In the following procedures, you configure one load balancer in front the Directory Server configuration instances, and one load balancer in front of the Directory Server user data instances.
Use the following as your checklist for configuring the Directory Server load balancers:
Configure Load Balancer 7 for the Directory Server Configuration instances.
Configure Load Balancer 8 for the Directory Server User Data instances.
In this deployment, both Directory Server load balancers are configured for simple persistence. When the load balancer is configured for simple persistence, all Federation Manager requests sent within a specified interval are sent to the same Directory Server for processing. Simple persistence ensures that within the specified interval, no errors or delays occur due to replication time or redirects when retrieving data.
When a request requires information to be written to Directory Server 3SP, that information is also replicated in Directory Server 4SP. But the replication takes time to complete. During that time, if a related request is directed by the load balancer to Directory Server 4SP, the request may fail.
For example, when simple persistence is not configured properly, creating a realm from the Federation Manager administration console could fail in the following way. A request for the parent entry creation is routed to Directory Server 3SP, and a second request to create the subentry is routed to Directory Server 4SP. But if the parent entry request is not yet fully replicated to Directory Server 4SP, the subentry request fails. The result is a partially created realm which may not contain all its subentries such as realm administration roles. Simple persistence eliminates this type of error. When persistence is properly configured, both the parent entry request and the subentry request are routed to Directory Server 3SP. The requests are processed in consecutive order. The parent entry is fully created before the subentry request begins processing.
Contact your network administrator to obtain an available virtual IP address for the load balancer you want to configure.
You must also know the IP address of the load balancer hardware, the URL for the load balancer login page, and a username and password for logging in to the load balancer application.
The load balancer hardware and software used in the lab facility for this deployment is BIG-IP® manufactured by F5 Networks. If you are using different load balancer software, see the documentation that comes with that product for detailed settings information.
You must also have ready the IP addresses for Directory Server 3SP and Directory Server 4SP.
To obtain these IP addresses, on each Directory Server host, run the following command:
ifconfig —a
Create a Pool.
A pool contains all the backend server instances.
Go to URL for the Big IP load balancer login page.
Open the Configuration Utility.
Click “Configure your BIG-IP (R) using the Configuration Utility.”
In the left pane, click Pools.
On the Pools tab, click the Add button.
In the Add Pool dialog, provide the following information:
Example: federation_ds_pool
Round Robin
Add the IP address of both Directory Server hosts. In this example:
192.18.69.135( for DirectoryServer-3SP:1389)
192.18.72.136 (for DirectoryServer-4SP:1389)
Click the Done button.
Add a Virtual Server.
If you encounter Javascript errors or otherwise cannot proceed to create a virtual server, try using Microsoft Internet Explorer for this step.
In the left frame, Click Virtual Servers.
On the Virtual Servers tab, click the Add button.
In the Add a Virtual Server dialog box, provide the following information:
192.18.69.16 (for LoadBalancer-7.siroe.com )
389
federation_ds_pool
Continue to click Next until you reach the Pool Selection dialog box.
In the Pool Selection dialog box, assign the Pool (federation_ds_pool) that you have just created.
Click the Done button.
Add Monitors
Monitors are required for the load balancer to detect the backend server failures.
In the left frame, click Monitors.
Click the Basic Associations tab.
Add an LDAP monitor for the Directory Server 3SP node.
Three columns exist on this page: Node, Node Address, and Service. In the Node column, locate the IP address and port number DirectoryServer-3SP:1389. Select the Add checkbox.
Add an LDAP monitor for the Directory Server 4SP node.
In the Node column, locate the IP address and port number for DirectoryServer-4SP:1389 . Select the Add checkbox.
At the top of the Node column, in the drop-down list, choose tcp .
Click Apply.
Configure the load balancer for simple persistence.
Verify the Directory Server load balancer configuration.
Log in as a root user to the host of each Directory Server.
On each Directory Server host, use the tail command to monitor the Directory Server access log.
# cd /var/opt/mps/serverroot/slapd-DirectorySerer-3SP/logs
# tail -f access
You should see connections to the load balancer IP address opening and closing. Example:
conn=54 op=-1 msgId=-1 — fd=22 slot=22 LDAP connection from 192.18.69.18 to 192.18.72.33
conn=54 op=-1 msgId=-1 — closing — B1
conn=54 op=-1 msgId=-1 — closed.
Execute the following LDAP search against the Directory Server load balancer:
# cd /var/opt/mps/serverroot/shared/bin/ # ./ldapsearch -h LoadBalancer-7.siroe.com -p 389 -b "o=siroe.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only one Directory Server access log.
Stop Directory Server 3SP, and again perform the following LDAP search against the Directory Server load balancer:
# ./ldapsearch -h LoadBalancer-7.siroe.com -p 389 -b "o=siroeusers.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Verify that the Directory Server access entries display in only one Directory Server access log.
If you encounter the following error message:
# ./ldapsearch —h 192.18.69.13 —p 1389 —b “o=siroeusers.com“ —D “cn=Directory Manager” —w 11111111 ldap_simple_bind: Cant' connect to the LDAP server — Connection refused |
You can reset the timeout properties to lower values:
In the load balancer console, click the Monitors tab, and then click the ldap-tcp monitor name.
In the Interval field, set the value to 5.
In the Timeout field, set the value to 16.
Click Apply.
Repeat the LDAP search.
Restart the stopped Directory Server 3SP, and then stop Directory Server 4SP.
Confirm that the requests are forwarded to the running Directory Server 4SP.
Perform the following LDAP search against the Directory Server load balancer.
# ./ldapsearch -h LoadBalancer-7.siroe.com -p 389 -b "o=siroe.com" -D "cn=Directory Manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only the one Directory Server access log.
Contact your network administrator to obtain an available virtual IP address for the load balancer you want to configure.
You must also know the IP address of the load balancer hardware, the URL for the load balancer login page, and a username and password for logging in to the load balancer application.
The load balancer hardware and software used in the lab facility for this deployment is BIG-IP® manufactured by F5 Networks. If you are using different load balancer software, see the documentation that comes with that product for detailed settings information.
You must also have ready the IP addresses for Directory Server 3SP and Directory Server 4SP.
To obtain these IP addresses, on each Directory Server host, run the following command:
ifconfig —a
Create a Pool.
A pool contains all the backend server instances.
Go to URL for the Big IP load balancer login page.
Open the Configuration Utility.
Click “Configure your BIG-IP (R) using the Configuration Utility.”
In the left pane, click Pools.
On the Pools tab, click the Add button.
In the Add Pool dialog, provide the following information:
Example: federation_users_pool
Round Robin
Add the IP address of both Directory Server hosts. In this example: .
192.18.69.135(for DirectoryServer-3SP:1489)
192.18.72.136 (for DirectoryServer-4SP:1489)
Click the Done button.
Add a Virtual Server.
If you encounter Javascript errors or otherwise cannot proceed to create a virtual server, try using Microsoft Internet Explorer for this step.
In the left frame, Click Virtual Servers.
On the Virtual Servers tab, click the Add button.
In the Add a Virtual Server dialog box, provide the following information:
192.18.69.16 (for LoadBalancer-8.siroe.com )
1389
federation_users_pool
Continue to click Next until you reach the Pool Selection dialog box.
In the Pool Selection dialog box, assign the Pool (federation_users_pool) that you have just created.
Click the Done button.
Add Monitors
Monitors are required for the load balancer to detect the backend server failures.
In the left frame, click Monitors.
Click the Basic Associations tab.
Add an LDAP monitor for the Directory Server 3SP node.
Three columns exist on this page: Node, Node Address, and Service. In the Node column, locate the IP address and port number DirectoryServer-3SP:1489. Select the Add checkbox.
Add an LDAP monitor for the Directory Server 4SP node.
In the Node column, locate the IP address and port number for DirectoryServer-4SP:1489 . Select the Add checkbox.
At the top of the Node column, in the drop-down list, choose ldap-tcp .
Click Apply.
Configure the load balancer for simple persistence.
Verify the Directory Server load-balancer configuration.
Log in as a root user to the host of each Directory Server.
On each Directory Server host, use the tail command to monitor the Directory Server access log.
# cd /var/opt/mps/serverroot/slapd-fm-users/logs
# tail -f access
You should see connections to the load balancer IP address opening and closing. Example:
conn=54 op=-1 msgId=-1 — fd=22 slot=22 LDAP connection from 192.18.69.18 to 192.18.72.33
conn=54 op=-1 msgId=-1 — closing — B1
conn=54 op=-1 msgId=-1 — closed.
Execute the following LDAP search against the Directory Server load balancer:
# cd /var/opt/mps/serverroot/shared/bin/ # ./ldapsearch -h LoadBalancer-8.siroe.com -p 1389 -b "o=siroeusers.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only one Directory Server access log.
Stop Directory Server 3SP, and again perform the following LDAP search against the Directory Server load balancer:
# ./ldapsearch -h LoadBalancer-8.siroe.com -p 1389 -b "o=siroeusers.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Verify that the Directory Server access entries display in only one Directory Server access log.
If you encounter the following error message:
# ./ldapsearch —h 192.18.69.13 —p 1389 —b “o=siroeusers.com“ —D “cn=Directory Manager” —w 11111111 ldap_simple_bind: Cant' connect to the LDAP server — Connection refused
You can reset the timeout properties to lower values:
In the load balancer console, click the Monitors tab, and then click the ldap-tcp monitor name.
In the Interval field, set the value to 5.
In the Timeout field, set the value to 16.
Click Apply.
Repeat the LDAP search.
Restart the stopped Directory Server 3SP, and then stop Directory Server 4SP.
Confirm that the requests are forwarded to the running Directory Server 4SP.
Perform the following LDAP search against the Directory Server load balancer.
# ./ldapsearch -h LoadBalancer-8.siroe.com -p 389 -b "o=siroeusers.com" -D "cn=Directory Manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only the one Directory Server access log.