Oracle Internet Directory High Availability Architecture

Configuring High Availability for Identity Management Components 8-19 use OCIOracle Net Services. Oracle Directory Services Manager and the command-line tools communicate with the Oracle directory servers over LDAP.

8.3.1.1.6 Oracle Internet Directory Log File Log files for Oracle Internet Directory are

under the following directory: ORACLE_INSTANCE diagnosticslogOID Table 8–5 shows Oracle Internet Directory processes and the log file name and location for the process. For more information on using the log files to troubleshoot Oracle Internet Directory issues, see Section 8.3.6, Troubleshooting Oracle Internet Directory High Availability .

8.3.2 Oracle Internet Directory High Availability Concepts

This section provides conceptual information about using Oracle Internet Directory in a high availability two-node Cluster Configuration. See Section 8.3.2.3, Oracle Internet Directory Prerequisites for prerequisites and Section 8.3.3, Oracle Internet Directory High Availability Configuration Steps for specific steps for setting up the two-node Cluster Configuration.

8.3.2.1 Oracle Internet Directory High Availability Architecture

Figure 8–3 shows the Oracle Internet Directory Cluster Configuration high availability architecture in an active-active configuration. Table 8–5 Locations of Oracle Internet Directory Process Log Files Process Log File Location Directory server oidldapd ORACLE_INSTANCE diagnosticslogs OIDcomponentNameoidldapd00sPID-XXXX.log where: 00 is the instance number 00 by default s stands for server PID is the server process identifier XXXX is a number from 0000 to orclmaxlogfilesconfigured. Once the orclmaxlogfilesconfigured value is reached, it starts over again from 0000. When it starts over, it truncates the file to 0 bytes. ORACLE_ INSTANCE diagnosticslogsOIDcomponentNameoid stackInstNumberPID.log LDAP dispatcher oidldapd ORACLE_INSTANCEdiagnosticslogs OIDcomponentNameoidldapd00-XXXX.log where: 00 is the instance number 00 by default XXXX is a number from 0000 to orclmaxlogfilesconfigured OID Monitor OIDMON ORACLE_INSTANCE diagnosticslogs OIDcomponentNameoidmon-XXXX.log where: XXXX is a number from 0000 to orclmaxlogfilesconfigured Directory replication server oidrepld ORACLE_INSTANCE diagnosticslogsOID componentName oidrepld-XXXX.log where: XXXX is a number from 0000 to orclmaxlogfilesconfigured 8-20 Oracle Fusion Middleware High Availability Guide Figure 8–3 Oracle Internet Directory Cluster Configuration High Availability Architecture Figure 8–3 shows Oracle Internet Directory in the directory tier in a Cluster Configuration high availability architecture. Clustering is set up at installation time. The load balancing router routes LDAP client requests to the two Oracle Internet Directory instances that are clustered on OIDHOST1 and OIDHOST2. Transparent Application Failover TAF is used to connect the Oracle Internet Directory instances with the Oracle RAC database that serves as the security metadata repository. The Oracle RAC database is configured in TNSNAMES.ORA. High availability event notification is used for notification when an Oracle RAC instance becomes unavailable. See Section 4.1.6.1, Oracle Internet Directory for more information about using Oracle Internet Directory with Oracle RAC.

8.3.2.1.1 Starting and Stopping the Cluster In the Cluster Configuration, OPMN

commands are used to start each Oracle Internet Directory instance. There is no impact to Oracle Internet Directory at startup. A new database connection is spawned when Oracle Internet Directory starts. When the cluster is stopped using OPMN, Oracle Internet Directory disconnects from the database and the Oracle Internet Directory server stops.

8.3.2.1.2 Cluster-Wide Configuration Changes Configuration changes can be done at a

cluster level to any instance in the Cluster Configuration. All the nodes in the Cluster Configuration that share the same database read the same configuration information. The OIDMON process polls for configuration changes on each Oracle Internet Directory server and updates the database repository about configuration changes. OIDMON and other Oracle Internet Directory servers pull the changes from the database repository. In this way, any change made at a cluster member level is propagated to every Oracle Internet Directory server in the cluster. The instance-specific configuration attributes for an Oracle Internet Directory LDAP server configuration are stored in this LDAP entry: cn=component-name,cn=configsets,cn=osdldapd,cn=subconfigsubentry Oracle Internet Directory server configuration aspects such as the number of servers, database connections, sizelimit, and timelimit are part of the instance-specific server configuration entry. The configuration attributes that are common to all Oracle Internet Directory instances in a cluster are stored in the LDAP entry: Load Balancer FANOCI FANOCI OIDHOST2 OIDHOST1 Cluster OID RAC OID Configuring High Availability for Identity Management Components 8-21 cn=dsaconfig,cn=configsets,cn=osdldapd,cn=oracle internet directory If you want to retain instance-specific server configuration attributes for each Oracle Internet Directory instance in the cluster, then you should choose a distinct Oracle Internet Directory component name for each Oracle Internet Directory instance at installconfiguration time; for example, oid1 on node1 and oid2 on node2. In this case, the configuration entries will be cn=oid1,cn=osdldapd,cn=subconfigsubentry and cn=oid2,cn=osdldapd,cn=subconfigsubentry respectively and they need to be updated separately for each Oracle Internet Directory instance. On the other hand, if you chooses to have a common set of server configuration attributes for both Oracle Internet Directory instances in the cluster, then you should choose the same Oracle Internet Directory component name for both Oracle Internet Directory instances, for example, oid1 on both Oracle Internet Directory node1 and node2. In this case, there will be one common configuration entry cn=oid1,cn=osdldapd,cn=subconfigsubentry. Oracle Internet Directory LDAP server instances cache certain LDAP metadata artifacts such as Schema, ACLs, and Password Policy. Multiple Oracle Internet Directory LDAP server processes on a given node keep their caches in sync via semantics built around a shared memory segment managed by Oracle Internet Directory on each node. OIDMON keeps these caches in sync across nodes by ensuring that these shared memory segments are in sync across the nodes, which is achieved using the Oracle Internet Directory database. Oracle Internet Directory also caches metadata and metadata changes trigger notification across the nodes. The ldapmodify utility is used to change metadata. The Oracle Internet Directory server that gets the ldapmodify request for the metadata change notifies other Oracle Internet Directory servers about the change of metadata including OIDMON. OIDMON is responsible for notifying OIDMON on other nodes about the metadata changes.

8.3.2.2 Protection from Failures and Expected Behavior