• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Breaking SSO HA

C

Child of Wonder

2[H]4U
Joined
May 22, 2006
Messages
3,270
Working with a client who mistakenly set up SSO in HA mode with the primary node being in their primary DC and the secondary node being in their DR site. Obviously this won't do them much good when the primary DC goes down and the secondary HA node can no longer reach the SSO database and since we're setting up SRM for them, they kind of need SSO to work at the DR.

I've been looking over the KB and documentation but can't find anything. What would be the proper procedure for breaking this SSO HA configuration? Is it as simple as uninstalling SSO on the server at the DR site or will that cause problems on the primary SSO node?
 
I will be following this closely....;) I'll also do some research...and post if I find anything.
 
For what it's worth, I labbed up a pair of servers running vCenter 5.1.0a with one as a primary HA node and the other as a secondary HA node. External SSO and vCenter DBs. No load balancer or anything else was configured since the customer didn't do any of that. All authentication works fine.

Went ahead and uninstalled SSO on the secondary node and authentication still works even after a reboot of the primary node.

So whatever it is that makes a "HA SSO" configuration simply by installing a second SSO server and telling it to join the primary must not change enough that if the secondary is gone the primary fails to function. Obviously the HA side of things is gone but since my customer has a separate vCenter at each location, no vCenter Heartbeat, or any other services beyond simple vCenter controlling some hosts and SRM, it seems to work fine with the secondary node gone.
 
The HA SSO at the DR location was separate from the SSO required for the vCenter at the DR i'm guessing?
 
Currently they have only one vCenter install which is at the primary DC. Customer installed SSO as primary node in HA at the primary DC then installed SSO on a separate VM at the DR site to join the primary SSO in HA.

DR Site: Secondary HA SSO VM
Primary DC: Primary HA SSO VM, vCenter (both DBs on separate SQL VM)

I'm about to uninstall SSO at the DR site just like I did in my lab then reinstall it without joining it to the primary DC SSO server. Then I can install vCenter in DR so we'll have vCenter in both locations for our SRM implementation.
 
You must log in or register to reply here.
Back
Top