Authentication to two ldap directories

[Ignacio Amoeiro Bosch]

Hi peter, thanks for response. I agree with you 100%. The problem is that one of the two ldap is not managed  by our company and also is not connected by LAN (VPN) so sometimes could fail...... Our ldap service has high availiability.

Regards

-----Mensaje original-----
De: users <users-bounces at shibboleth.net> En nombre de Peter Schober
Enviado el: domingo, 16 de junio de 2019 12:50
Para: users at shibboleth.net
Asunto: Re: Authentication to two ldap directories

* Ignacio Amoeiro Bosch <ignacio.amoeiro at extern.ibsalut.es> [2019-06-15 12:01]:
> I have configured two ldap directories for authentication following 
> the documentation [...]. It works fine, but when one of the 
> directories is down then it stop authentication although the user i'm 
> triing to authenticate his LDAP server is up. ¿How I can resolve that? 
> I have read ldaptive documentation, and can't found how to solve it.

I don't know the answer to your question (wherher ldaptive can be made to do what you want) but I personally find it unreasonable to expect every single application to "support" a certain kind of behaviour when really your LDAP /service/ as such (not "server") should simply never fail (catastrophic exceptions aside).

LDAP is simple and cheap to replicate and make highly available, so if the case you're asking about is a common one then really any effort should go into avoiding the root cause[1] (at the source) instead of trying to get all applications that need to connect to LDAP to handle failure "better":
  Mostly because it's probably unattainable (not all applications can be made to support the desired behaviour when faced with server
outages) but also because you'd spend possibly more time solving only a part of the problem -- any requests that would require a specific LDAP server to be up would still fail!

Best regards,
-peter

[1] You can't avoid "server failure" but you can avoid "service outage by server failure" by having multiple servers for each function, with a loadbalancer of some sorts in front.
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net