AD user connection by IA blade using IDC

[Matlu]

Hello,

A query, when using the IA blade with the IDC (Identity Collector).

With which commands can I see if a user appears "registered" in the GW?

I understand that there are commands like "pdp monitor..." is this correct?

For example I have a user "rchapin", who already logged in with his network credentials, and I want to see if he appears in the GW.
Any useful commands?

Now, a question related to this, if a user, manages to "log in" with his network credentials, this should appear in the 2 members of a Cluster?

Or is it only seen on the active member of a Cluster?

Greetings.

[the_rock]

Hey bro, you can use pdp monitor, hit enter and it will give you options. Ie say user is matlu. command is pdp monitor user matlu

Andy

[Matlu]

Andy,

When an AD user logs in to the network, should this user be seen in both members of your cluster?

Or should the user only be seen on the active member?

For example, my user "matlu", if I have a Cluster, the "pdp monitor user matlu", must be seen in both members of the Cluster, in a mandatory way?

Regards

[the_rock]

Not 100% certain on that, but I believe only current active member, will check tomorrow.

[Matlu]

Ok, my friend.

Anyway, this question is related to the fact that I had a punctual problem with a user, that at a certain moment "could not" log in to the network, and we only visualize his "log" in the CLI of the active member of the Cluster, but not in the passive member.

Apart from the above, we observed the following log.

It gives us the impression, that it has something to do with the AD, a responsibility of the AD itself, that probably, by an update in the same one, this user, at a certain moment, could not log in.

What do you think?

[the_rock]

I guess thats logical...you could always try pdp update all command and test.

[the_rock]

Just checked bro and I only saw output on current active member.

Andy

[Matlu]

Andy,

I guess this behavior is normal, in a ClusterXL (Active-Passive) environment.

But it seems that in an environment that you use the ClusterXL in a "Load Sharing - Unicast" mode, the validation of a network user, is done on the 2 members of the Cluster (This is what I am validating right now).

I have a customer, who has configured the Cluster, in Load Sharing mode, and I really don't understand why they decided to implement it that way.

Is it that Load Sharing offers more "stability" than a traditional Cluster?

Regards.

[the_rock]

I suppose in load sharing, it would make sense to see it on both members. Personally, I would never deploy LS cluster, seen it before in production have so many issues.

Just my personal opinion.

[Matlu]

Sorry,

I just rechecked the 2 clusters.

The ClusterXL in "Active-Passive" mode, the network user, appears to me in the 2 cluster members.

The ClusterXL in "Load-Sharing_Unicast" mode, the network user, does not appear in any of the 2 cluster members.

I am validating the user with the command "pdp montitor user <username>", but in the Cluster in LS mode, the user does not appear, in none of the 2 members.

It seems too strange to me.

I don't know if it could be a problem of the Cluster mode type 😕

[the_rock]

I would call TAC and maybe get remote going, hard to say why it fails.

[Matlu]

Hello,

We had a session with the TAC, but without achieving a solution so far.

The problem so far is focused on 1 user.

This user does "appear" in our Cluster-1, but does not appear in Cluster-2.

We checked the IDC, and although the user was no longer in working hours, we wanted to check his logs, and the only thing we found is a log that is related to the year 2022.

It is very strange.

A doubt, the logs that you see in the IDC, are they only in real time?
Or for example, can you see the logs of "logueo" of yesterday, or 1 week ago?

Greetings.

[the_rock]

I believe its only in real time.