Authentication with redundant ldap servers

Hello @sopraf,

Thanks for the report.

SonarQube’s LDAP support is not designed to connect to multiple LDAP servers in a failover mode. Instead, the feature is designed to allow companies with different LDAP servers hosting different users to allow users of both LDAPs to connect.

For security reasons, the user provisioned via LDAP server 2 must always connect with the same LDAP server. Otherwise, this would allow people to create a matching user on LDAP server 1 and potentially impersonate the account (assuming the 2 LDAP servers are owned.

For your scenario, a possibility would be to hide your two LDAP nodes behind a reverse proxy.

I will tag internally the doc team, so that they can make it more explicit on the relevant documentation page.

Aurélien

1 Like