Automatic Active Directory Server Switching

Products

• CA Release Automation - Release Operations Center (Nolio)

Issue/Introduction

There are two Microsoft Active Drectory servers configured in Release Automation : AD1 and AD2.

All AD users are replicated on AD1 and AD2.

In case one of the servers stops working, the application automatically connects to the other one?

 

Environment

Release Automation 6.7, 6.8

Resolution

Unfortunately the answer is no.

Users with the same name but from the different AD are treated as the different users. 
User attributes are retrieved from the LDAP/AD but also user's groups are loaded to create a list of user's permissions.

The framework used in Release Automation (spring security) expects just one user with the same username and as result will choose the first user from the retrieved list

Here we might face some random behavior: in some cases it might choose the user from AD#1 and in other cases it might choose the user from AD#2. In every case the relevant configuration of the AD will be used to validate the user and it might give different results depending on the AD server health/availability. According to the current implementation and basic logic there is no way to use different AD servers to validate the same user

This means, the login attempt will fail in case the relevant LDAP/AD is stopped or is not reachable from the nolio server.