Author : Sanjeev Gupta
This AppNote aims to provide procedure to configure Novell Business Continuity cluster (BCC) and Identity Manager in a multiple eDir tree environment.
Table of Contents
2. Requirements and assumptions
3. Installing and configuring BCC software in single eDir tree
4. Installing and configuring IDM on second tree
4.1 Creating Cluster Resource Synchronization driver
4.2 Creating User Object Synchronization driver
4.3 Creating certificates for Cluster Resource Synchronization driver and User Object Synchronization driver
4.4 Starting Drivers and enable BCC on cluster on second tree
5. Add peer cluster credentials
6. Add search-and-replace values to the cluster replacement script
BCC: Novell Business Continuity Cluster Services software is an integrated set of tools to automate the setup and maintenance of a business continuity infrastructure.
It automates business continuity cluster configuration, maintenance, and synchronization by adding specialized software.
Novell Business Continuity Cluster software creates a cluster of clusters, which provides the ability to failover selected or all cluster resources from one cluster to other clusters at separate geographic sites.
Note: BCC 1.2 on Linux doesn’t officially support multi tree deployment. Please verify the support from documentation before configuring in your production setup. I did this setup on the beta builds to write this document.
Identity Manager 3.6: Novell Identity Manager 3.6 is a comprehensive identity management suite. It allows organizations to manage the full user lifecycle, from initial hire, through ongoing changes, to ultimate retirement of the user relationship. Identity Manager includes capabilities for automated provisioning and de-provisioning of user accounts, approval workflows, managing passwords, and managing user data throughout your organization's directories, applications, databases, and OS platforms. Through streamlined user administration and processes, Identity Manager helps organizations reduce management costs, increase productivity and security, and comply with government regulations.
The setup, I am using to write this application note looks like the diagram below.
Configuring BCC for more than one eDir tree requires the following steps.
For multi tree setups, we need to add a BCC user synchronization driver too. This driver will take care of synchronizing users between both eDir trees and ensure that users can access the resources even when resources failover between trees.
To create this driver on our new tree "BCC2", launch iManager from the server hosting IDM on "BCC2" and login to the tree.
Example Driver Set Summary for a Multiple-Tree, Four-Cluster Business Continuity Cluster.
|Driver Set for Cluster One|
|Driver Set for Cluster Two|
|Driver Set for Cluster Three|
|Driver Set for Cluster Four|
|C1 to C2, port 2002|
|C2 to C1, port 2002|
|C3 to C1, port 2003|
|C4 to C3, port 2004|
|C1 to C3, port 2003|
|C3 to C4, port 2004|
|C1 to C3, port 2001|
|C3 to C1, port 2001|
For multi tree IDM drivers, there should be NDS-to-NDS SSL certificates created for the drivers so they can communicate with each other. Here are the steps to create the required certificates.
Lets start with creating certificate for Cluster Resource Synchronization driver.
As you can see in the above screenshot, in Connections, all the clusters from both the trees are visible but with "invalid credentials" state. For the clusters to communicate correctly, we need to provide the peer cluster credentials on all the clusters.
To add the peer cluster credentials, do the following for each node of every cluster in the business continuity cluster:
To enable a resource for business continuity, certain values (such as IP addresses) specified in resource load and unload scripts need to be changed in corresponding resources in the peer clusters. This is due to fact that different clusters specially in different trees in different networks would be using their own network configurations and i.p address schemes for networking. You need to add the search-and-replace strings that are used to transform cluster resource load and unload scripts from another cluster to the one where you create the replacement script. His will ensure that strings like i.p address pool names etc are replaced with required names and i.p addresses when they move to new network environment. Replacement scripts are for inbound changes to scripts for objects being synchronized from other clusters, not outbound.
To add search-and-replace values to the cluster replacement script:
After finishing the above configuration, you can see the property of each BCC enabled resource and add the new cluster in the "Resource Preferred Clusters-Assigned" list. This will ensure that the resource can be failed over to the new cluster as well.
For more information on BCC you can visit the links mentioned below: