<div dir="ltr"><div>Hi Ryan, </div><div>Thanks for giving the insight on how they actually works! </div><div><br></div><div>Regards,</div><div>Ki Wi </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 19, 2016 at 5:24 PM, Ryan Huff <span dir="ltr"><<a href="mailto:ryanhuff@outlook.com" target="_blank">ryanhuff@outlook.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto">
<div>The DirSync service only runs on the publisher and, as you pointed out, handles LDAP directory synchronization. This capability will only issue requests from the publisher.</div>
<div><br>
</div>
<div>LDAP authentication is a separate component that actually uses the tomcat service on the node that issues a bind request the the LDAP authentication sever. LDAP authentication BIND requests can potentially come from any node (assuming
you have LDAP Authentication enabled); although Directory Synchronization (DirSync) will only com from the publisher.</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Ryan</div><div><div class="h5">
<div><br>
On Aug 19, 2016, at 3:56 AM, Ki Wi <<a href="mailto:kiwi.voice@gmail.com" target="_blank">kiwi.voice@gmail.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">
<div>Hi Guys, </div>
<div>Anyone know how this LDAP DirSync works? </div>
<div><br>
</div>
<div>Besides sync directory (as per their name), does this very same service does the authentication with the LDAP servers?
</div>
<div><br>
</div>
<div>Will there be any subscribers be taking over if the publisher is down? Does the subscribers need the DirSync service to be running?</div>
<div>If so,how do we determine which will be the next one taking over?</div>
<div><br>
</div>
<div><br>
</div>
<div>Regards,<br>
Ki Wi</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Aug 5, 2016 at 11:36 PM, Daniel Pagan <span dir="ltr">
<<a href="mailto:dpagan@fidelus.com" target="_blank">dpagan@fidelus.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div lang="EN-US" vlink="purple" link="blue">
<div>
<p class="MsoNormal"><span style="color:rgb(64,64,64);font-family:"Calibri",sans-serif;font-size:11pt">Nice find, Anthony, and a good read.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(64,64,64);font-family:"Calibri",sans-serif;font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(64,64,64);font-family:"Calibri",sans-serif;font-size:11pt">A while back I worked a case where LDAP synchronizations would not complete when the synchronize button was pressed by the customer. While looking into it,
I found it interesting that CUCM would attempt A-record resolution on *<b>all</b>* FQDN server entries before starting the sync task (scheduled and forced), and now it makes even more sense if you’re seeing a three-way TCP handshake and bind request across
the board. Seems like CUCM is using the same entry-by-entry verification steps built into a simple click of “Save” during every directory sync job.<u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="color:black;font-family:"Calibri",sans-serif;font-size:11pt"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><span style="color:rgb(64,64,64);font-family:"Calibri",sans-serif;font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;font-size:11pt">From:</span></b><span style="font-family:"Calibri",sans-serif;font-size:11pt"> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puc<wbr>k.nether.net</a>]
<b>On Behalf Of </b>Anthony Holloway<br>
<b>Sent:</b> Friday, August 05, 2016 9:51 AM<br>
<b>To:</b> Cisco VoIP Group <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> Re: [cisco-voip] CUCM LDAP Authentication Redundancy<u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I'll also add that a "show open ports" on the publisher CLI does show the TCP socket switching to a new port every so often, so my theory as to why it was hanging on to this server is squashed. I should have thought about the life span
of a TCP session, before making that hypothesis.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Fri, Aug 5, 2016 at 8:34 AM, Anthony Holloway <<a href="mailto:avholloway+cisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.c<wbr>om</a>> wrote:<u></u><u></u></p>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentColor currentColor currentColor rgb(204,204,204);padding:0in 0in 0in 6pt;margin-right:0in;margin-left:4.8pt">
<div>
<p class="MsoNormal">Something small to note for you layer 4 geeks out there.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">When CUCM initiates a Directory Sync, a packet capture shows the pub going through a TCP three-way handshake with each of the LDAP servers, in order I might add, and also initiating a simple bind request to each one, finally settling on
performing the search request on the first LDAP server.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">When CUCM initiates an Authentication, a packet capture shows the pub not going through a TCP three-way handshake, but instead, using an already open TCP connection. Perhaps the CUCM Auth code is written this way because authentication
requests are more frequent than dir sync, and so it saves on overhead to reuse a connection rather than setup/teardown connections for each request. That might explain why she's stuck using that one server, but of course it doesn't explain why it started
using that one server to begin with.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, Aug 4, 2016 at 12:59 PM, Anthony Holloway <<a href="mailto:avholloway+cisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.c<wbr>om</a>> wrote:<u></u><u></u></p>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentColor currentColor currentColor rgb(204,204,204);padding:0in 0in 0in 6pt;margin-right:0in;margin-left:4.8pt">
<div>
<p class="MsoNormal">All,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm working on an issue where my CUCM 11.0 system is configured with 3 LDAP servers under LDAP Authentication AND LDAP Directory.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">What I'm see is, for packet captures of CUCM when a login attempt is made, the CUCM server sends the BIND request to the last server in the list of three servers. However, when performing a directory sync, CUCM server sends the requests
to the first server in the list.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm trying to read up on what the expected behavior is, as I've always thought of it as top = primary; middle = secondary; bottom = tertiary. In fact, a few years ago there was an issue with CAD logins, when the primary server was unreachable
and CAD would timeout before CUCM tried the secondary server.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The SRND is no help with only the following passage:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><i>High Availability</i></b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><i>Unified CM LDAP Synchronization allows for the configuration of up to three redundant LDAP servers for each directory synchronization agreement.
<span style="background:rgb(255,242,204)">Unified CM LDAP Authentication allows for the configuration of up to three redundant LDAP servers for a single authentication agreement.</span> You should configure a minimum of two LDAP servers for redundancy. The
LDAP servers can be configured with IP addresses instead of host names to eliminate dependencies on Domain Name System (DNS) availability.</i><u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Source: <a href="http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab11/collab11/directry.html?bookSearch=true#pgfId-1085451" target="_blank">
CUCM 11.0 SRND</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">So, what do you know, or what can you share, that states one way or the other, why CUCM might use a server in the listing, other than the first one, assuming the first server is healthy and accessible?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I did search the bug toolkit and didn't see any defects matching this scenario.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks.<u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
<br>
______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank" rel="noreferrer">https://puck.nether.net/mailma<wbr>n/listinfo/cisco-voip</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div data-smartmail="gmail_signature">
<div dir="ltr">
<div>Regards,</div>
<div>Ki Wi</div>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>______________________________<wbr>_________________</span><br>
<span>cisco-voip mailing list</span><br>
<span><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a></span><br>
<span><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a></span><br>
</div>
</blockquote>
</div></div></div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Regards,</div><div>Ki Wi</div></div></div>
</div>