<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 04/04/2015 12:30 PM, Nadav Mavor
wrote:<br>
</div>
<blockquote
cite="mid:CAN5Z3gO+hC3rMyP6BoG5JoEogZbNuBUzZSK5qnmyNmUPQia-Lw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>i use F5 and 3 IPA servers no big issues but some notes :<br>
</div>
1) as note you cant use it for kerberos<br>
<div>2) for the DNS we use group and not L/B do to the zone
serial (the zone serial num is not geting sync so if you round
robin you will get deferent zone num evey time and it will
mess up zone sync to external dns servers)<br>
</div>
<div>3) for the GUI (443) make sure to use stickiness so the
user wont get bounce after the login <br>
</div>
</div>
</blockquote>
<br>
I did not quite get 2) above...<br>
Can you please describe it in more details?<br>
If you know how to make LB work with IPA's DNS and kerberos a nice
HOWTO wiki page would be really welcome!<br>
<br>
<br>
<blockquote
cite="mid:CAN5Z3gO+hC3rMyP6BoG5JoEogZbNuBUzZSK5qnmyNmUPQia-Lw@mail.gmail.com"
type="cite">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Sat, Apr 4, 2015 at 11:47 AM, Simo
Sorce <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">We use
SASL/GSSAPI/krb5 to authenticate clients to the LDAP server.<br>
If you want to load balance by using a common DNS name in
front of all<br>
servers, you will need to deal with issues with krb5
authentication.<br>
<br>
At the very least you should add keys to all servers for a
principal<br>
named after the common name. However we do not test this
scenario and I<br>
am not 100% sure it works correctly when you factor in that
we use<br>
GSSAPI also for replication.<br>
<br>
Simo.<br>
<span class=""><br>
On Sat, 2015-04-04 at 22:16 +0700, Brian Topping wrote:<br>
> I believe LDAP can be load balanced without any
problem. It is a TCP<br>
> based protocol without persistent state between
transactions so it<br>
> should be just fine.<br>
><br>
> Sent from my iPhone<br>
><br>
> > On Apr 4, 2015, at 21:55, Janelle <<a
moz-do-not-send="true"
href="mailto:janellenicole80@gmail.com">janellenicole80@gmail.com</a>>
wrote:<br>
> ><br>
> > Hello everyone,<br>
> ><br>
> > Probably a quiet weekend for any responses, but
I will toss this<br>
> out. I was wondering if anyone has had any issues
with load balancers<br>
> and IPA? Not with Kerberos, since I know the protocol
is designed<br>
> without load balancer support, but in the case of
using the LDAP<br>
> portion? I am curious because the load balancing
within sssd is not<br>
> really load balancing, but more fail-over. I am
wondering what kind of<br>
> experience and maybe suggestions for a good LB setup
anyone might<br>
> have.<br>
> ><br>
> > Thank You<br>
> > ~J<br>
> ><br>
> > --<br>
> > Manage your subscription for the Freeipa-users
mailing list:<br>
> > <a moz-do-not-send="true"
href="https://www.redhat.com/mailman/listinfo/freeipa-users"
target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
> > Go to <a moz-do-not-send="true"
href="http://freeipa.org" target="_blank">http://freeipa.org</a>
for more info on the project<br>
><br>
<br>
<br>
--<br>
</span>Simo Sorce * Red Hat, Inc * New York<br>
<div class="HOEnZb">
<div class="h5"><br>
--<br>
Manage your subscription for the Freeipa-users mailing
list:<br>
<a moz-do-not-send="true"
href="https://www.redhat.com/mailman/listinfo/freeipa-users"
target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a moz-do-not-send="true"
href="http://freeipa.org" target="_blank">http://freeipa.org</a>
for more info on the project<br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>