Multiple LDAP servers not working

Hi,

I'm trying to set up TeamCity to authenticate against two LDAP (AD) servers. According to the documentation I should be able do do something like:

java.naming.provider.url=ldaps://ldap1.mycompany.com:636/OU=location,DC=mycompany,DC=co,DC=uk ldaps://ldap2.mycompany.com:636/OU=anotherlocation,DC=mycompany,DC=co,DC=uk

Unfortunately, this doesn't seem to work. TeamCity seems only to use the first server. Users from 'location' can log in if I configure as above (but not users from 'anotherlocation'. If I reverse the order of the servers, users from 'anotherlocation' can log in; those from 'location' cannot.

Anyone spot something I'm doing wrong or have I hit a bug?

Thanks,


Andy

4 comments
Comment actions Permalink

Hi Andy,

Sorry for delay in replying.

Unfortunately our documentation isn't accurate at this moment. In fact, you can specify fail-over providers, which will be contacted until one of them responds.
Moreover there is no guarantee of any particular order in which the address list will be processed.

You can file a feature request at http://youtrack.jetbrains.com/, but right now it is not supported.


---
Maxim

0
Comment actions Permalink

Thanks for the reply, Maxim. Actually, the reason I was trying the multiple LDAP servers was to work around bug TW-9610 which I see you're working on. We can continue the discussion there!

Cheers,


Andy

0
Comment actions Permalink

Andy,

I see.
How many users do you have? Is the sync working if you narrow the search filter?

---
Maxim

0
Comment actions Permalink

Maxim,

Yes, the sync works fine as long as I have a search filter which produces <1000 results. As soon as I get more than 1000 results the paging kicks in and I see the exceptions noted in the bug.

I was trying the multiple LDAP servers as a work-around: we have ~1400 potential users located in two centres so I figured that it might be possible to configure TeamCity to hit LDAP (Active Directory) twice using the different OUs for the different centres to limit the number of results returned in each case.

I also tried an extensible   match search on the DN, filtering on the OU, before I realised that AD doesn't support that. Neither wildcards it seems.

Thanks for your help on this.


Andy

0

Please sign in to leave a comment.