Load balancer requirements and guidelines for Atrium Single Sign-On high availability 1

You must install and configure Atrium Single Sign-On for high availability before installing the TrueSight Presentation Server. Although Atrium Single Sign-On supports SAML and two-factor authentication, the TrueSight Presentation Server does not support these capabilities. To view the supported external authentication. see Atrium Single Sign-On system requirements.

Before you begin

• Ensure you can login successfully using the “amadmin” user and password you specified during installation.
• You must have created custom SSL certificates as described in Implementing private certificates in the Atrium Single Sign-On Server.

Configuring high availability using the embedded Atrium Single Sign-On database

When you choose to implement Atrium Single Sign-On with its embedded database, BMC recommends that you set up two independent ASSO servers and manually keep them in sync.

For example, you would create a user on ASSO Server1 and create the same user on ASSO Server2.

In the event of a failure, perform the following steps to re-register active Atrium Single Sign-On server with the Presentation Server: 

1. Run the following command to re-register the active Atrium Single Sign-On server with TSPS: 
   tssh properties set bmc.sso.servername <new asso server>
2. Run the following command to apply the changes:
   tssh properties reload

Configuring high availability for Atrium Single Sign-On using external LDAP authentication

When integrating Atrium Single Sign-On with your LDAP system, you can configure two ASSO servers and use a load balancer to connect to the TrueSight Presentation Server.

You can configure the ASSO servers as though they were Active/Active nodes; however, you must configure the load balancer as described in the following steps.

• You must configure the load balancer to connect to one of the ASSO servers at all times. 
• If the first ASSO server fails, load balancer must switch to the second ASSO server in a controlled manner. 

Atrium Single Sign-On keeps the passive node in sync using built-in Atrium Single Sign-On technology; therefore, you do not need to manually configure synchronization activities.

Primary and elder Atrium Single Sign-On servers

When you configure an Atrium Single Sign-On cluster, one ASSO server member assumes the role of primary, and the other members are secondary members. Only the primary node can answer requests authoritatively. In some cases, the secondary nodes will forward their requests to the current primary node. The primary node selection process determines the elder node, which is the node that was started first in the cluster.

You can determine the current elder node in an Atrium Single Sign-On cluster by reviewing the ASSO HA page. To access the ASSO HA page, you must log on to the ASSO console and access the following URL (example): https://atssoY1.example.com/atriumsso/atsso/ha

In this example, the Site ID for atssoY1.example.com is 01, which is also the value of Elder Site Id.  Site ID 01 is typically assigned to the admin node, so both the admin node and the primary have the same site ID.

For an ideal configuration, ensure that atssoY1.example.com is reachable through the load balancer and that atssoY2.example.com is not.

Monitoring Atrium Single Sign-On

So that you know when to manually switch from the primary ASSO node to a secondary node in a controlled manner, you must monitor the primary node to ensure that it is alive or determine that its performance is degrading. To determine if the server is running, enter and bookmark the following URL: https://<AtriumSSO_serverName>:8443/atriumsso/isAlive.jsp.

Tuning Atrium Single Sign-On for large environments

Administrators responsible for large environments with a high user load can modify the settings in the setenv.sh and server.xml files. To ensure that that resources do not contribute to system instability, BMC oversized the the Atrium Single Sign-On nodes.

In some cases, the Atrium Single Sign-On server would significantly increase thread count for a short time. Setting this value to 3000, as shown in the following example, addresses that problem. 

Changes to setenv.sh (Tomcat/bin directory)

• -Xms4096m \
• -Xmx6144m \
• -Dcom.sun.management.jmxremote \
• -Dcom.sun.management.jmxremote.port=8086 \
• -Dcom.sun.management.jmxremote.ssl=false \
• -Dcom.sun.management.jmxremote.authenticate=false \

Changes to server.xml

maxThreads="3000" scheme="https" secure="true"

Restarting Atrium Single Sign-On in a high-availability environment

As a best practice, BMC recommends that you adhere to the following procedure when restarting the Atrium Single Sign-On nodes in a high-availability environment. BMC's testing has found that if you adhere to this process, you could successfully restart the system on a daily basis, if necessary. 

Restart process for Atrium Single Sign-On in a high-availability environment

Additional configuration guidelines for a successful Atrium Single Sign-On implementation

Adhering to the following guidelines will further aid in the high-availability implementation of  Atrium Single Sign-On within a TrueSight installation:

Load balancer requirements and guidelines for high availability

• As long as the load balancer can handle the active/passive load re-routing, you can use any type of load balancer with Atrium Single Sign-On.
• Although you can configure the load balancer for HTTP communication, BMC strongly recommends that you configure it for HTTPS communication to enable secure communication with the TrueSight Presentation Server..
• The load balancer should send traffic to only the active node (i.e., Node 1). When the active Node is down, the load balancer would then send traffic to Node 2.
• You can use a couple of different options to configure SSL load balancing – Passthrough or SSL Offloading. Because Atrium Single Sign-On is installed in HTTPS mode, BMC recommends that you use Passthrough mode.
• In a load-balanced environment, apply the Subject Alternate Names (SAN) certificate, which enables you to specify additional host names that will be protected by a single SSL certificate. The SAN attribute must include the values of the load balancer and each of the host names used for Atrium Single Sign-On.

Using a single ASSO server with multiple TrueSight Presentation Servers 

As long as the ASSO server has the required resources, you can point multiple TrueSight Presentation Servers or other products to a single Atrium Single Sign-On implementation. 

Disaster recovery configuration for Atrium Single Sign-On

Because Atrium Single Sign-On does not provide any export or import utilities, if you require a disaster recovery solution, you must install configure two independently-deployed ASSO servers. The two ASSO servers will have to be synchronized with manual reconciliation.

Where to go from here

You can perform either of the following tasks following configuration of high availability for Atrium Single Sign-On: 

• Perform the Presentation Server installation.
• Configure Atrium Single Sign-On timeout settings.