Configuring LDAP with HA failover servers

Edit online

version 4170 Starting with IBM Cloud Pak® foundational services version 4.17.0, configure Lightweight Directory Access Protocol (LDAP) with high availability (HA) failover servers by using an Identity Management (IM) API or the console. Failover servers are used as backup if your primary LDAP server is not available or if the connection times out.

Prerequisites

Edit online

Before you configure the HA failover server, note the following assumptions and dependencies:

  • The LDAP server that is used for failover needs to have the same configuration and needs to be the same type as the primary LDAP server. However, the failover server needs a different DNS and port for an access point.
  • The primary LDAP server needs to run while you configure the connection, but the failover servers don't need to run while you configure the connection.
  • Use the LDAP failover server only when the primary LDAP server is not available or when Liberty doesn't get a response after the connection times out.
  • If the primary LDAP server is slow to respond, the failover servers might not be used because Liberty or IM can still reach the primary LDAP server.

Configuring failover servers with an IM API

Edit online
Use the following IM API to configure LDAP with HA failover servers. Replace the idp_config parameters with the values that apply to your server. For more information about setting up your LDAP connection, see Connecting to your LDAP directory. 
{
    "name": "openldap",
    "description": "ldap ha failover testing",
    "protocol": "ldap",
    "type": "Custom",
    "idp_config": {
        "ldap_url": "ldap://<IP address>",
        "ldap_failover_servers_list": ["ldap://<IP address>","ldap://<IP address>"]
        "ldap_basedn": "dc=<example>,dc=com",
        "ldap_bindpassword": "<base64 encoded password>",
        "ldap_binddn": "cn=<example>,dc=<example>,dc=com",
        "ldap_userfilter": "<filter clause for searching users>",
        "ldap_groupfilter": "<filter clause for searching groups>",
        "ldap_useridmap": "<filter to map a username to an LDAP entry>",
        "ldap_groupidmap": "<filter to map a group name to an LDAP entry>",
        "ldap_groupmemberidmap": "<filter to map a user to a group>"
    }
}

Configuring failover servers with the console

Edit online
Complete the following steps to configure LDAP with HA failover servers with the console:
  1. Click New connection and select LDAP.
  2. In the Server URL section, for the URL field, enter the primary LDAP server endpoint.
  3. Select Enable LDAP failover.
  4. Click Add LDAP server. Enter the server URL and click Add LDAP server. Repeat these steps for each failover server that you want to add.
  5. To create the configuration, click Create.

Configuring the connectionTimeout property

Edit online

Configure the connectionTimeout property through a ConfigMap value. The connectionTimeout property is time in milliseconds that the client tries to create a connection with the LDAP server before it times out and moves to the failover servers if they are configured.

The default value is 30 seconds. Complete the following steps to change the value:
  1. In Workloads, go to ConfigMaps.
  2. Search for the platform-auth-idp ConfigMap.
  3. Click Edit ConfigMap and search for the LDAP_CLIENT_CONNECT_TIMEOUT value.
  4. Edit the default value with the time in milliseconds that you want to use.
  5. Save the changes and wait for all platform pods to restart.