Can Safeguard Authentication Services be configured to work with a VIP / Load Balancer? (4383850)

There may be a situation where a customer has an F5 DNS VIP, for example, and would like to connect SAS client systems to the VIP so that traffic goes to an active back-end DNS server. 

SAS cannot be configured to connect to VIP and use a load balancer. 

Support does not have any documentation to provide on how to configure SAS with a load balancer because the functionality does not exist.

SAS is designed to use cldap pings to find a site, then DNS SRV queries to locate an in-site server, then SRV queries to find all servers if needed.

If an environment is normally very responsive, but occasionally loses connectivity to multiple DCs at once, the following settings should make vasd more responsive for logins:

1) /opt/quest/bin/vastool configure vas libdefaults kdc_timeout 2

Decrease from the default of 3 seconds. If a server is down, this lets vasd move on to try another server sooner.
 
2) /opt/quest/bin/vastool configure vas libvas vascache-ipc-timeout 20

Increase from the default of 10.

This allows the calling application, i.e., pam from sshd, to wait longer for vasd to try to find an available DC and complete the authentication.
 
Once suitable DCs are found, and other DCs are seen as down, the srvinfo cache will store that, allowing faster subsequent logins.