<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>[correct destination this time]<br><br><hr>From: ctcard@hotmail.com<br>To: openldap-technical@openldap.org<br>Subject: problem using redundant ldap servers with keystone<br>Date: Mon, 15 Jun 2015 18:10:25 +0000<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir=ltr>Hi,<br>I have an HA OpenStack installation with a keystone domain backed by an LDAP server.<br>I want to make the installation resilient in the case of an LDAP server failure, so I have configured keystone with a space-separated list of LDAP server urls in the [ldap] url option. <br>This configuration appears to work well if I e.g. stop slapd on one of the LDAP servers - I can login to horizon as a user from the LDAP directory as long as one of the LDAP servers is running slapd.<br>But if I shutdown one of the LDAP servers, login to horizon fails and the browser (chrome in this case) says "No data received".<br>I've turned on debug logging in keystone, and as far as I can see the LDAP requests are still working; indeed cli commands like "openstack user list --domain <domain>" which get data from LDAP still work.<br>Any ideas?<br>[openstack juno, centos 7, keystone and horizon running as wsgi apps under Apache]<br>Chris<br><br><br> </div>
</div></body>
</html>