IBM Security Access Manager for Enterprise Single Sign-On, Version 8.2

Distributed servers or clusters in multiple locations

Customers with users and offices in multiple geographical locations can deploy separate clusters of the IMS Server and database in geographically separated sites. This option distributes and localizes the traffic and load.

A distributed IMS Server setup consists of multiple sites. Each site has its set of IMS Servers and database instances. All IMS Servers at each site point to the corresponding IMS Server database servers at that site.

Deploying IMS Servers across multiple sites has the following benefits:

It minimizes cross-site traffic. AccessAgents communicate locally or communicate with the nearest IMS Server for improved bandwidth and response time.
Failure of any single IMS Server site has no impact on the users of other sites. Additional sites provide several backups.

How a geographically distributed or multi-site deployment works

A typical distributed IMS Server setup has one designated main site, and one or more satellite sites. Configure the IMS Server at the satellite site to be the same as the main site, except for the database connection parameters, enterprise directory, and messaging gateways.

You can configure each satellite site to replicate local changes bidirectionally with the main site. Changes made to system, machine, and user data at either the main site or satellite site is replicated to all sites. However, the audit logs can be replicated in a unidirectional flow from the IMS Server database at the satellite site to the IMS Server database at the master site.

Each IMS Server has different virtual IP numbers at each site. All instances of the IMS Server in a site share a common virtual IP number through a load balancer. Use the split-horizon DNS technique where the IMS Servers at all sites share the same DNS name. All AccessAgents are configured to point to this common DNS name.

Figure 1. An example of how data is replicated between two satellites and a main site in a geographically distributed IMS Server deployment.

Figure shows an example of a geographically distributed deployment with replication between one main site and two satellite sites.

For example, IMS Servers at Site 1 have a virtual IP of 192.0.2.10. The IMS Servers at Site 2 have a virtual IP of 192.0.2.15 but all the IMS Servers share the DNS name of ims.example.com.

If an IMS Server site becomes unavailable. For example: The IBM® DB2® is down, the AccessAgent connected to this IMS Server site is redirected to the local or nearest active IMS Server site.

An alternative configuration is that each IMS Server site maintains its own unique IMS Server DNS name. In this configuration:

The IMS Server at each site has its own unique IMS Server DNS name and virtual IP.
The AccessAgent at each site is configured to communicate with the DNS name of the IMS Servers at that site.
The IMS Server and AccessAgent installations at each site are installed and configured to different IMS Server DNS names.

Database replication

Use database replication to cross-replicate data between the IMS Server databases located at each site.

Database replication technologies vary between vendors. For this release, IBM Security Access Manager for Enterprise Single Sign-On supports only database replication for DB2.

The IMS Server at the main site hosts the master IMS Server database. The database server at each site can be stand-alone, clustered, or mirrored for high availability.

Feedback