Does Adaxes automatically fail over to another domain controller when the one in use goes offline?

Question

Hello,

We are running Adaxes 3.18.25007.0 with a managed domain example.local that has two domain controllers, DCnode1 and DCnode2. The domain was registered by domain name only (no specific DC), and SSL Usage is set to "Always" in the managed domain properties.

Our use case: during a planned maintenance one of the two DCs was shut down. The Adaxes service did not seem to notice. It kept trying to use the DC that was offline and only worked again after manual intervention. Our goal is for Adaxes to keep working automatically when one of the two DCs is unavailable, whether for maintenance or a failure.

We read the article "Use specific domain controllers" (https://www.adaxes.com/help/UseSpecificDCs/) and this older thread: https://www.adaxes.com/questions/721/adaxes-connects-to-any-domain-controller. In 2014 you explained that allowedDomainControllers is an ordered preference list ("connect to DC1; if DC1 is not available, use DC3..."), and that the domain is marked as not operational if none of the listed DCs is available.

Our questions:

1. Is the behaviour described in that 2014 thread still valid in the current version of Adaxes?

2. Failover with an already established connection: if Adaxes is already connected to DCnode1 and DCnode1 goes offline, does Adaxes detect it and switch to DCnode2 automatically? Is availability checked on every connection or only at service startup? How long does the switch roughly take (timeouts, retries), and is a service restart ever required?

3. Default behaviour without allowedDomainControllers: when the domain is registered by name only and the DC in use becomes unreachable, does Adaxes re-discover another DC on its own, and how quickly?

4. Load-balanced LDAPS endpoint: our network team provides an LDAPS endpoint behind a load balancer (F5) that balances both DCs. Is it supported to point Adaxes at such an endpoint, either in the domain registration or in allowedDomainControllers, instead of the individual DCs? If not, what is the recommended approach to get automatic failover?

Thank you in advance for your help.

Best regards, Leonardo Bressan

Answer 1

Hello Leonardo,

Is the behaviour described in that 2014 thread still valid in the current version of Adaxes?

Yes, it is still valid as described in the help article.

if Adaxes is already connected to DCnode1 and DCnode1 goes offline, does Adaxes detect it and switch to DCnode2 automatically?

Yes, it switches automatically.

Is availability checked on every connection or only at service startup?

It is performed whenever a request is executed from Adaxes towards the domain. It can be something manual (e.g. updating object properties) or automatic (e.g. actions performed by a scheduled task).

How long does the switch roughly take (timeouts, retries), and is a service restart ever required?

The switch is performed instantly.

when the domain is registered by name only and the DC in use becomes unreachable, does Adaxes re-discover another DC on its own, and how quickly?

By default, Adaxes relies on the Domain Controller locator algorithm to locate domain controllers for a managed domain. That is what gives Adaxes available domain controllers if the Softerra.Adaxes.Service.dll.config file is not updated accordingly.

Is it supported to point Adaxes at such an endpoint, either in the domain registration or in allowedDomainControllers, instead of the individual DCs? If not, what is the recommended approach to get automatic failover?

Unfortunately, there is no such possibility. Specifying DCs in the Softerra.Adaxes.Service.dll.config file is the only option. Pay attention that all the required ports must be open for all the corresponding DCs: https://www.adaxes.com/help/AdaxesNetworkUsage.