LSF9 - LDAP Bind to AD - Issue with always using Secondary Domain Controller

Which one did you actually bind to: DC1 or DC2?
You can only bind to one or the other...there is currently no way to bind to both for failover, etc.

Thanks for quick reply.

We actually did a LDAP Bind to a DNS Name "domaincontroller"  (originally the same IP as DC1). 

Changing the IP of "domaincontroller" to DC2 (Stilled worked), then we took DC2 offline to see if DC1 would automatically take over (nope), then changed the ip of "domaincontroller" back to DC1 (still did not work). Once DC2 was brought back on-line : worked

We did traces at the time  (from the core, and from the AIX server), and saw that DC2 was always involved in the authentication process.

From current traces, DC2 is currently being used for only the SEARCH CN=Configuration ....   while DC1 is being SEARCH for the actual user name.

Are there any tools which can print out current LDAPBIND settings besides lsconfig , and ssoconfig -c ?

Thanks

Lawson LDAPBIND works with 1 physical DC only, the DC that you specified during installation of ldapbind. The DC that Lawson is setup to use is under tag in you sooconfig. Do an export all services and look for that tag.

In the event that ldap://your-fried-dc goes kaboom, you will need to manually modify the value to a different DC so lawson will authenticate user again. You can rerun LDAPBIND under GENDIR/bin to respecifiy the DC under "Enter the LDAP provider URL to access".

You can bind to multiple DC's by using a Load Balancer to control the traffic between them. Create an alias bind to it as you have done. Point the dns to the load balancer and test your fail-over. I have worked with networking teams and tested failure of multiple DC's with an LDAPBIND in place, pointing to a Load Balancer controlling the traffic of the bind.

Bart

Bart,

Thx for the tips. I am gonna try that.

Hey David:

I am try to make this happen Via Microsoft AD, are you using the CN or the sAMAccountName?

I was told that this will only work via the CN name.

 

For AD, you use sAMAccountName

A Lawson Eng. told me that I need to use the CN along with the sAMAccountName.  In my case I only want to use the sAMAccountName because it's consistant within my AD tree.

Example:

Some of my users have a CN=jdoe

and others have a CN= john Doe

as per lawson both of these (CN and sAMAccountName) should be the same for portal using AD to work.

Is there a way to only use the sAMAccountName?

 

Perhaps I'm misunderstanding what you're talking about. If you are referring to the attribute in AD which is searched against for each user, I have always used sAMAccountName in AD. That's the only consistent element. (In other words, I understand what you're talking about (inconsistent "cn"'s). In fact, I'm not even aware of how you can use "CN along with the sAMAccountName"...

Microsoft AD default settings are always

sAMAccountName as naming attribute
user as structural attribute