Is it possible to have multiple hosts for one LDAP Strategy?

[fjmelo]

Hi all,

We have Splunk connected to 5 LDAP domains and each one with at least 10 servers. Today Splunk is pointing to the domain name "domain1.com" that has the DNS pointing and rotating to each one of the 10 servers after some time, even if the Active Directory server is out the "domain1.com", it still points to it and times out. When this happens, the connections to Splunk using SSO hang until the AD server is rotated to another server.

We also had this situation on our SAP portal server (That as Splunk seems to be not LDAP aware), but we fixed this using the names of 4 servers separated by commas so the rotation would happen on SAP level and only on those servers. We would like to approach it the same way in Splunk. Is that possible?

Example below:

[domain1]
host = server1.domain1.com,server2.domain1.com,server3.domain1.com,server4.domain1.com
port = 389
SSLEnabled = 0
....

Thanks,

[ursfischer]

Hello there,

Is there a solution for this question. We too (like many others i guess) have domains with multiple LDAP servers behind. Either we register per domain several strategies what gives us in the end about 15 strategies an more or we can solve with the DNS record for the Domain (example demo.domain.local). In my opinion Splunk will then connect to one of the multiple Servers behind this DNS record with Round Robin. What are the possibilities and how did you solve this?

With so many strategies we have the problem that with an adjustment to roles with subsequent reload the whole thing with a search head cluster at the end goes very long. Clearly, the strategies here are only one part of many in a reload, and yet this would help us.

[isoutamo]

Hi

one option is use several strategies which are pointing to different LDAP servers which have identical content. Another option is use LB before LDAPs and use this VIP address as server for strategy. That is probably more easier solution for overall.

r. Ismo

[adhoke_splunk]

Ldap strategy can point to only one ldap server. However, you can specify multiple ldap strategies, one for each of your servers. In this case, strategies will be same except for host.
Specify those strategies in authSettings as comma separated values. Splunk will attempt to connect to all strategies.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Authenticationconf