IBM Security Verify

 View Only
Expand all | Collapse all

Policy Server High Availability

  • 1.  Policy Server High Availability

    Posted Wed February 10, 2021 01:29 PM
    Hi,
    I have 2 policy server in clustered environment as master and secondary master. I have 2 FELB with one on each policy server, I have a VIP(192.168.1.1) which is taking traffic for policy server and load balancing the traffic to 2 policy servers as mentioned in the figure below.

    I want to achieve High availability of FELB, So if i reboot the primary policy server, the same VIP present in the secondary FELB in secondary policy server is not taking the traffic as expected and i am getting the following error,
      
    But if i make the load balancer disable manually in Primary policy server then same VIP 192.168.1.1 present in secondary FELB is taking traffic without any issues. But when i restart Primary policy server and it is not available for 5 minutes during the restart in the mean time secondary FELB is not taking the traffic to serve the request(But if i hit the direct management IP of secondary policy server it serves the traffic during restart of primary)

    Why FELB high availability of VIP IP is not accepting the request during primary policy server restart but the same VIP(Present in Secondary server) is taking traffic if i disable manually front end load balancer in Primary server. 



    ------------------------------
    Vasanthakumar Chandrasekaran
    ------------------------------


  • 2.  RE: Policy Server High Availability

    Posted Wed February 10, 2021 04:07 PM
    The first thing which I will ask is why are you trying to achieve policy server HA using a load balancer?  The policy server does not support automatic failover - the policy server on the primary master is the only active policy server in an environment and if something happens to the primary master a manual step is required to promote another machine in the cluster to the primary master role and thus become the policy server.  It appears to be pointless to have a front-end load balancer in this environment when there can only ever be one policy server active.
     
    As far as the automatic failover between mutliple front-end load balancers - have you configured this using the 'High Availability' tab on the 'Front End Load Balancer' panel of the LMI?  If so, the issue sounds like it might be a configuration or networking issue.
     
    I hope that this helps.
     
     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access
    IBM Master Inventor
    Phone: 61-7-5552-4008
    E-mail: scotte@au1.ibm.com
    1 Corporate Court
    Bundall, QLD 4217
    Australia
     
     



    Original Message


  • 3.  RE: Policy Server High Availability

    Posted Fri February 12, 2021 01:43 AM
    Hi Scott,
    Yes, As per Product documentation we should not load balance policy server, But customer is sending restapi calls to modify user account to valid and import new user from LDAP from Webservice web server via restapi calls to connect to policy server. So they asked us to load balance.

    As far as high availability is concerned, high availability configuration's has been configured with remote IP address and rest of the configuration. As per cluster configuration if Primary policy server is restarting, those 5 minutes it is considered as policy server down so secondary policy server cannot actively take traffic for restapicalls for PDadmin.  Is that so, that until we make secondary policy server promote to Primary it will not accept the traffic?

    But when Primary policy server is running and if i send restapi calls only to secondary policy server management ip by disabling backend node of primary policy server then it works(secondary policy server is actually serving traffic). When primary policy server is restarting that time if send traffic to secondary policy server it fails and giving error like runtime environment must be available to perform  this operation.



    ------------------------------
    Vasanthakumar Chandrasekaran
    ------------------------------

    Original Message


  • 4.  RE: Policy Server High Availability

    Posted Mon February 15, 2021 02:43 AM
    Hi Scott,
    One last thing i need to confirm, When primary policy server is down until and unless if we promote secondary policy server in a cluster to Primary manually. All requests reaching to policy server IP address(either to Primary Policy server or Secondary Policy server) it fails? .

    So if primary policy server is down, then entire policy server operations are down until we promote a secondary policy server to Primary?

    For ex: Request such as importing the new user to policy server through restapi calls will fail until we promote a secondary policy server to Primary?

    ------------------------------
    Vasanthakumar Chandrasekaran
    ------------------------------

    Original Message


  • 5.  RE: Policy Server High Availability

    Posted Mon February 15, 2021 03:29 AM
    Vasanthakumar,
     
    If the primary master is unavailable it means that the policy server will be unavailable, until you manually promote a different node to become the primary master.  While the policy server is unavailable WebSEAL will continue to operate due to the fact that it maintains a local copy of the policy database.  You will not however be able to modify the policy until the policy server becomes available again.
     
    I hope that this helps.
     
     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access
    IBM Master Inventor
     
     
     
     



    Original Message


  • 6.  RE: Policy Server High Availability

    Posted Mon February 15, 2021 03:36 AM
    Thank you for the information Scott. I understood now.

    ------------------------------
    Vasanthakumar Chandrasekaran
    ------------------------------

    Original Message


  • 7.  RE: Policy Server High Availability

    Posted Mon February 15, 2021 04:14 AM
    I think it's worth saying that you shouldn't be importing users via the LMI REST API if you need that operation at runtime.

    You should use SCIM or UserLookupHelper to perform these operations. These run in AAC/Fed Runtime and are highly available.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 8.  RE: Policy Server High Availability

    Posted Mon February 15, 2021 08:47 AM
    Thanks Jon. Customer don't have Fed/AAC module activated. I will consider your options and propose to use SCIM or user looker help, instead of rest api calls to import the users.

    ------------------------------
    Vasanthakumar Chandrasekaran
    ------------------------------

    Original Message


  • 9.  RE: Policy Server High Availability

    Posted Mon February 22, 2021 10:25 AM
    Hi Scott,

    Will the WebSEAL server survive a restart if no policy server is available ? I know it will have its read-only copy, but is that persisted so it will survive reboot while the policy servers are down ?

    I guess this is one of the cases where it works better in docker since each webseal container embeds its own policy server - administration of policies however is still done one the single-point-of-failure configuration container.

    Thanks
    /Kim

    ------------------------------
    Kim Rasmussen
    ------------------------------

    Original Message


  • 10.  RE: Policy Server High Availability

    Posted Mon February 22, 2021 03:19 PM
    Kim,
     
    The copy of the policy database is persisted and so WebSEAL will survive a restart or reboot and start just fine without a policy server.  The policy server is only required for administration operations (e.g. policy management, junction management).
     
    Thanks.
     
     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access
    IBM Master Inventor

     
     



    Original Message


  • 11.  RE: Policy Server High Availability

    Posted Tue February 23, 2021 02:14 AM
    Hi Scott,
    Great to know, thanks for confirming this !

    /Kim

    ------------------------------
    Kim Rasmussen
    ------------------------------

    Original Message


  • 12.  RE: Policy Server High Availability

    Posted Tue February 23, 2021 02:19 AM
    Just to be sure you know - use of the old Java API is also considered "administration" and depends on the Policy Server being available. To avoid that dependency you can use the ldap based registry ("rgy") instead that has also much higher performance and only depends on the avialability of the ldap server.

    ------------------------------
    Franz Wolfhagen
    IAM Technical Architect for Europe - Certified Consulting IT Specialist
    IBM Security Expert Labs
    ------------------------------

    Original Message


  • 13.  RE: Policy Server High Availability

    Posted Tue February 23, 2021 03:25 AM
    Thanks Franz,
    We should only be using this in our old useradministration app - and need to migrate that to use ldap directly for everything anyway... only bits it does via the java API now is what can be replaced by going directly to the LDAP secAuthority=xxxx branch.

    Thanks
    /Kim

    ------------------------------
    Kim Rasmussen
    ------------------------------

    Original Message