topic Re: How to configuring Multiple AD server using LDAP in Administration and Deployment

How to configuring Multiple AD server using LDAP

ASHISH2525 — Fri, 20 Sep 2019 05:21:48 GMT

Hi All,

We have two AD servers XYZ.COM & ABC.COM.
WE have configured LDAP configuration in SASV9_USERMODE.CFG in metadata.

if we attempt to use one at a time it works but when we try to use both at same time. we are only able to login through second one.

-set AD_HOST XYZ.COM
-set AD_PORT 389
-authpd ADIR:XYZ.COM
-primpd XYZ.COM

-set AD_HOST ABC.COM
-set AD_PORT 389
-authpd ADIR:ABC.COM
-primpd ABC.COM

/sasconf/Lev1/SASMeta/MEATADAServer

Sasv9_usermod.cfg

Regards,

Ashish

Re: How to configuring Multiple AD server using LDAP

AnandVyas — Fri, 20 Sep 2019 05:57:46 GMT

Hi @ASHISH2525 ,

Did you try the format provided in the admin guide?

https://documentation.sas.com/?docsetId=bisecag&docsetTarget=n0w8oa3erw568vn192xwf0872npk.htm&docsetVersion=9.4&locale=en#n0oa5gj8lu1n99n1y1bx81q4um7h

Multiple LDAP Servers

SAS can recognize multiple LDAP servers as authentication providers, regardless of whether there are trust relationships among those servers.

For example, to cause the metadata server to search three Active Directory servers (AD1, AD2, and AD3) when authenticating users, set the AUTHPROVIDERDOMAIN system option as follows:

-authpd (ADIR:AD1, ADIR:AD2, ADIR:AD3)

To enable SAS to locate all three LDAP servers, supply information about each server through associated environment variables. To indicate which LDAP server each variable describes, append the server's name to the variable name. For example, with the preceding AUTHPD syntax, you might set server-specific variables as follows:

set AD_HOST_AD1=machine1.company1.com
set AD_HOST_AD2=machine1.company2.com
set AD_HOST_AD3=machine1.company3.com

AUTHPROVIDERDOMAIN=(provider:domain-name)

specifies an alternative authentication provider. When the AUTHPROVIDERDOMAIN parameter is omitted from the metadata server start command, the metadata server uses host authentication to authenticate users. AUTHPD is an alias for AUTHPROVIDERDOMAIN. For usage information, see Direct LDAP Authentication in SAS Intelligence Platform: Security Administration Guide.

Note: In UNIX operating environments, you must insert an escape character before each parenthesis. For example:-authproviderdomain = \(ADIR:MyDomain\)

Thanks!

Re: How to configuring Multiple AD server using LDAP

ASHISH2525 — Fri, 20 Sep 2019 06:35:26 GMT

@AnandVyas

Hi,

Thanks for your quick response. Right now we are doing this.

-set AD_HOST_ABC ABC.in
-set AD_HOST_XYZ xyz.XX.XX.in
-authpd (ADIR:ABC, ADIR:XYZ)
-set AD_PORT 389

Can you recommend the changes we should do in above. we are on Linux Os.

Regards,

Ashish

Re: How to configuring Multiple AD server using LDAP

AnandVyas — Fri, 20 Sep 2019 06:56:50 GMT

Can try this?

-authpd \(ADIR:ABC, ADIR:XYZ\)
-set AD_HOST_ABC ABC.in
-set AD_HOST_XYZ XYZ.xx.xx.in
-set AD_PORT 389