LDAP clients and fail-over

[Alex Smith]

I wrote an LDAP framework in Java and now I have it talking to AD. The
framework does not have a notion of a fail-over in a sense that it
only connects to a single LDAP server with no provision to continue
the conversation with another directory. It does have a notion of a
connection pool so that a particular connection will be tested before
or after it's used. If the LDAP server or network doesn't respond for
a while but then comes back up, the application using the framework
will recover gracefully. If my LDAP server is AD and I've got a bunch
of them merrily replicating in a domain, what's the best way to
achieve fail-over without adding this logic on the client side?

I thought I could get away with a round-robin DNS scheme but after
reading Q247811 I am not so sure. My second thought is to use a
Layer-4 switch (Alteon, Cisco, others). Will either of these work or
are there better approaches?

Alex Smith
ACME Consulting

 

[Joe Richards [MVP]]

If all of your DC's are on high speed near the LDAP Server (say in a data center) you can use the domain dns name in the
connection string i.e. domain.com and then if your DNS roundrobins it will spin through the various DC's. I fyou have a
small domain or everything is close you don't need to worry about how Windows does it with the SRV records though if you
have a large distributed environment you then want to figure it out.

Some solutions that our UNIX folks have come up with include

1. Writing an actual locator service that reads the DNS records for a defined site and dynamically connects to those
DC's returned.
2. Hardcoding the names of several servers.
3. Having a perl script do sort of a locator service every hour and then writes those values into the config file for
the LDAP client.

1 is the best obviously. From what I understand, future versions of J2EE will have SRV locator functionality built in.
It is a very handy mechanism, MS did really good implementing it though I have some suggestions on some of their GC
registrations if they want to listen... p