[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: GSSAPI and LVS Load balanced ldap servers



--On Monday, February 02, 2009 8:31 PM -0500 Frank Swasey <Frank.Swasey@uvm.edu> wrote:

Today at 4:16pm, Quanah Gibson-Mount wrote:

--On Monday, February 02, 2009 3:13 PM -0500 Francis Swasey
<Frank.Swasey@uvm.edu> wrote:

We've finally reached the point in replacing our old authentication
system that I'm attempting to get GSSAPI working with our ldap.uvm.edu
system.

Good luck. :) The only way I ever got this working was via software load balancing on round-robin DNS, where the virtual name would resolve to the actual host.

LVS is a software load balancer. What software load balancer did you use that also used DNS round-robin (or am I completely confused in my understanding of what you just wrote)?

Something custom that stanford wrote. ;)

<http://www.eyrie.org/~eagle/software/lbcd/>

But what it doesn't do is make use the LB name when it does the actual bind, as it gets translated into the real host.

Fresh ticket cache:

tribes:~> klist
Ticket cache: FILE:/tmp/krb5cc_54046
Default principal: quanah@stanford.edu

Valid starting     Expires            Service principal
02/03/09 08:33:09  02/04/09 09:33:07  krbtgt/stanford.edu@stanford.edu
02/03/09 08:33:09  02/04/09 09:33:07  afs/ir.stanford.edu@stanford.edu


Kerberos 4 ticket cache: /tmp/tkt54046 klist: You have no tickets cached


ldapsearch:

tribes:~> ldapsearch -h ldap1 uid=quanah uid
SASL/GSSAPI authentication started
SASL username: quanah@stanford.edu
SASL SSF: 56
SASL installing layers
...


Now the ticket cache has ldap/ldap1: tribes:~> klist Ticket cache: FILE:/tmp/krb5cc_54046 Default principal: quanah@stanford.edu

Valid starting     Expires            Service principal
02/03/09 08:33:09  02/04/09 09:33:07  krbtgt/stanford.edu@stanford.edu
02/03/09 08:33:09  02/04/09 09:33:07  afs/ir.stanford.edu@stanford.edu
02/03/09 08:33:59  02/04/09 09:33:07  ldap/ldap1.stanford.edu@stanford.edu


Kerberos 4 ticket cache: /tmp/tkt54046 klist: You have no tickets cached



And here's the actual record for ldap.stanford.edu:

tribes:~> host -t txt ldap
ldap.Stanford.EDU       CNAME   ldap.best.Stanford.EDU
ldap.best.Stanford.EDU  TXT     "    150/1.000  ldap3.stanford.edu"
!!! ldap.best.Stanford.EDU TXT record has zero ttl
ldap.best.Stanford.EDU  TXT     "    150/1.000  ldap1.stanford.edu"
!!! ldap.best.Stanford.EDU TXT record has zero ttl
ldap.best.Stanford.EDU  TXT     "    150/1.000  ldap4.stanford.edu"
!!! ldap.best.Stanford.EDU TXT record has zero ttl
ldap.best.Stanford.EDU  TXT     "    120/1.000  ldap2.stanford.edu"
!!! ldap.best.Stanford.EDU TXT record has zero ttl


--Quanah




--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration