Scenario 6: Configuration of multiple pass-through authentication servers

You can map a specified user container in IBM® Security Verify Directory with multiple pass-through servers.

For this scenario to work, you must install IBM Security Directory Server Version 6.3.1.5 or later.

In all other scenarios of pass-through authentication, the specified user container in IBM Security Verify Directory is mapped to any one pass-through authentication server, which is a 1:1 mapping. You can also configure N:1 mapping, because multiple user containers can be mapped to any one pass-through authentication server.

However, in this scenario, you can map any specified user container to multiple pass-through authentication servers. It is possible to configure 1:N mapping. For example, assume that there are two pass-through servers. For both of these servers, the users are stored under ou=users,o=sample in IBM Security Verify Directory. In this case, the configuration of the two pass-through authentication servers would be as shown here:

dn: cn=ad1, cn=Passthrough Authentication, cn=Configuration
cn: ad1
ibm-slapdPtaAttrMapping: uid $ samAccountName
ibm-slapdPtaBindDN: cn=Administrator,ou=users,dc=ad1,dc=com
ibm-slapdPtabindPW: {AES256}SDHQJXZcNdnuBRxzW3nUsw==
ibm-slapdPtaConnectionPoolSize: 4
ibm-slapdPtaMigratePwd: false
ibm-slapdPtaSearchBase: ou=users,dc=ad1,dc=com
ibm-slapdPtaSubtree: ou=users,o=sample
ibm-slapdPtaURL: ldap://127.0.0.1:7389
objectclass: top
objectclass: ibm-slapdConfigEntry
objectclass: ibm-slapdPta
objectclass: ibm-slapdPtaExt

dn: cn=ad2, cn=Passthrough Authentication, cn=Configuration
cn: ad2
ibm-slapdPtaAttrMapping: uid $ samAccountName
ibm-slapdPtaBindDN: cn=Administrator,ou=users,dc=ad2,dc=com
ibm-slapdPtabindPW: {AES256}SDHQJXZcNdnuBRxzW3nUsw==
ibm-slapdPtaConnectionPoolSize: 4
ibm-slapdPtaMigratePwd: false
ibm-slapdPtaSearchBase: ou=users,dc=ad2,dc=com
ibm-slapdPtaSubtree: ou=users,o=sample
ibm-slapdPtaURL: ldap://127.0.0.1:4389
objectclass: top
objectclass: ibm-slapdConfigEntry
objectclass: ibm-slapdPta
objectclass: ibm-slapdPtaExt

The following requirements must be met for this scenario to work properly:

The value of ibm-slapdPtaSubtree must be the same for both the pass-through authentication servers.
All of the users in the user container must contain the ID of the pass-through authentication server that stores the credentials of the user.
The server ID must be stored by using the auxiliary object class ptaServerInfo and the attribute ptaServerId.
The value of the attribute must be the same as the value of CN attribute from the pass-through server configuration.

For example, assume that the user, uid=tbrown,ou=users,o=sample has credentials in the pass-through authentication server, cn=ad1, cn=Passthrough Authentication, cn=Configuration, and the user uid=jdoe,ou=users,=sample has credentials in the pass-through authentication server cn=ad2, cn=Passthrough Authentication, cn=Configuration. The user entries would be configured as shown here:

dn: uid=tbrown,ou=users,o=sample
cn: Tom Brown
sn: Brown
uid: tbrown
ptaServerId: ad1
objectclass: inetOrgPerson
objectclass: ptaServerInfo

dn: uid=jdoe,ou=users,o=sample
cn: John Doe
sn: Doe
uid: jdoe
ptaServerId: ad2
objectclass: inetOrgPerson
objectclass: ptaServerInfo

In this scenario, when a user binds to IBM Security Verify Directory, the following process takes place:

The server identifies the pass-through authentication server from the value of ptaServerId that is stored in the user entry.
It does a search on the identified pass-through authentication server to get the user DN.
Then, it authenticates on the pass-through authentication server.

Hence, for this scenario to work properly, the value of CN attributes in the pass-through authentication server configuration must be unique across all the servers. If multiple CN attributes are present in the configuration, only the first value must be used for storing in the user entries.