Allow Cacti to use multiple possible LDAP servers

[bmfmancini]

Hey Guys,

In the current cacti LDAP settings you are only able to provide a single LDAP server
It would be good to be able to add a secondary server
Thanks !

[netniV]

Actually, if you use LDAP domains section, you can have multiple LDAP authentication. One of the updates to 1.3 will be to remove the older single LDAP configuration.

[netniV]

Oh, do you mean a backup LDAP server?

[bmfmancini]

Yes

…

On Thu., Jun. 10, 2021, 22:08 Mark Brugnoli-Vinten, < ***@***.***> wrote: Oh, do you mean a backup LDAP server? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4299 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGEXTG6UXLSRDEJTX7YLR3TSFVYFANCNFSM46PHRPFQ> .

[netniV]

OK, so first thing to define, which of these known errors should failover to the backup:

     const None                  = 0;
     const Success               = 0;
     const Failure               = 1;
     const UndefinedUsername     = 2;
     const ProtocolErrorVersion  = 3;
     const ProtocolErrorReferral = 4;
     const ProtocolErrorTls      = 5;
     const MissingLdapObject     = 6;
     const ProtocolErrorGeneral  = 7;
     const InsufficientAccess    = 8;
     const ConnectionUnavailable = 9;
     const ConnectionTimeout     = 10;
     const ProtocolErrorBind     = 11;
     const SearchFoundNoGroup    = 12;
     const SearchFoundMultiUser  = 13;
     const SearchFoundNoUser     = 14;
     const SearchFoundNoUserDN   = 15;
     const UndefinedDnOrPassword = 16;
     const Disabled              = 99;

[netniV]

Work is underway to simplify LDAP setitngs by removing from global and just using the user domains.

develop...ldap

Feel free to run in a test lab, but the upgrade process isn't right yet if you were already using LDAP (not multiple ldap), I just wanted to commit it so you can see what has been going on.

[TheWitness]

Not using a VIP or RRDNS with VIPs?

[bmfmancini]

It's more to cover a setup that doesn't have one I agree you would have a VIP or something else

…

On Fri., Jun. 25, 2021, 15:09 TheWitness, ***@***.***> wrote: Not using a VIP or RRDNS with VIPs? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4299 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGEXTHEU4GB3E6TU6YHGCLTUTH6RANCNFSM46PHRPFQ> .

[netniV]

So, we are still at the point of deciding which of the above errors can cause a failover to the secondary server. And I presume the secondary must have all the same settings aside from hostname?

[bmfmancini]

I will setup a LDAP server and check the failure types and yea they would all be the same

…

On Mon., Jun. 28, 2021, 19:24 Mark Brugnoli-Vinten, < ***@***.***> wrote: So, we are still at the point of deciding which of the above errors can cause a failover to the secondary server. And I presume the secondary must have all the same settings aside from hostname? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4299 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGEXTA2O3UGBMR7SMUAF7LTVEAEDANCNFSM46PHRPFQ> .

[arno-st]

If I may add some input, I'm using multiple LDAP config, and for me this 2 should s handled:
const ConnectionUnavailable = 9;
const ConnectionTimeout = 10;
const ProtocolErrorBind = 11;

The other are LDAP data error, not kind of protocol releated error. So if you have a replication of the 2 LDAP servers, the other errors are most likelly to be the same.
Event the error about the version, should give you other error on your domain, and is not suppose to be different on master and backup server.

Just my point to the reflection!

[bmfmancini]

Oh crap I totally forgot about this one! And I submitted it!... Fail I will look at some other response codes and send them over

…

On Mon., Oct. 18, 2021, 07:45 Arno Streuli, ***@***.***> wrote: If I may add some input, I'm using multiple LDAP config, and for me this 2 should s handled: const ConnectionUnavailable = 9; const ConnectionTimeout = 10; const ProtocolErrorBind = 11; The other are LDAP data error, not kind of protocol releated error. So if you have a replication of the 2 LDAP servers, the other errors are most likelly to be the same. Event the error about the version, should give you other error on your domain, and is not suppose to be different on master and backup server. Just my point to the reflection! — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4299 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGEXTBXVBIVUXWO26RXE4TUHQCELANCNFSM46PHRPFQ> .