Clustering with multiple LDAP Base & RootDN

Hello,

I am looking to have a clustered set of ejabberd servers serving the same domain company.com at three different sites.

Each site has it's own unique AD Server, and thus a unique LDAP Base & RootDN to place in the LDAP Query. If I understand the responses to this question correctly (http://www.ejabberd.im/node/533), it is presently not possible to query multiple LDAP Base's and RootDN's.

However, I went ahead and set up individual servers at each site, and joined them in a cluster.

Relevant Configs from Site 1:
-------------
{auth_method, ldap}.
{ldap_servers, ["10.0.3.33","10.0.2.33"]}.
{ldap_uidattr, "sAMAccountName"}.
{ldap_base, "OU=Site 1 Employees,DC=site1,DC=company,DC=com"}.
{ldap_rootdn, "CN=messenger,CN=Users,DC=site1,DC=company,DC=com"}.
{ldap_password, "supersecret"}. % Password to LDAP manager
-------------
{hosts, ["company.com","messenger.site1.company.com"]}
-------------

Relevant Configs from Site 2:
-------------
{auth_method, ldap}.
{ldap_servers, ["10.0.2.33","10.0.3.33"]}.
{ldap_uidattr, "sAMAccountName"}.
{ldap_base, "OU=Site 2 Employees,DC=site2,DC=company,DC=com"}.
{ldap_rootdn, "CN=messenger,CN=Users,DC=site2,DC=company,DC=com"}.
{ldap_password, "supersecret"}. % Password to LDAP manager
-------------
{hosts, ["company.com","messenger.site2.company.com"]}
-------------

All this works as expected! I can have users at site 1 log in with their user information, and users at site 2 log in with theirs. (You cannot - as expected - log into site 1 with a login from site 2, and vice-versa)

But user1@company.com (from site1) can communicate with user2@company.com (at site2), and vice-versa, which is what I wanted.

Here's my question:

Is there anything particularly bad about setting things up this way? (The clustering docs say to make the ejabberd.cfg as identical as possible) Do I run the risk of corrupting databases, etc? Or is all this perfectly well and good?

Thanks in advance.

The authentication is only

The authentication is only used to.... authenticate. Once the user+password is accepted on the server, the authentication system is no longer used during the user's session. Your auth setup is only used to restrict which users can connect to each node. I don't see any reason for the database to be harmed in any way.

That's just me speculating. If you later find any inconvencience, please comment on this thread. Other people will want to know if there are problems.

Syndicate content