FIM Load Balancing and SPN's - Strange behaviour

I have a FIM setup in a domain
I have mycorp.com and a domain in the same forest contractor.mycorp.com (fictional setup)
I have 2 servers built in the contractors.mycorp.com domain
Id1
Id2
Id1 has the Service and portal on wss3 in SharePoint farm mode, Sp central admin is on this as well
Id2 has the service and is a load balanced SharePoint farm.
I have NLB setup and working the service name is identity.mycorp.com pointing at the IP of the NLB
I have a CNAME identity pointing at identity.mycorp.com
Identity.mycorp.com is used as the name of the Service and the Portal.
In the ApplicationHost.config I have
<system.webServer>
   <security>
      <authentication>
         <windowsAuthentication enabled="true" useKernelMode="true"
useAppPoolCredentials="true" />
      </authentication>
   </security>
</system.webServer>
I have kernel mode enabled, and I have Windows authentication enabled in the IIS console on id1 and id2.
The app pool credentials are a domain account SPService for SharePoint Service, the app pool is set on both id1 and id2 servers. The root domain account mycorp\SPService us used.
In
c:\inetpub\wwwroot\wss\VirtualDirectories
I have set
<resourceManagementClient
requireKerberos="true"
I have registered the alternate URL mappings for SharePoint as
Identity
Identity.myCorp.com
I have registered SPN's for
Setspn –S FIMService/identity.myCorp.com myCorp\FIMService
Setspn –S FIMService/identity myCorp\FIMService
Setspn –S HTTP/identity.myCorp.com myCorp\SPService
Setspn –S HTTP/identity myCorp\SPService
I have configured delegation for both accounts in ADUC for the identity.mycorp.com
So all is well and I installed everything fine.
Now my problem is that if I go to id1 and browse to http://identity/identitymanagement I get redirected , and authenticated with my admin account to
http://id1/IdentityManagement/default.aspx
On id1 if I go to http://identity.myCorp.com/identitymanagement I get prompted for credentials, when I enter myCorp\FIMAdmin and my password I get redirected to the portal at
http://id1/IdentityManagement/default.aspx
If I try and authenticate to any of the previous URL's from other machines in my domain, including the load balanced box id2 I get "HTTP Error 401. The requested resource requires user authentication."
Even if I try and browse to
http://id1/identitymanagement from another machine I am getting 401. Only on
http://id1 am I getting a result, even if there is a prompt.
I am sure my SPN's are fine, there are no duplicate SPN's , I checked with the -x switch
So my load balanced portal and service are not working as I would have thought , I have looked at
http://blogs.msdn.com/b/webtopics/archive/2009/01/19/service-principal-name-spn-checklist-for-kerberos-authentication-with-iis-7-0.aspx
http://social.technet.microsoft.com/Forums/en-US/484faae8-4df6-4b81-8b2d-9d75d5258e4f/fim-portal-http-error-401-the-requested-resource-requires-user-authentication?forum=ilm2
http://social.technet.microsoft.com/wiki/contents/articles/4473.fim-http-error-401-the-requested-resource-requires-user-authentication.aspx
http://setspn.blogspot.ie/2010/06/kerberos-basic-troubleshooting-tip-3.html
The only thing that I can think of is that the machine is in the contractors.myCorp.com domain which makes the machine
unique from where the SPN's are registered, but if that was the case then browsing to the portal from
http://id1 would certainly fail.
Can anyone see anything wrong with my approach ?
Normally I find SharePoint a pain, but this week it seems to be this.
When I ran the fim service install I specified identity.myCorp.com as the name of the server
Rob

In my Load Balanced setup it helped a lot (on some strange behaviours) when I set up Load Balancer to keep session on one server.
Borys Majewski, Identity Management Solutions Architect (Blog: IDArchitect.NET)

Similar Messages

VPN load balancing and ASA !!!

Hi netpros,
I have a couple of questions about this and hope you might be able to assist me.
1.- Are VPN load balancing and failover (Active/Active) mutually exclusive ..? I mean they can't be used at the same time correct ..?
2.- How does the ASA handle the return traffic from the Internal LAN towards the remote client .. Because the cluster only requires ONE public virtual IP address, which will work for incoming packets .. but what about the return traffic which has knowledge of the DHCP scope's default gateway IP address only .. ? How gets the returned packet redirected from the default gateway IP address to the respective ASA internal IP address .?
3.- VPN load balancing only applies to remote clients using easy VPN technology (easy vpn client, hardware client , pIX using easy vpn client etc ) and does not work with static LAN-LAN tunnel .. correct ..?
Your comments are much appreciated

Hi Gilbert ..
1.- Thanks I wanted to make sure.
2.- I know that .. my question is in regards the return packets .. for example if I have the below IP schema:
ASA1: Public 20.20.20.20
Private 192.168.1.1
ASA2: Public 20.20.20.21
Private 192.168.1.2
Cluster virutal IP: 20.20.20.10
Default gateway for segment 192.168.1.0 is 192.168.1.1
Let's say that a vpn client tries to connect and the cluster instructs the client to connect to ASA2 20.20.20.21. The packets reach the internal server at 192.168.1.100. The internal server then sends the return packets back to the client by forwarding them to its default gateway which is 192.168.1.1 (ASA1). Here is my question .. how does the cluster handles this because the return packet are supposed to be directed to ASA2 192.168.1.2
3.- Any idea about this one ..?
Cheers,

Load balancing and rfc metadata repository in reciever rfc communication ch

hi.
i want to know the purpose of load balancing and rfc meta data repository in RFC communication channel.
and can u send me any examples on this load balancing.
waiting for your response.
bye.
regards.
seeta ram.

Hi Seeta Ram,
Load distribution is handled by the message server (there is one message server in an SAP System). When a user logs on, the message server assigns him or her to the application server that currently has the <b>smallest load</b>.
Well now you can understand that we use load balancing for better performance by distributing the work to different processes to balance or maintain the work load in SAP system.
For more information refer to this link
http://help.sap.com/saphelp_nw04/helpdata/en/28/75153a1a5b4c2de10000000a114084/content.htm
Regards
Sumit Bhutani

Advantages of using a webserver inbetween a load balancer and application servers

I am building out a new weblogic domain.
I am wondering which one of these configuration to go with:
1. Load balancer > weblogic servers
2. Load balancer > web server > weblogic servers
Could someone tell me what are the specific advantages of having web servers inbetween a load balancer and application servers (besides caching static data content and acting as a proxy)?
Thanks in advance
Srini

Other than hosting the static content, nothing much really. We have our load balancer go straight to WL for applications without static content and route to web server if there is static content. Easy enough to do it both ways, best of both worlds.

For a true load balancing and high-availability OHS, OPMN, and mod_oc4j

i have read this link of Enabling Clustering on oc4j9.0.4 standalone app server
http://www.oracle.com/technology/docs/tech/java/oc4j/htdocs/getstart.htm#1015479
To test the clustering, start up the load balancer by executing "java -jar loadbalancer.jar".
C:\OC4J_EXTENDED\j2ee\home>java -jar loadbalancer.jar
In a future release of Oracle Application Server, loadbalancer.jar will be
desupported. Because of this, we strongly suggest that you discontinue your use
of loadbalancer.jar in this release. Under high loads, loadbalancer.jar may not
function properly. For a true load balancing and high-availability solution,
please move to use OHS, OPMN, and mod_OC4J. For more information, please see
http://otn.oracle.com/products/ias/ohs/content.html
Balancer initialized...
what load balancer should i use for web clustering
<frontend host="balancer-host" port="balancer-port" />
balancer-host=localhost
balancer-port=80
for all nodes i mentioned same host and port in http-web-site.xml.Is it correct?
i completed all the steps and run http://localhost:6666/session/SessionServlet
i hit 3 times
in the different browser http://localhost:7777/session/SessionServlet
instead of coming 4 it starting from 1 only.

can i use this loadbalancer.jar or not?
how to mod_oc4j in standalone app server

Load balancing and High Availability topology

Our Forms 6i client-server application currently runs on Citrix farm of 20 Windows 2000 boxes (IBM Blade Servers 2 CPU and 2 Gig Memory).
Application supports 2000 users.
We are moving to AS 10g r2, forms 10g and the goal is to use same hardware, 20 Windows boxes (or less), for intranet web deployment.
What will be our best choices for application Load balancing and High Availability?
Hardware load balancer, Web Cache, mod-oc4j? Combinations?
Any suggestions, best practices, your experience?

Gerd, I understand, that you are running 10g web forms through the browser, but using Citrix for deployment. This means that in addition to Application Server and Forms runtime sessions, it will be separate browser session opened for each user. What the advantage of this configuration?
Michael, we are aware, that Citrix is not supported by Oracle as a deployment platform. That only means that prior contacting Oracle Support we have to reproduce the problem in standard environment. It was never been a problem to reproduce problem :) We were using Citrix as a deployment platform for Forms 6i client/server for 4 years, but now we are forced to upgrade to 10g.
We are familiar with various Load balancing options available. The question is which option is the most "workable" in our case.

2 ISP load balancing and redundancy

Hello!!
Our small company has about 40 branches spreaded within city. Branches are connected by optic wire supplied by our ISP. So in ISP our branches are located in one VLAN. From every branch we created VPN tunnel to our server room in central office. Central office is like a cetner point. If optic wire fails to central office, there would no VPN tunnels and no network to all branches. Moreover, all the traffice goes through central office.
Now we decided to pave one more optic line to our central office. And that will increase bandwidth and redundancy.
Private network topology: There are no default gateways and ip-addresses. For examle, at first branch I will plug computer directly into media converter and at the second branch plug another computer to the media converter. After that this two computers became in one network. And can assign any ip addresses to them.
What I have: our firewall do enough work, don't want to overload it. But we have some free ports in our new cisco 3750. The question is how to do load balancing and redundanccy? Can it do load balancing according to traffic? And how load balance incoming traffic? For example, connection was established from branche's router, how this router will choose through which line make connection? By the way, at all branches we use noisy cisco
3700 series routers.

Sorry for upping 1 year old threat.
We talked to our Network Provider. They said "these two cables are coming from two different places, so there is no way to use etherchannel. You must use active-standby solution."
Relying on STP we just put two cables into 3750 stack. But with default STP settings, connection was very unstable, many packet losses and disconnections. So we found easy solution with "flex links", making one interface backup of the other. And only now I recognized that this is not a failover solution. Because, if network beyond media converter will down, link from media converter to switch would still up.
What could I do to make our L2 WAN redundant? Are there any additional STP settings.

Load balancing and Failover

Hello,
We are wondering how load-balancing and failover of tpcall() work with
WTC:
The scenario:
We have one WLS Domain and two Tuxedo Domains. The Tuxedo Domains offer
the same set of services.
In the bdmconfig.xml, we specify connection_policy as 'ON_STARTUP' for
both Remote Tuxedo Domains. We also Import (T_DM_IMPORT) the same
Tuxedo Service from both Tuxedo Domains.
Questions:
1. Is there any load-balancing of the tpcall between the two Domains? If
so, is it round-robin? If round-robin, what determines the order?
2. If it is ONLY Failover, what determines the order of the tpcall? And,
is the Failover automatic? Or do we need to code for retry on failure?
3. ON_DEMAND vs ON_STARTUP: Does ON_DEMAND drop the connection to the
remote domain upon tpterm? And does ON_STARTUP use a pool of
TuxedoConnection objects?
4. Are there any configuration parameters for
'max_number-of_connections? What determines how many simultaneous
connections can be made?
Thanks,
Suresh Mohan.

Hi Suresh,
The following are my answers to your questions.
Suresh Mohan wrote:
Hello,
We are wondering how load-balancing and failover of tpcall() work with
WTC:
The scenario:
We have one WLS Domain and two Tuxedo Domains. The Tuxedo Domains offer
the same set of services.
In the bdmconfig.xml, we specify connection_policy as 'ON_STARTUP' for
both Remote Tuxedo Domains. We also Import (T_DM_IMPORT) the same
Tuxedo Service from both Tuxedo Domains.
Questions:
1. Is there any load-balancing of the tpcall between the two Domains? If
so, is it round-robin? If round-robin, what determines the order?Yes there is a load balancing between two remote Tuxedo TDomain Gateways.
The algorithm is random, not RR. Over time this should give equal
opportunities to both remote TDomain.
>
2. If it is ONLY Failover, what determines the order of the tpcall? And,
is the Failover automatic? Or do we need to code for retry on failure?The load balancing is always there. The failover is automatic. When a
connection to a remote TDomain encountered a problem (ie network) the remote
domain will be put on retry open connection (in ON_STARTUP) and the load
balancing will not select it until the connection re-established.
However, the tpcall() that encountered the error will not be retried to send
to different destination. It is up to the application to decide whether it
want to resend. Any requests called after the error will not select the
failed Remote TDomain.
>
3. ON_DEMAND vs ON_STARTUP: Does ON_DEMAND drop the connection to the
remote domain upon tpterm? And does ON_STARTUP use a pool of
TuxedoConnection objects?TPTERM() only terminate your application session to WTC. WTC still maintain
a secured T-session to remote Tuxedo TDomain. WTC does not use a pool of
TuxedoConnection Objects, the object stored in the JNDI refers to WTC.
>
4. Are there any configuration parameters for
'max_number-of_connections? What determines how many simultaneous
connections can be made?No. As described in #3, there is no need to use connection pool in WTC. WTC
uses session and virtual circuit design concept as Tuxedo TDOMAIN, the
logical pool is created/destroyed dynamically. That is the reason why you
can have a lot of TPACALL() outstanding at the same time. (The limitation is
the availability system resource.)
>
>
Thanks,
Suresh Mohan.Regards,
Hong-Hsi :-)

Discussion on load-balance and load-sharing

Hi, I found a article, which discuss the difference between load-balance and load-sharing. I think the explanation is pretty good, please see below. But I still have a question: how can we decide to choose one the both balance in the production environment ? Thank you
"In short, load balancing tries to distribute traffic evenly over multiple paths, whereas, load sharing intends to do it (for the lack of a better term) equally. True load balancing is difficult to achieve. For example, let's say there were two links (100 mbps and 300 mpbs) and a router needed to send out 600 mbps of traffic. Load balancing would distribute the traffic evenly, sending 300 mbps on each link. On the contrary, load sharing would divide the traffic equally based on the available resources, sending 200 mbps on the slower link and 400 mbps on the faster one. "

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
That's not how Cisco uses the terms, and generically they are often used almost interchangeably.
Cisco uses load balancing as the catch all for how a single L3 device routes across multiple paths to the same destination. Equal metrics or equal actual load distribution are not required. Most often, load balancing will be discussed with ECMP, but unequal path loading balancing will include Cisco's proprietary IGPs, such as EIGRP.
Cisco uses load sharing when using multiple paths when a single L3 devices doesn't normally route across multiple paths or multiple L3 devices are involved. Cisco load sharing discussions usually revolve around BGP.
Generically, I would say load balancing has more of a dynamic aspect to it, i.e. something is trying to actively balance traffic across multiple paths, while load sharing might mean multiple paths are utilized but not actively dynamically balanced.
I'm unsure what's your question with a production environment.

Load Balancing and Failover with 10G Standard Edition

Hi,
I am new to Oracle Replication and need some help setting up replication for load balancing and failover. Is this possible using Oracle 10G Standard Edition? I plan on having all updates done on the master site and both databases will be for reads. In case of failure of the master site, I would need to be able to failover to the other database.
Also, if anyone knows of any documention for Basic Replication in 10G, please let me know.
Thanks.

Simple nnapshot replication of data would require significant manual effort to configure to load balance or failover. One the load balancing side, you would generally be limited to to static load balancing-- assigning half the users to one machine and the other half of the users to the other machine, regardless of who is actively using the machine. Failover would be a significant manual effort, particularly to bring the failed machine back into the cluster. You would be implementing the guts of multi-master replication.
Frankly, if you actually have a system which is valuable enough to need load balancing and disaster recovery, I'm going to wager that it will be far cheaper even in the short run to buy more boxes and/or enterprise edition licenses than to try to implement this sort of thing yourself. In the long run, it will be far cheaper, since it will be far easier to maintain. Building all this yourself would probably be penny wise and pound foolish.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Load balancing and RFC problem

Hi!
I have a problem regarding load balancing and RFC's. We use the follow function in librfc32.dll (from VB6) for RFC calls: RfcOpenExt It's working fine no problem, but from now on we will have to use the this funcion due to load balancing: RfcOpenExtV3
The only difference between the two functions is the parameters. RfcOpenExtV3 has 5 additional parameters:
intLoadBalance1, strLbHost1, strLbSysName1, strLbGroup1, intSapGui1
I asked our tech guys for the details so that I can set up the parameters (double check everything) and the RfcOpenExtV3 doesn't working. Return value is zero.
Have somebody faced with this issue before?
Thanks in advance!

Hi,
1. Probably this link may help.
[http://help.sap.com/saphelp_nw04/helpdata/en/22/042f18488911d189490000e829fbbd/content.htm]
Especially see the function parameters on this page,
which are the bottom.
regards,
amit m.

TES6.1 Load Balancing and DSP

Haven't gotten much response to my other posts, hoping I get some about this.
For those using load balancing, do you name your DSP the same on both servers? I was trying to see if there were pros and cons to naming them different or the same (or if you can't name them the same).
We have them named different, one is TesDevCM1 and the other is TesDevCM2. This makes it easier to troubleshoot and know where someone is connected BUT I realize that this is not good when you are trying to truly utilize loadbalancing for example for Transporter and TESCmmandline as this forces you to bound these apps to a specific CM.
Just wanted to see if there were opinions out there. (Made my post shorter, hopefully someone will respond ^_^)

Hi Jesse,
Actually it works after you asked me to go through the web cache documentation which i posted question on how to do the load balancing and failover. Thanks for you help. I just want to double confirm whether i did correctly. Since i have problem in passing the session variables. Which the server switch between the two servers for load balacing, it can't bring the session variables from server 1 to server 2. It will give error on the pages. I want to ask whether anyway to bring the session variables from server1 to server2??
Besides, can you please tell me if i just wanted to have failover but not load balancing, can this be done???
Thanks
Regards,
Ming Jade

UAG External Load Balancing and ISATAP

Hi Experts,
I am deploying a UAG Array to be used for Direct Access. The Array will consist of two servers and use an F5 External Load Balancer. In addition and in similarity
to 90% of the other corporate intranets out there, the internal network is IPv4 with no IPv6 transition technologies deployed. The article
http://blogs.technet.com/b/edgeaccessblog/archive/2010/05/17/configuring-an-external-load-balanced-uag-directaccess-array-for-an-ipv4-only-network.aspx
isgreat but to my mind has no information to support ‘Manage Out’ and throws up a number of questions: (Note that I want to enable ‘Manage Out’ capability and as far as I am aware that is achieved by using ISATAP)
The article describes that you have to generate and configure your own IPv6 address for the internal interface when using an external load balancer. Does anyone know why? Why not let UAG assign
the addresses as per the default?
UAG by default configures itself as an ISATAP router when there is no IPv6 infrastructure deployed on the internal network
to facilitate ‘manage out’. This still applies when using Windows NLB. Why does this no longer apply when using an external load balancer? I.e. Why does UAG no longer configure itself as a ISATAP router?
In relation to question 2; you therefore need to move your ISATAP router to a different device (http://technet.microsoft.com/en-us/library/ee690463.aspx),
in doing so how do you configure the ISATAP environment to traverse the UAG servers without some sort of load balancing on the internal interfaces? I’m assuming that you can only tell the ISATAP router to use the one default gateway i.e. either one UAG server
or the other. This means that you would have all your outbound internally initiated traffic going via one server only – not very good for performance or fault tolerance.
In relation to question 3; I thought therefore that NLB could be used on the internal interface to solve the above problem, except that I have read that you can’t mix and match external load
balancing and NLB even though they are on separate networks due to bidirectional affinity. What does this actually mean and why does this not occur when load balancing is mixed in this manor?
Therefore when you wish to use external load balancers, do you:
A) Except the fact that you can’t use UAG as a ISATAP router and you do indeed need two devices
and deploy it as described here (http://technet.microsoft.com/en-us/library/ee690463.aspx)
or
B) Except the fact that that you can’t use UAG as a ISATAP router and any internal outbound
traffic travels via the one UAG server only.
Apologies for the long post, but I wanted to make sure that I get my thoughts down concisely so that it may help others who come up with the same questions
J
Thanks for your time everyone
Gary

I am also facing the same issue. I have UAG1 and UAG2, which are in an array, and externally load balanced. I've configured an external ISATAP router according to:
http://www.windowsnetworking.com/articles_tutorials/Configuring-ISATAP-Router-Windows-Server-2008-R2-Part2.html. However, as mentioned by others, the ISATAP router has to have either UAG1 or UAG2 as the next hop for IP-HTTPS traffic. As
a result, communication between the DirectAccess client and management devices will only work if the client is tunneling through the same UAG server that the ISATAP router has as the next hop for the IP-HTTPS prefix. From what I can tell, my configuration
is supported, but I can't figure out how to have the ISATAP router determine which UAG server a client is tunneling through. I thought about having two separate IP-HTTPS prefixes for each UAG server, but this would get overwritten when activating
the DirectAccess configuration. Maybe some type of internal load balancing?

OCS on a cluster with Load balancing and fail safe environment

Dear all,
i want to ask is there any documat or hints on how to do an OCS R2 installaiotn on 3 server with RAC option (clustered Fail Safe), how can i install OCS on a cluster with Load balancing and fail safe environment.
plz i need ur help
thanking u
[email protected]

Dear all,
i want to ask is there any documat or hints on how to do an OCS R2 installaiotn on 3 server with RAC option (clustered Fail Safe), how can i install OCS on a cluster with Load balancing and fail safe environment.
plz i need ur help
thanking u
[email protected]

ISA570-Load balancing and Losing packets

I am load balancing two isp's. One isp is fine, but the other I have very high packet loss when pinging the corresponding wan interface from any machine located outside our network. During the packet loss, I cannot https to our firewall from outside our network, but I can rdp using a different address on that same isp and ping another machine located inside our network, it seems only the wan interface is having the issues. Our isp uses icmp to our wan interface and they started noticing the loss the other day, again the other isp loses no packets. I have no issues with clients losing connection from that isp so it looks like it is an issue from outside in only on that wan interface.
I have a spare ISA and that is experiencing no packet loss when using another ip from the problem isp on it's wan interface. The isa's have the same configuration and when I tried moving completely to the backup isa it continued with the same issue. Upgraded to a later firmware, still the same issue. I even took a laptop and put it on our switch that is before the isa and gave it a static public address and I can ping it with no problem from the outside. I can also ping from the laptop to the wan port of the prod isa that is losing packets and it replies as it should, which I assumed would lose packets if it were the isa having issues, but it didn't.
I know this has nothing to do with Cisco security services as on the backup firewall it was still losing packets when we moved the connections over to it.
I can ping from inside my network to the public wan address with no loss when outside machines are having problems.
I can ping the problem wan address from a laptop or from isa(IP = 64.x.x.42) to isa(IP = 64.x.x.45) with no packet loss.
This is a head scratcher and I need some real help here.

Never figured this one out. However, I was able to figure out how this starts. A couple of weeks ago we had an issue with an ISP and we disabled that interface during the day and re-enabled at the end of the day and thats when we noticed ICMP breaks to other ISP.. I don't know why but the ISP we renabled we can ping just fine, but the other one always has issues. The only fix is to enable link failover detection and both WAN interfaces become pingable again.
Now, we use load balancing and one issue we are experiencing is that randomly both WAN interfaces go down and I can confirm this with a ping utility we use off site that pings both WAN interfaces and also each ISP gateway they are connected to. When this happens the ISP's gateways are reachable and neither WAN interface on the ISA are. I am still on .15 version of the firmware, because there were too many issues with newer releases. Is this a known issue?

FIM Load Balancing and SPN's - Strange behaviour

Similar Messages

Maybe you are looking for