Secure LDAP with Multiple DPS's on Single Physical Server

I am having an issue connecting to the directory server over SSL via the directory proxy server. I have enabled SSL and tested successfully in some situations, however this situation is unique.
DPS 5.2 patch 4
Directory Server patch 4
I have applied the neccessary hotfixes from sun to resolve the SSL issues.
There are 3 physical servers. 2 of those servers each have 2 instances of directory proxy server running. The 3rd server has 2 separate Directory Server instances running (1 for enterprise authentication, 1 for Access Manager). Each physical proxy server has 1 instance running for each Directory server instance (1 enterprise LDAP, 1 AM LDAP). All 4 proxy instances can connect successfully to the Directory Masters over the unsecure ports (389 for enterprise LDAP, 55389 for AM LDAP). On the proxy servers, only the initial proxy instance can connect to the secure port successfully. For instance, on server 1 first the DPS for enterprise LDAP was installed then a DPS for AM LDAP was added. Only the enterprise proxy instance can connect successfully over SSL. On server 2 initially the AM LDAP instance was installed and then an enterprise LDAP instance was added. In this case only the AM LDAP instance can connect successfully.
For both instances of the proxy the appropriate certificates have been installed and verified. I can use the dps-instance-cert8.db for the working and non working DPS instances and successfully connect to the Directory Master using ldapsearch from the directory proxy server.
When I do ldapsearch I receive the following error on the second instances:
ldap_simple_bind: Can't contact LDAP server
SSL error -12271 (SSL peer cannot verify your certificate.)
Certificates:
bash-2.05$ /jes/ds52/shared/bin/certutil -L -d /jes/ds52/alias -P dps-instance1-
LDAP Development Pu,u,u
CMS SUN CERTIFICATE AUTH 2023 CT,,
bash-2.05$ /jes/ds52/shared/bin/certutil -L -d /jes/ds52/alias -P dps-instance2-
LDAP Development Pu,u,u
CMS SUN CERTIFICATE AUTH 2023 CT,,
Each use the same server cert, the host is �*.test.com�, using the asterisk so the hostname shouldn�t matter.
DPS INSTANCE 1 � Success
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385609] TCP_NODELAY was set on socket 3
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   310200] Success with enabling socket 16 for blocking
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   323705] ( xxx.xx.xxx.xx+ 636) syncConnection success.
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385609] TCP_NODELAY was set on socket 16
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [TRACE] [   520503] Connection established to condo101.cms.hhs.gov
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300771] Promoting socket 16 via socket 1.
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300751] Socket 16, success with SSL_HANDSHAKE_AS_CLIENT
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385701] Success with sessionPromote to SSL for socket 16.
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385704] Success with setting SSL_AuthCertificateHook callback
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385705] Success with setting SSL_BadCertHook callback
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385706] Success with setting SSL_HandshakeCallBack
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   302019] Success with SSL_SetPKCS11PinArg (socket 16)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385748] SSL_SetURL skipped on socket 16 (null url)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385803] Success with SSL_ResetHandshake as client (socket 16)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385739] Certificate possesses valid times on socket 16
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385745] For socket 16, pinArg does possess a value.
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   302024] Success with CERT_VerifyCertNow (checking signature, usage: "certUsageSSLServer").
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385725] Certificate accepted on socket 16
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300754] Success with handshake on socket 16
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385746] SSL_ForceHandshake success on socket 16
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [TRACE] [   171210] [client(       xxx.xxx.xxx.xxx,   3)] [server(  xxx.xx.xxx.xx+  636,  16)] Connection via SSL session
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [STAT/CONN] [   171211] [client(       xxx.xxx.xxx.xxx,   3)] Accepting connection via network-group-1
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   310200] Success with enabling socket 3 for blocking
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300771] Promoting socket 3 via socket 0.
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300750] Socket 3, success with SSL_HANDSHAKE_AS_SERVER
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385701] Success with sessionPromote to SSL for socket 3.
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385704] Success with setting SSL_AuthCertificateHook callback
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385705] Success with setting SSL_BadCertHook callback
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385706] Success with setting SSL_HandshakeCallBack
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300801] Success with setting SSL_REQUEST_CERTIFICATE (1)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300802] Success with setting SSL_REQUIRE_CERTIFICATE (0)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300405] Success with SSL configuration on socket 3
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385803] Success with SSL_ResetHandshake as server (socket 3)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300406] Success with SSL promotion on socket 3
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [TRACE] [   390307] [client(       xxx.xxx.xxx.xxx,   3)] [server(  xxx.xx.xxx.xx+  636,  16)] Success with OnSSLEstablished rule... continuing
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   300754] Success with handshake on socket 3
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385713] Read on socket 3. Received 42 byte(s)
May 10 2007 09:44:18 server123 SunONEDPS[ 24710]: [DETAIL_TRACE] [   385716] ber_get_next (socket 3) returned complete PDU
DPS INSTANCE 2 � FAILING
ldapsearch -h server123 -p 55636 -P /<serverroot>/alias/dps-server123-cert8.db -D "cn=directory manager" -s base -w adminjes -b dc=cms,dc=hhs,dc=gov objectclass=*
ldap_simple_bind: Can't contact LDAP server
SSL error -12271 (SSL peer cannot verify your certificate.)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   300901] Successful match of xxx.xxx.xxx.xxx+36383 against ALL
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   110999] In permit_connection_from_ip(), The counter for IP:xxx.xxx.xxx.xxx is now 2 and the limit is 0
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385609] TCP_NODELAY was set on socket 15
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   310200] Success with enabling socket 16 for blocking
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   323705] ( xxx.xx.xxx.xx+55636) syncConnection success.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385609] TCP_NODELAY was set on socket 16
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   520503] Connection established to condo101.cms.hhs.gov
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300771] Promoting socket 16 via socket 1.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300751] Socket 16, success with SSL_HANDSHAKE_AS_CLIENT
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385701] Success with sessionPromote to SSL for socket 16.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385704] Success with setting SSL_AuthCertificateHook callback
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385705] Success with setting SSL_BadCertHook callback
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385706] Success with setting SSL_HandshakeCallBack
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   302019] Success with SSL_SetPKCS11PinArg (socket 16)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385748] SSL_SetURL skipped on socket 16 (null url)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385803] Success with SSL_ResetHandshake as client (socket 16)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385739] Certificate possesses valid times on socket 16
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385745] For socket 16, pinArg does possess a value.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   302024] Success with CERT_VerifyCertNow (checking signature, usage: "certUsageSSLServer").
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385725] Certificate accepted on socket 16
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300754] Success with handshake on socket 16
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385746] SSL_ForceHandshake success on socket 16
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   171210] [client(       xxx.xxx.xxx.xxx,  15)] [server(  xxx.xx.xxx.xx+55636,  16)] Connection via SSL session
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   310200] Success with enabling socket 15 for blocking
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300771] Promoting socket 15 via socket 0.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300750] Socket 15, success with SSL_HANDSHAKE_AS_SERVER
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385701] Success with sessionPromote to SSL for socket 15.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385704] Success with setting SSL_AuthCertificateHook callback
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385705] Success with setting SSL_BadCertHook callback
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385706] Success with setting SSL_HandshakeCallBack
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300801] Success with setting SSL_REQUEST_CERTIFICATE (1)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300802] Success with setting SSL_REQUIRE_CERTIFICATE (1)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300405] Success with SSL configuration on socket 15
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385803] Success with SSL_ResetHandshake as server (socket 15)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   300406] Success with SSL promotion on socket 15
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   390307] [client(       xxx.xxx.xxx.xxx,  15)] [server(  xxx.xx.xxx.xx+55636,  16)] Success with OnSSLEstablished rule... continuing
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [NOTICE] [   385721] Read on socket 15 failed.
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [NOTICE] [   385721] SSL_ERROR_BASE + 3, NSPR error: -12285 (0xffffd003). Native errno is: 11
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385714] ber_get_next (socket 15) returned LBER_DEFAULT
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   385714] SSL_ERROR_BASE + 3, NSPR error: -12285 (0xffffd003). Native errno is: 11
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [EXCEPTION] [   301006] Unexpected error on socket 15. (Error: -12285).
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   190401] [server(  xxx.xx.xxx.xx+55636,  16)] Input was not a BER encoding or connection closed: source( xxx.xxx.xxx.xxx, 15)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   190401] [server(  xxx.xx.xxx.xx+55636,  16)] SSL_ERROR_BASE + 3, NSPR error: -12285 (0xffffd003). Native errno is: 11
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   171505] [server(  xxx.xx.xxx.xx+55636,  16)] Entering recycle_inner_connection
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   301201] Closing connection to: xxx.xx.xxx.xx+55636 (socket 16)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [DETAIL_TRACE] [   301201] Closing connection to: xxx.xxx.xxx.xxx (socket 15)
May 10 2007 10:05:17 server123 SunONEDPS[ 26275]: [TRACE] [   110998] In done_connection_from_ip(), The counter for IP:xxx.xxx.xxx.xxx is now 1 and the limit is 0

In these situations it's important to separate SSL level issues from LDAP issues. I've had good results using "openssl s_client" to investigate and debug SSL/TLS level issues. I point it at the LDAP server and it sets up a connection handling the SSL layers and giving lots of diagnostics about SSL and the X.509 certificates in use.
Try looking for things like whether the SubjectAltName and/or Issuer's CN contain the same hostname you are using to connect.
After giving you the diagnostics it will be waiting with your stdin/stdout connected to the application via SSL (which could make you think it's hanging). Since you're probably not going to be typing the LDAP protocol by hand you want to abort s_client at this point (or type something that Directory Server will reject as a LDAP protocol error).
You can get openssl from the usual places: blastwave.org & sunfreeware.com.
Hopefuly this will help,
-Scott-

Similar Messages

  • Multiple SAP system on single physical server.

    Hello Experts.
    We are in process of implementaing SAP solution withLandscpe having systems ECC 6.0, SolMan 4.0, BI. We are planning to have 3 Sytem landscape for all.
    Now but currently we are having only one Physical server
    Is it possible to Install 6 SAP system on single server?(DEV and QAS for ECC, Solman, BI respectively). The server is having sufficient hardware for 6 system as per sap standered. Planne OS is RHEL and DB MaxDB. Initially we are having 16 GB RAM extendable.
    Will SAP support such kind of landscape?

    Hi Nikhil
    Just my two cents:
    Never put non-prod/prod systems on the same server, how would you test os patches, what if system wide components cause problems, what if - for example - you want to upgrade your database on the dev system, but you need a new library, which is not compatible to the version needed by the prod system.
    Your single linux box will not be big enough to hold all these systems, trust me. And x86_64 hw is sooo cheap ))
    Regards, Michael

  • Any docs or guide for OpenSSO secure Ldap with Opends

    Any docs or guide for OpenSSO secure Ldap with Opends
    Cheers
    Blacknasa

    Hi,
    it seems to be a JRE Problem. When I use the Kerberos implementation from "Vintela Single Sign-On for Java" I can establish a "aes256" secured LDAP connection to the AD Server.
    This LDAP connection allows to change the passwords of the users stored in the AD.
    The problem is that "Vintela Single Sign-On for Java" is not free, so it would be nice to have a solution which works with the Kerberos implementation of the JRE.
    The error is the same for "aes128" and "aes256" encryption.
    And with Wireshark I can not see any differences in the packets send to the AD and received from the AD.

  • Issues with multiple Files with multiple subdbs on a single environment.

    I'm having an issue with Berkeley DB 4.2 on 32-bit platforms, regarding multiple physical files with multiple subdatabases in a single database environment. Specifically, when I open a subdatabase for a physical file, Berkeley DB thinks that it is using the same subdatabase in a different physical file.
    I'm doing the following:
    1. Create and open a db enviornment.
    2. Move file1 to the common area.
    3. Open, get and close the subdatabases in file1.
    4. Move file2 to the common area.
    5. Open, get and close the subdatabases in file2.
    6. remove file2 from the common area
    7. Move file3 to the common area.
    8. Open a subdatabase from file3. About 1/2 the time, the fetches
    return data from file2, not from file3.
    It's possible that at some earlier time (i.e. before step 1 of this
    test case), file1, file2 and file3 were the same file. I noticed
    that there is something called env->fileid_reset, but that is not
    in 4.2.52.
    Any ideas?

    Looks like I've resolved the issue

  • How do I host multiple domains on a single Messaging Server?

    How do I host multiple domains on a single Messaging Server?
    <p>
    To host multiple domains on one Messaging Server, use the
    mailAlternateAddress attribute. If you want to host two domains
    (customer1.com and customer2.com) on your server mail1.domain.com,
    make sure that:
    The various domains (in DNS) point to the installed mail server
    (you must have the MX records that
    points mail for customer1.com to mail1.domain.com and
    customer2.com to mail1.domain.com)
    That each person receiving mail at customer1.com and
    customer2.com has an appropriate mailAlternateAddress
    attribute describing the appropriate email address. For
    instance, John Doe can have an email address (i.e. the value
    of the 'mail' attribute for the John Doe LDAP entry) of
    [email protected] and receive his mail on
    [email protected] (the value of the mailAlternateAddress
    attribute)
    With Messaging Server 3.5, mailAlternateAddress can take the
    form of @mail1.domain.com. If jdoe's mailAlternateAddress is
    set to @mail1.domain.com, mail sent to [email protected]
    will be delivered to [email protected]

    jaygatsby1123 wrote:
    So what exactly am I doing with virtual hosts?  There is a place for Aliases...  What would I put in the "Aliases" box?
    Any other host name that you want to resolve to the specified virtual host.  It's quite literally an alias.
    if you want www.example.com and www.example.org to end up at the same web site and you already have a virtual host — Apple refers to virtual hosts as sites — configured for www.example.com in Server.app, then you'd add www.example.org as an alias for the www.example.com virtual host (site).
    Virtual hosts are implemented in a web server using some details of the HTTP or HTTPS protocol, and what the web browser (client) specified.  The client gets handed an IP address or a domain name by the user, and the client then fetches the associated IP address for the target web server from the client's DNS services or local host database, and the client then connects to the IP address and passes over the text string that the user had requested — the IP address or domain name or even some local shortcut set up in the client system — via the HTTP or HTTPS protocol.  The web server receives and processes this arriving text string from the client, and uses it to select which web site to render back to the web client.   One subtle detail lurks here, too: the server's own DNS configuration really isn't involved in the selection of the virtual host.

  • Multiple Import into Multiple schemas in a single Database server ?

    Is it possible to create a multiple import into multiple schema in a single DB server ?

    Hi,
    Yes, You can do it.. With Multiple Export File..it may cause some Performance issue, so need to check your Server configuration before do that..

  • 2 Hyper-V Servers with Failover Cluster and a single File Server and .VHDs stored on a SMB 3 Share

    I have 2 X M600 Dell Blades (100 GB local storage and 2 NICs)  and a Single R720 File Server (2.5 TB local SAS storage and 6 NICs).  I´m planning a Lab/developer enrironment using 2 Hyper-V Servers with Failover Cluster and a single File Server putting
    all  .VHDs stored on a SMB 3 Share on the File Server.
    The ideia is to have a HA solution, live migration, etc, storing the .VHDs onm a SMB 3 share
    \\fileserver\shareforVHDs
    It is possible? How Cluster will understand the
    \\fileserver\shareforVHDs as a cluster disk and offer HA on it?
    Or i´ll have to "re-think" and forget about VHDs on SMb 3 Share and deploy using iSCSI?
    Storage Spaces makes difference in this case?
    All based on wind2012 R2 STD English version

    I have 2 X M600 Dell Blades (100 GB local storage and 2 NICs)  and a Single R720 File Server (2.5 TB local SAS storage and 6 NICs).  I´m planning a Lab/developer enrironment using 2 Hyper-V Servers with Failover Cluster and a single File Server putting
    all  .VHDs stored on a SMB 3 Share on the File Server.
    The ideia is to have a HA solution, live migration, etc, storing the .VHDs onm a SMB 3 share
    \\fileserver\shareforVHDs
    It is possible? How Cluster will understand the
    \\fileserver\shareforVHDs as a cluster disk and offer HA on it?
    Or i´ll have to "re-think" and forget about VHDs on SMb 3 Share and deploy using iSCSI?
    Storage Spaces makes difference in this case?
    All based on wind2012 R2 STD English version
    You can do what you want to do just fine. Hyper-V / Windows Server 2012 R2 can use SMB 3.0 share instead of a block storage (iSCSI/FC/etc). See:
    Deploy Hyper-V over SMB
    http://technet.microsoft.com/en-us/library/jj134187.aspx
    There would be no shared disk and no CSV just SMB 3.0 folder both hypervisor hosts would have access to. Much simplier to use. See:
    Hyper-V recommends SMB or CSV ?
    http://social.technet.microsoft.com/Forums/en-US/d6e06d59-bef3-42ba-82f1-5043713b5552/hyperv-recommends-smb-or-csv-
    You'll have however a limited solution as your single physical server being a file server would be a single point of failure.
    You can use Storage Spaces just fine but you cannot use Clustered Storage Spaces as in this case you'll have to take away your SAS spindles from your R720 box and mount them into SAS JBOD (make sure it's certified). So you get rid of an active components
    (CPU, RAM) and keep more robust all-passive SAS JBOD as your physical shared storage. Better then a single Windows-running server but for a true fault tolerance you'll have to have 3 SAS JBODs. Not exactly cheap :) See:
    Deploy Clustered Storage Spaces
    http://technet.microsoft.com/en-us/library/jj822937.aspx
    Storage Spaces,
    JBODs, and Failover Clustering – A Recipe for Cost-Effective, Highly Available Storage
    http://blogs.technet.com/b/storageserver/archive/2013/10/19/storage-spaces-jbods-and-failover-clustering-a-recipe-for-cost-effective-highly-available-storage.aspx
    Using
    Storage Spaces for Storage Subsystem Performance
    http://msdn.microsoft.com/en-us/library/windows/hardware/dn567634.aspx#enclosure
    Storage
    Spaces FAQ
    https://social.technet.microsoft.com/wiki/contents/articles/11382.storage-spaces-frequently-asked-questions-faq.aspx
    Alternative way would be using Virtual SAN similar to VMware VSAN in this case you can get rid of a physical shared storage @ all and use cheap high capacity SATA spindles (and SATA SSDs!) instead of an expensive SAS.
    Hope this helped :)
    StarWind VSAN [Virtual SAN] clusters Hyper-V without SAS, Fibre Channel, SMB 3.0 or iSCSI, uses Ethernet to mirror internally mounted SATA disks between hosts.

  • ADS+Terminal Services on a Single Physical Server running Windows Server 2008 R2

    We have a Dual Processor Server (2 x Intel Xeon E5-2620v2 + 32GB RAM) running on Windows Server 2008 R2. This has ADS configured. We now wish to add a VDI Setup with NComputing Zero-Clients. We have to run Terminal Services with User RDS CAL + User
    CAL for all VDI Clients.
    Please confirm if we can have both the ADS & Terminal Services running on the same physical server ? Are there known issues or crashes due to this ? Or should both these run on two different servers ? Customer does not want to invest in one more server
    & OS. Hence, we have to run both the services on a single physical server. Customer has just upgraded his server to a Dual Processor with 32GB RAM to accommodate both the services.
    Please advice, if we can run both the ADS & TS on the same server. What is the best practice for this Solution ?
    Thanks & Regards,
    VR
    ([email protected])

    Hi,
    After referring your comment I can say that, you can able to use ADS and Terminal service on same physical server with server 2008 R2. But installing a terminal server on an Active Directory domain controller is not recommended. I suggest that it’s not a good
    practice to manage the environment in that way. If possible, then try to run on two different machines for better result and to avoid any problem. Allowing users to run programs on a domain controller could create security risks and performance issues.
    If the Terminal Server role service is installed on a domain controller, the security settings of the domain controller will need to be adjusted to allow user’s remote access to the server. This remote access is controlled by the "Allow log on through Terminal
    Services" user rights assignment, which can be configured by using the Group Policy Management Console (GPMC).
    You can refer below link for more information.
    1.  Installing RD Session Host on a Domain Controller
    2.  Best practices for setting up Remote Desktop Licensing (Terminal Server Licensing) across Active Directory Domains/Forests or Workgroup
    Hope it helps!
    Regards.

  • Two SAP production systems in a single physical server

    Dear All,
    Is SAP support installing two SAP production systems like SAP ECC 6.0 of one customer and ECC 6.0 with a different SID and instance no. for another customer in a single physical server? Would like to know from the experts is this possible? If yes ,  what are the things to take care of this design if any?
    Thanks
    Hany

    Hi ,
    check below blog
    You can check the following blog https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/5124. [original link is broken]
    It helps you to understand different logon pages for portal
    Koti Reddy

  • How to Implement DC and RDS on a single physical server

    Can any one guide me that how to install DC and RDS on a single physical server. It would be highly great full.

    Hi,
    Whilst possible to do it isn't supported and you should have your DC as a dedicated DC and then a separate server(s) for the remote desktop session host.
    Regards,
    Denis Cooper
    MCITP EA - MCT
    Help keep the forums tidy, if this has helped please mark it as an answer
    Blog: http://www.windows-support.co.uk 
    Twitter:   LinkedIn:

  • How to filter with multiple selection on a single column on external list, currently only one filter per column is available.

    I have external list where i want to apply multiple filter for every column like we do in Excel spreadsheet - we can filter a spreadsheet column by selecting multiple checkbox for every  column. I am using Sharepoint 2010
    Is this possible in sharepoint 2010? Any idea how to acheive that?
    Thanks in advance.

    Hi Rahul,
    According to your description, my understanding is that you want to use filter with multiple values on a column of an external list in SharePoint 2010.
    Per my knowledge, there is not an OOB way to achieve it. As a workaround, you can custom the web part to implement it. There is an articles for your reference:
    http://blogs.telerik.com/aspnet-ajax/posts/13-11-05/add-excel-like-multi-select-filtering-to-your-asp.net-datagrid
    In addition, you can use a third party solution to achieve it, please take a look at:
    http://abilitics.com/Blog/index.php/sharepoint-improved-grids-with-excel-like-inline-editing/
    http://social.technet.microsoft.com/forums/sharepoint/en-US/3d19b9d3-d394-4af9-9e8e-2dee70b50540/filter-column-with-multiple-filter-values-in-sharepoint-list
    I hope this helps.
    Thanks,
    Wendy
    Wendy Li
    TechNet Community Support

  • Multiple ESS access to single EP server from two backend servers.

    Hi Experts,
    I have one concern regarding ESS.
    Can we do or can we make   two ESS access (R3 server1 and R3 Server2)  from one Portal server.
    I heard  that from one portal server (ESS)  we can connect multiple clients which are from backend R3 (example client 100 and client 200)
    My requirement is  :
    We have two R3 backend servers and one EP(ESS) server.
    Can we access two backend systems from one EP server with Two ESS tabs.
    I am expecting Multiple jco settings, multiple SSo, Multiple SLD, Multiple SPRO Menu settings, UWL settings.
    Multiple service specific settings to be access  by using  single EP server(Multiple ESS Tabs)
    Please help me for doing this.
    Regards
    Kumar.

    yes you can do so As Pooja indicated also refer
    Please have a look  at the Note 596698
    Thanks for clearing that up, Now if I understand the issue
    correctly :
    1 Portal, Two backend R/3 System, This can be done, Now then
    if you dont want the particular application disable that
    r/3 as you are aware that the links appear from V_T7XSSSERRES.
    Here you can also make sure some applications appear or no.
    Accessing multiple Backends in WebDynpro:
    How it can be done?
    1) Define different JCO Destinations
      The logical System names have to be defined in the Web Dynpro Content
    Administrator.
      Different clients or completely different Systems can be accessed
    given that the function modules called exist in those systemsThe logical System to be used can be passed to the Web Dynpro
    Application by using a URL Parameter
      The URL Parameter can be easily maintained in the iView Property when
    using the portal.
    The standard way to handle this is to create copies (via delta-link) of
    all the business package iviews and change the 'System' property in the
    newly created iviews to point to the correct system Alias. From the
    portal point of view this is all that is required in order to point an
    view to a different system
    Refer these links for further information:
    https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.
    docs/library/webas/webdynpro/How%20to%20Use%20the%20Web%20Dynpro%20Conte
    nt%20Administrator.pdf

  • Problem with multiple Toplink/JPA apps in same server

    Anyone have experence of running serveral Toplink/ EJB-3 Web apps in the same server (OC4J, alas)?
    We seem to get a problem with the second app failing to initialise toplink, with an entity not found message. Each app runs OK on it's own.

    Yes, they access the same datasource and most of the tables overlap.
    We're thinking it might help to have common entity classes and put them in a shared library, but I don't know if this is relevant (setting up shared libraries complicates testing and tends to snowball, I reckon we need about 15 jars all told).
    I''ve had some funnies on OC4J before which I think may be to do with it's use of ClassLoaders, for example I initially put persistence.xml in the libary jar with the data model, but for some reason I get the entity not found error that way. It only seems to work if it's in the classes folder.
    For the moment we're getting arround the problem with multiple OC4J instances in the server.

  • Multiple report fields from single physical column.

    Hi Experts,
    I have a physical table like below. Multiple records for a single customer id. The no of Address_type may increase in future.
    Customer_id     Address_Type         Address
    101                  Primary                   abcdefgh
    101                  Secondary               234oij3mb4
    101                  Billing                      mdmnweoij4
    102................etc.
    My Requirement on OBIEE is to display report as below.
    Customer_ID, Primary_Address, Secondary_Address, Billing_Address.
    101                 abcdefgh            234oij3mb4               mdmnweoij4
    Multiple report fields ( Primary_Address, Secondary_Address, Billing_Address ) are derived from same physical column ADDRESS.
    I tried to duplicate the Address column on the report thrice and added conditions like Address_Type = Primary/Secondary/Billing for those three fields respectively.
    But only of the field is getting correct data and rest of duplicate columns are null.
    Tried FILTER function on OBI Answers, but the function fails saying it should be used only on measures.
    Thought the alternative would be to define multiple logical columns at BMM layer. Created multiple alias for same table at physical layer and correspondingly created LTS for each on a single logical table. Defined Fragmentation/Where conditions.
    LTS1 - Address_Type = PRIMARY
    LTS2 - Address_Type - SECONDARY
    LTS3 - Address_Type - BILLING
    Created multiple logical columns from each LTS like Primary_Address, Secondary_Address, Billing_Address from LTS1, LTS2, LTS3 respectively.
    This time, am getting data for all the fields on the report but getting cartesian result.
    Can someone guide me whether my approach is correct or any other alternate best approach to achieve the desired result.
    Note: I have the data Address on multiple physical rows for a customer, rather Not in a single row. which is causing me problem.
    Thanks...
    Ramchand.

    Hi Srini VEERAVALLI,
    I have lot many other fields in the same report coming from other tables.
    Does the Pivot table option for above mentioned Address fields affect other columns?
    If Yes, Can there be any other alternative? Am thinking of Opaque View at Physical layer to bring all Addresses on a single row.
    Thanks...
    Ramchand.

  • Accessing many databases with HTML DB from a single Apache Server

    Hello;
    I am planning the install of 10g and HTML DB on a HPUX server with many databases running out of many Oracle Homes 9.2.0, 9.0.1 and 8.1.7. I will be upgrading a number of the existing databases to 10g and want to access them with HTML DB.
    My question is how can I install HTML DB on many databases and use a single Apache Server to access them?

    Where would I find the DADs? a default installation of htmldb puts the modplsql DAD, "pls/htmldb", in a marvel.conf file located in $OHS_HOME/Apache/modplsql/conf/marvel.conf
    What would the URLs look like? not sure what you're asking. if you're asking about how the change in DAD's would affect the URLs you're calling, though, you should consider looking over the OHS (oracle http server) doc some more before making these types of customizations.
    And how would I install the HTML DB in the different databases?
    Would I use the installer or scripts?the only supported way to install htmldb is via the 10g Companion CD. just use that installer to point to your different db's.
    regards,
    raj

Maybe you are looking for