It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Crowd Multiple LDAP servers

Algoteq Feb 18, 2018

I have 2 LDAP servers Primary (currently configured via ldap: chemar URL field in connector, but want to add 2nd server (LDAP Slave). Should I specify 

URL: ldap://ds1:389/ ldap://ds2:389/

instead of:

URL: ldap://ds1:389/

3 answers

1 accepted

1 vote
Answer accepted
Marcin Kempa Atlassian Team Feb 19, 2018

You may also give a try directory failover that Crowd offers, as described here.

Or you can go for the load balancer method as suggested by @Craig Castle-Mead.

 

Hope that helps,

Marcin Kempa

1 vote
Algoteq Feb 19, 2018

Crows is based on java naming service API, the URL field may contain multiple servers:

https://docs.oracle.com/javase/jndi/tutorial/ldap/misc/url.html

 

 

But it's not documented by crowd team.

Craig Castle-Mead Community Leader Mar 22, 2018

Thanks @Algoteq - was just able to get time to fully test this out and it's simplified things significantly (no need for external haproxy/lb/etc.

Used the URL format

"ldap://10.0.0.1:3268/ ldap://10.0.0.2:3268/"

Whatever the connection timeout value is, it'll check against each instance, and if there's no response, moves down the list

CCM

0 votes
Craig Castle-Mead Community Leader Feb 19, 2018

I’m quite certain that the UI won’t even let you save with the double LDAP server string in the field.

I’d suggest looking at load balancing your ldap servers outside of Crowd itself (f5, AWS elb, haproxy), have Crowd point to that device and then it has the smarts to know which server to route the traffic to.

If the two servers have replication delay, you may notice some weird behavior if/when you need to fail over. Hopefully this doesn’t happen too frequently, but I’d definitely suggest testing it out on a non-prod install, or even just a new Crowd directory that isn’t linked to any of your apps. Force a failover, see what happens the next sync, fail back, test again. I’d defnintely suggest against using a round robin approach (lowers the risk of constantly adding/removing groups of the two ldaps are out of sync), only use the secondary when you have to.

 

CCM

Suggest an answer

Log in or Sign up to answer
This widget could not be displayed.
This widget could not be displayed.
Community showcase
Published in Marketplace Apps & Integrations

Webinar alert! An IT Admin's Guide to Securing Collaboration at Scale

Hello, Atlassian Community! My name is Dave Meyer and I'm a Principal Product Manager at Atlassian. I wanted to give this community a heads up about an upcoming Webinar that might be of interest...

171 views 2 7
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you