SAML Login not available during an HA Failover

We have enabled SAML with MFA in our Orion HA instance.

When we are in HA failover mode from the main Active application server to the Standby application server (main pollers)
we lose the LOGIN WITH AZURE SSO PROD button.

I checked with Support and they said this is the expected behavior as SAML is not supported in HA.
We only run in HA during patching or if there is an outage with the main pollers.

I know we can still login with the username / password fields, but we want to have that option disabled for Admin users.
Basically, we are forcing any users with Admin privileges to use SAML / MFA.

Anyone know of a workaround for this issue?

Find more posts tagged with

ha failover

saml

Accepted answers

All comments

jm_sysadmin

I don't believe that SAML auth should care as long as you have it configured to the correct DNS that hits the active webserver. I use additional webservers, but the sites are still active on my main polling engine. Let me test a failover and see.

rhether

As I far as I have been told the SAML cert / configuration is tied down to a single physical server.
Please let me know your results.

jm_sysadmin

We use additional web servers, and when we set up the SAML auth application in Azure AD we specified all the servers and the DNS alias. Any server there can call Azure Auth via SAML, and it completes the transaction by sending back to the DNS alias. We only have 1 active web server at a time currently, but it doesn't matter which server. I can retest all that as well today to ensure it still works the way it used to.

jm_sysadmin

OK, testing completed, and everything worked. I have 2 additional web servers, those don't run HA, it's basically just DNS that points to one of them. I have main polling engines in an HA pool.

Before testing I could sign into either additional webserver by Hostname, or DNS alias, via SAML and it would always send us back to the alias. I could also enter the active main polling engine and use SAML to sign in and get sent to the alias.

After failover, I could sign into either additional webserver by Hostname, or DNS alias, via SAML and it would always send us back to the alias. I could also enter the active main polling engine and use SAML to sign in and get sent to the alias.

Main polling engine failover has no impact to the authentication, which makes sense, since the configuration hasn't changed.

If I were you, and support told me what you said, I would fail to the node that SAML isn't an option, and break HA then delete the pool. Now Support isn't supporting HA, they are supporting a web console that doesn't show the SAML configuration. I honestly might do that second, and just rerun the configuration wizard before I call them again, but that's just my thought process.

I am actually still in the process of moving to SAML auth, but feel free to @ me if you need to.