<div dir="ltr"><div class="gmail_default" style=""><div class="gmail_default" style=""><font face="verdana, sans-serif">SRV record failover works for Kerberos on the Mac. Setting "dns_lookup_kdc = yes" and removing the KDC server ("kdc = xxx") entries from the /Library/Preferences/edu.mit.Kerberos config file does the trick.</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">For LDAP, although you can enable it, I can't see it documented anywhere so I'm assuming that isn't the recommended way for the Mac. This can be enabled by running this for the LDAP server you're using:</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">sudo odutil set configuration /LDAPv3/<a href="http://ipa1.example.com">ipa1.example.com</a> module ldap option "Use DNS replicas" "true"</font></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style=""><font face="verdana, sans-serif">Adding the altServer values with the Directory Manager credentials worked and I'm happy to report that the failover on the Mac works great with FreeIPA!</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">As suggested by Rob, for three servers, on server ipa1:</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">$ ldapmodify -x -D 'cn=directory manager' -W</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">Enter LDAP Password:</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">dn:</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">changetype: modify</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">add: altServer</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">altServer: ldap://<a href="http://ipa2.example.com">ipa2.example.com</a></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">-</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">add: altServer</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">altServer: ldap://<a href="http://ipa3.example.com">ipa3.example.com</a></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">modifying entry ""</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">^D</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">The altServer values didn't replicate so I had to add them to each of the FreeIPA servers.</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">Then, tell the Mac (testing on OS X v10.11.5) to use the altServer attribute to look for replicas in case of failover: </font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">sudo odutil set configuration /LDAPv3/<a href="http://ipa1.example.com">ipa1.example.com</a> module ldap option "Use altServer replicas" "true"</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">And, viola! Highly available authentication with a FreeIPA cluster for the Mac!</font></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style=""><font face="verdana, sans-serif">Thanks so much for your help!</font></div><div class="gmail_default" style=""><font face="verdana, sans-serif">Guillermo</font></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><div class="gmail_extra"> <br><div class="gmail_quote">On Fri, May 20, 2016 at 10:38 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span>Martin Basti wrote:<br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"> Hello,<br> <br> IPA uses SRV records for failover to another replica/LDAP.<br> <br> I don't know how it works on MACs, but in case that there is no<br> possibility to use SRV, you may need to file a RFE ticket<br> (<a href="https://fedorahosted.org/freeipa/newticket" rel="noreferrer" target="_blank">https://fedorahosted.org/freeipa/newticket</a>)<br> </blockquote> <br></span> Agreed, SRV records are the preferred mechanism. I was curious though so played with this a bit and it is possible to add altServer values:<br> <br> $ ldapmodify -x -D 'cn=directory manager' -W<br> Enter LDAP Password:<br> dn:<br> changetype: modify<br> add: altServer<br> altServer: ldap://<a href="http://gyre.example.com" rel="noreferrer" target="_blank">gyre.example.com</a><br> <br> modifying entry ""<br> ^D<br> <br> $ ldapsearch -LLL -x -b "" -s base altServer<br> dn:<br> altServer: ldap://<a href="http://gyre.example.com" rel="noreferrer" target="_blank">gyre.example.com</a><br> <br> My test rig is a single master so I don't know if this replicates or not.<br> <br> rob<br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span> <br> Martin<br> <br> <br> On 19.05.2016 17:43, Guillermo Fuentes wrote:<br> </span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span> Hello all,<br> <br> As OS X allows LDAP server failover via the altServer attribute<br> (RFC4512) from RootDSE, it would be great to be able to configure our<br> Macs to connect to a single FreeIPA server and add other FreeIPA<br> servers as multiple altServer values.<br> The current schema doesn't seem to support adding this attribute.<br> Can this be done in a way I'm missing?<br> <br> Thanks in advance!<br> <br> GUILLERMO FUENTES<br> SR. SYSTEMS ADMINISTRATOR<br> <br> <a href="tel:561-880-2998%20x1337" value="+15618802998" target="_blank">561-880-2998 x1337</a><br> <br> </span><a href="mailto:guillermo.fuentes@modmed.com" target="_blank">guillermo.fuentes@modmed.com</a> <mailto:<a href="mailto:guillermo.fuentes@modmed.com" target="_blank">guillermo.fuentes@modmed.com</a>><br> <br> <br> [ Modernizing Medicine ] <<a href="http://www.modmed.com/" rel="noreferrer" target="_blank">http://www.modmed.com/</a>><br> [ Facebook ] <<a href="http://www.facebook.com/modernizingmedicine" rel="noreferrer" target="_blank">http://www.facebook.com/modernizingmedicine</a>> [<br> LinkedIn ] <<a href="http://www.linkedin.com/company/modernizing-medicine/" rel="noreferrer" target="_blank">http://www.linkedin.com/company/modernizing-medicine/</a>> [<br> YouTube ] <<a href="http://www.youtube.com/user/modernizingmedicine" rel="noreferrer" target="_blank">http://www.youtube.com/user/modernizingmedicine</a>> [<br> Twitter ] <<a href="https://twitter.com/modmed_EMA" rel="noreferrer" target="_blank">https://twitter.com/modmed_EMA</a>> [ Blog ]<br> <<a href="http://www.modmed.com/BlogBeyondEMR" rel="noreferrer" target="_blank">http://www.modmed.com/BlogBeyondEMR</a>> [ Instagram ]<br> <<a href="http://instagram.com/modernizing_medicine" rel="noreferrer" target="_blank">http://instagram.com/modernizing_medicine</a>><br> <br> <br> <br> <br> <br> </blockquote> <br> <br> <br> </blockquote> <br> </blockquote></div><br></div></div>