-1

We have around 50 applications currently configured with LDAP and we have around 20 Domain Controllers. As per the security best practice we have to migrate all these applications from LDAP to LDAPS. Currently, all applications are connected using Domain's "NETBIOS" name so there no need to worry about high availability.

What is the best design approach to achieve high availability for LDAPS?

Prefer not to configure individual DC servers as LDAPS servers in the application. Note: all the servers (DC and application servers) are enrolled in on-prem PKI.

0

It depends on the application, but generally speaking the application owner is responsible for ensuring it uses an available and healthy domain controller.

Also your statement of using the domain single label name - that does not provide high availability.

If all you want to do is connect to a uniform name and not individual domain controller names, include the domain name in the Subject Alternative Name (SAN) for the certificates.

https://support.microsoft.com/en-us/help/931351/how-to-add-a-subject-alternative-name-to-a-secure-ldap-certificate

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.