If multiple ldap servers are specified, no switch happens if first goes down

[Wouter van Bommel]

Hi,

Just had the experience that in the charm 2 ldap servers where configured.
(juju config keystone-ldap ldap-server='ldaps://server1,ldaps://server2'

At the moment server1 went down, authentication was no longer possible. The only way to restore service, was by changing the order, so that server2 is referenced first.

This does not seem to be in line with the documentation that 'juju config keystone-ldap' gives, as there it is suggested that specifying multiple ldap servers should provide redundancy.

[Xav Paice (xavpaice)]

subscribed field-medium, this affects Bootstack customers.

[James Page (james-page)]

The charm configuration option is a direct pass through to the keystone ldap url configuration option which specifies:

"URL(s) for connecting to the LDAP server. Multiple LDAP URLs may be specified
 as a comma separated string. The first URL to successfully bind is used for the
 connection."

This is configured directly in the backend:

[ldap]
url = {{ options.ldap_server }}
user = {{ options.ldap_user }}

So I'm guessing that the fault here lies in whatever failover code exists in keystone and the underlying LDAP library to support failure detection and failover.

[James Page (james-page)]

Please can you provide full details of which OpenStack release you are using on which Ubuntu release.

Thanks!

[James Page (james-page)]

Potentially related bug 1544821

[James Page (james-page)]

We might be able to fix this in the charm so re-opening but it really depends on which openstack release is in play.

[James Page (james-page)]

For later releases ldappool is used for connection management, however the default connection_timeout configuration in keystone that gets passed to ldappool is -1 (disabled) so I'm not sure that failure detection will work.

[James Page (james-page)]

You could try passing

connection_timeout=5

via the charms ldap-config-flags option - that should end up in the correct sectional config.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Keystone LDAP integration because there has been no activity for 60 days.]

[Launchpad Janitor (janitor)]

[Expired for keystone (Ubuntu) because there has been no activity for 60 days.]