You should not retain, copy or use this e-mail or any
> attachments for any purpose, or disclose all or any part of the contents to
> any person. Any views or opinions expressed in this e-mail are those of the
> author and do not represent those of the Baptist School of Health
> Professions. If you have received this e-mail in error, or are not the
> named recipient(s), you are hereby notified that any review, dissemination,
> distribution or copying of this communication is prohibited by the sender
> and to do so might constitute a violation of the Electronic Communications
> Privacy Act, 18 U.S.C. section 2510-2521. Please immediately notify the
> sender and delete this e-mail and any attachments from your computer.
>
>
> _______________________________________________
> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>
>
> --
>   Ing. Ivan Noris
>   Senior Identity Management Engineer & IDM Architect
>   evolveum.com                     evolveum.com/blog/
>   ___________________________________________________
>   "Semper Id(e)M Vix."
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>

-- 

CONFIDENTIALITY NOTICE:
This e-mail together with any attachments is proprietary and confidential; 
intended for only the recipient(s) named above and may contain information 
that is privileged. You should not retain, copy or use this e-mail or any 
attachments for any purpose, or disclose all or any part of the contents to 
any person. Any views or opinions expressed in this e-mail are those of the 
author and do not represent those of the Baptist School of Health 
Professions. If you have received this e-mail in error, or are not the 
named recipient(s), you are hereby notified that any review, dissemination, 
distribution or copying of this communication is prohibited by the sender 
and to do so might constitute a violation of the Electronic Communications 
Privacy Act, 18 U.S.C. section 2510-2521. Please immediately notify the 
sender and delete this e-mail and any attachments from your computer. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20150223/90ca1fa3/attachment.htm>