Highly Available
Novell Nsure® Identity Manager

Perin Blanchard

Software Engineer, Consultant

Novell, Inc.

Shon Vella

Software Engineer, Consultant

Novell, Inc.

Introduction

High Availability (HA) is one of the most-requested capabilities that is not already built into Identity Manager

Asked about on every large deployment

HA is typically achieved through the use of clustering

Identity Manager can't be clustered using NetWare® Cluster Services (NCS)

HA for Identity Manager has been traditionally achieved through a convoluted, manual, incomplete, and fragile process

The Key to Clustering Identity Manager

The key to clustering Identity Manager is the ability to share the same copy of the eDirectoryTM and Identity Manager data between servers

eDirectory data CANNOT be shared between different NetWare® servers in an NCS cluster, but can be shared using StandbyServer* from CaminoSoft.

eDirectory data CAN be shared between different Linux and Win32 servers

eDirectory data can PROBABLY be shared between different AIX* or Solaris* servers (we haven't tried it yet)

Shared Storage

Sharing the eDirectory/Identity Manager data requires some form of shared or mirrored storage

DRBD

iSCSI

Shared SCSI

Fibre-channel SAN

Shared Storage: DRBD

DRBD (Distributed Replicated Block Device) is an Open Source project for mirroring storage between two servers

Requires a dedicated partition on each server

Replicates over IP

Least expensive storage option

Included in SUSE® LINUX

Not available on Windows

http://www.drbd.org

Shared Storage: iSCSI

iSCSI is an emerging standard for sharing disk devices over TCP/IP

Client (initiator) support is included in SUSE LINUX

A NetWare 6.5 server can be used as an iSCSI target

Hardware can be fairly inexpensive (or not)

http://linux-iscsi.sourceforge.net

Haven't yet gotten Windows to work with a NetWare iSCSI target

Shared Storage: Shared SCSI

An dual-connector external SCSI disk or disk array can be shared between two servers

Requires a SCSI adapter in each server

Must be able to change the SCSI address of one of the SCSI adapters

Hardware can be fairly inexpensive (or not)

Configuration can be temperamental

Have demonstrated on both SUSE LINUX and Windows

Shared Storage: Fibre-channel SAN

A Fibre-channel SAN is a high-end shared storage option often used in large or enterprise-class clusters

Hardware can be very expensive

Would usually only be used with an existing SAN infrastructure

Components of a Linux HA Cluster

A typical Linux HA Cluster has several software components, all of which are included in SUSE LINUX Enterprise Server

Cluster Manager (heartbeat)

Shared Storage (e.g. drbd, linux-iscsi)

Resource fencing (heartbeat-stonith)

Resource Monitoring (mon)

Components of a Linux HA Cluster (cont.)

A Linux HA Cluster also has additional hardware components

Server interconnects (serial and additional NICs)

Shared Storage hardware (additional disk or partitions, external shared storage)

STONITH devices (UPS, controllable power switches)

Linux Cluster Manager: heartbeat

Heartbeat provides the core clustering service

Establishes communication between the cluster nodes

Allocates resources to the active node

Resources are SysV init scripts

http://linux-ha.org/heartbeat

Linux Resource Fencing: heartbeat-stonith

Resource fencing is making sure that only one server has access to a particular resource at a time

a plugin for heartbeat

STONITH = Shoot The Other Node In The Head

Helps to maintain the integrity of your shared disk

Support for many different STONITH devices

APC SmartUPS

APC MasterSwitch

Baytech Switch

Operator intervention ("meatware")

Linux Resource Monitoring: mon

mon is an extensible monitoring and notification system

necessary because heartbeat doesn't doesn't monitor status of resources after they are started

need custom monitors to allow monitoring of ndsd

need custom alerts to allow ndsd to be restarted or failed over

http://www.kernel.org/software/mon

Linux iSCSI Cluster

power

power

iSCSI Target

UPS

UPS

Primary Node

Secondary Node

serial

serial

ethernet

ethernet

ethernet crossover

serial null modem

Gigabit Switch

Components of a Windows HA Cluster

A typical Windows HA Cluster includes:

Windows Cluster Services (included in Windows Server Enterprise Edition)

Shared Storage hardware (e.g. shared SCSI, iSCSI, SAN)

Quorum disk hardware (additional disk or partition on shared storage device)

Server interconnects (extra NICs)

Windows Shared SCSI Cluster

SCSI Disk Array

SCSI cable

SCSI cable

ethernet crossover

Network Switch

Ethernet

Ethernet

Secondary Node

Primary Node

Demo

Q&A

Highly Available Novell® Nsure® Identity Manager

2003-12-08T12:43:39