Our situation
We currently have many web applications that use LDAP for authentication. For this, we point the web application to one of our AD domain controllers using the LDAPS port (636
).
When we have to update the Domain Controller, this has caused us issues because one more web application could depend on any DC.
What we want
We would like to point our web applications to a cluster "virtual" IP. This cluster will consist of at least two servers (so that each cluster server could be rotated out and updated). The cluster servers would then proxy LDAPS connections to the DCs and be able to figure out which one is available.
Questions
For anyone that has had experience with creating an HA cluster for AD's LDAP interface:
- What software did you use for the cluster?
- Any caveats?
- Or perhaps a completely different architecture to accomplish something similar?
Update
Perhaps my question wasn't initially clear enough. My apologies for that.
These web applications are not developed by us and are not AD-aware. They only ask for an LDAP server's hostname/IP address. Unfortunately, we have to work with that restriction. I understand how SRV records
work but, being these are not our applications, doesn't help us in this case.
It is also not realistic for us to force the developers to modify their applications to be AD aware.
The only option is to address this issue within the infrastructure as oppose to the software. My questions are directed toward anyone that has done that specifically.