Topic: balancer config

[sailor]

I'm trying setup a Apache balancer with an LDAP.

Listen *:490

<Proxy balancer://mycluster>
BalancerMember ldap://ldap.mycompany.com:490 retry=30
</Proxy>

ProxyPass / balancer://mycluster/

ProxyPreserveHost On

ProxyPassReverse / ldap://ldap.mycompany.com:490


I can telnet to 490 ok. I can ping ldap.mycompany.com ok.

I know I have my Softerra LDAPBRowser setup ok as I can connect to regular ip ok. But LDAP Browser reports COM error. Detail "error loading RootDSE entry from ldap.mycompany.com:490."

490 is non SSL port for our ldap as 389 is used by another ldap instance.

[tangent]

I don't believe Apache currently supports proxying for LDAP.

If you look at https://httpd.apache.org/docs/current/mod/mod_proxy.html it says to provide proxy services you need:

1) mod_proxy, which provides basic proxy capabilities
2) mod_proxy_balancer and one or more balancer modules if load balancing is required
3) one or more proxy scheme, or protocol, modules:

Unfortunately, so far no one has produced a mod_proxy_ldap module for Apache, to service the LDAP protocol.

Because of LDAP bind requirements, any LDAP proxy service must provide session stickiness based on TCP connection details (there are no HTTP headers / cookies available with LDAP).

Any number of commercial load balancer applicances support LDAP, e.g. F5, Incapsula, and there are equally other software alternatives such as HAProxy (and dare I say Nginx), which purportedly can load balance LDAP.

[James Blond]

mod_ldap[1] "might" be able to.

From using it for auth with mod_authnz_ldap in apache, I know what you have to add a "dc=example,dc=com?uid?one" to the ldap url. It might be worth trying it.

I have no ldap server to test this.




[1] http://httpd.apache.org/docs/current/mod/mod_ldap.html

[sailor]

This shows how to use for http auth though:

https://gist.github.com/alivesay/b81cd86457a1590e0cfd49725494056c

I tried nginx and it seems to work:

stream {
upstream ldap {
# LDAPS terminates here
server myldap1.com:390;
server myldap2.com:390;
server myldap3.com:390;
server myldap4.com:390;

}

server {
listen 390;
proxy_pass ldap;
proxy_timeout 3s;
proxy_connect_timeout 1s;
}



}

Just wish I had better visibility with their free version. The other thing would be how to setup a second lb in case the one is down during a reboot.