Hi all,
Question,  If I use federated repositories with a LDAP server and the file-based repository, if the LDAP server goes down, I still can authenticate with an user configured in the file, right?

Regards! ;)

 

should be 

Hi! 
Look what I found in "Limitations of Federated Repositories" 

If one or more repository in the federation is down, you will not be able to authenticate (even as an admin), regardless of which repository your particular ID is stored in. The VMM component always checks all repositories before letting an authentication to succeed. 

So, I guess not. :( If you find something else, please let me know ;) 

Source:
www.ibm.com/developerworks/websphere/tec... 

Jasmin

Do you have more than one LDAP server if so you can perform LDAP lookups to the domain name vice the actual LDAP server name? This is an example of the our settings for one of my cells that use standalone LDAP registry (please note the domain name has been changed for security)

Host (this host does not exist I had my DNS team set this up and it points to multiple LDAP server)

                   Adsauth.state.lost.us

Base distinguished name (appusers is the OU that I want the ldap lookup to be done in so the app is not searching the whole 123.state.lost.us domain for a user)

                   OU=appusers,DC=123,DC=state,DC=lost,DC=us

 

Yes, there is a configuration option that enables the authentication to continue if one or more other registries are down, as long as the ID is found in one of the registries that are still up and functional.
The federated repository configuration command to permit this is:

$AdminTask createIdMgrRealm -name ibmRealm -allowOperationIfReposDown true

More information can be found in the Information Center article: IdMgrRealmConfig command group for the AdminTask object.

Tony makes a great call out that you may want to consider using a DNS entry to add a bit of Disaster Recovery (DR) to your infrastructure.  By using a DNS entry, you should not experience an inability to authenticate when logging in or launching services if the LDAP server is unavailable.  You should check with your system administrators who are responsible for your LDAP system as this may already be created (many mid-large companies already do this.)
 
@Anitha -Thanks for posting that information!  This would be a great addition to our DR planning!
 

Great tip anitha! That's what I need, I believe. Thank you very much.
And Thank you all for your responses! ;)