[389-users] Re: SSL configuration on dynamic deployments

> On 23 May 2019, at 17:12, Angel Bosch Mora <abosch@imasmallorca.net> wrote:
>
>> I think to answer this, I'd like to see a diagram or description of
>> the network and deployment topology you have in mind to help advise
>> for what you want to achieve here :)
>>
>
> Is really very simple. Think of it like the typical MMR with 4 nodes:
>
> https://i.imgur.com/DY8aSAo.png
>
> but the number of consumers can go from 2 to N.
>
> all consumers are read only and we have a generic FQDN pointing to them: ldap.example.com
>
> and writable suppliers got their FQDN too: ldapw.example.com
>
> is that enough for you?

I think so.

So your 4 write servers are in mmr. Then you have 2 -> N read-onlys as well which scale up and down.

Do you plan to have ldap.example.com point to the IP's of the read-onlys directly? Or to a load balancer?

If this was me, just because of the scaling requirements, I would actually recommend TLS termination on the load balancer, then ldap plaintext to the 2 -> N consumers (or ldaps to the consumers where the LB trusts the CA that signed the readonlies. IE:


Client -- TLS connection 1 --> [ LB ] -- TLS Connection 2 --> [READ_ONLIES]

TLS connection 1 is presented by the LB, which offers a valid cert/ca chain. The LB then would re-encrypt but trusting the CA of tls connection 2 which is a self signed to the read_onlies.


Another main point here is you'll need to automate that when a read-only is scaled up (added), you'll need to automate the addition of the replication agreements to the write servers + conduct a full reinit on first start.


Does that help?

>
> abosch
>
> -- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent.
> -- Abans d'imprimir aquest missatge, pensau si es realment necessari.
> _______________________________________________
> 389-users mailing list -- 389-users@lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org

—
Sincerely,

William Brown

Senior Software Engineer, 389 Directory Server
SUSE Labs
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org