How to configure ADS Failover

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

You can configure the Active Directory connector to fail over to alternative Active Directory servers. This is useful when multiple domain controllers serve a single Windows domain.

 

The process and prerequisites are discussed in full detail in the Connector documentation (see link below), this information augments the documentation.

 

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-management-and-governance-connectors/1-0/connectors/microsoft-connectors/microsoft-active-directory-exchange-and-skpye-for-business(lync)/Managing-the-Connection-to-Active-Directory/active-directory-failover-setup.html

Environment

All Identity Manager

Cause

Documentation Clarification

Resolution

There are some pre-requisites to making this work which are fully documented, but in summary:

 

1. More than one domain controller must exist in the environment

2. Ensure that the name of the Active Directory server that is specified on the Endpoint page matches its fully qualified DNS name.

3. If you are using SSL, ensure that all of the domain controllers in the domain are configured to use SSL.

4. The "ADS_FAILOVER" system environment variable must be set to 1 on the machines which are running the C++ Connector Server and the Provisioning Manager

5. After these settings are applied the Connector server (CCS) requires a restart.

 

Once you have met the pre-requisites log on to the Provisioning Manager and follow the steps below.

 

1. Click on "Endpoints" icon at the top of the screen.

2. in the Object type: Select "Active Directory Endpoint"

3. Click "Search"

4. The name of your endpoint should appear in the left hand pane.  Double click and you will see the Endpoint properties.

5. Click on the "Failover" tab. (This only appears if you have more than 1 DC in your environment)

6. Ensure that "Failover to the first available backup controller" is ticked.

 

For example:

 

 

7. Click on "Refresh DC list" to get a list of the Backup Domain Controllers (DCs).  This information is propagated from DNS.  

 

For example:

 

8. Click "Apply".

9. Now click on the "Users" icon and click on the search button.

10. Select a user and double click to display their properties. 

11.  Click on the "ADS Domain Preferences"  tab and you will now see the DCs added to the preference list, from here you can set the preference order.

12. Click "Apply" to make any changes.

 

Additional Information

How to change the ADS Endpoints hostname and/or clear the failover list of DCs when a DC is decommissioned
https://knowledge.broadcom.com/external/article?articleId=45113