Fix/dedicated machine account for cluster

[stgmsa]

Cluster support for domain.conf

• allow PacketFence nodes in a cluster have their own dedicated settings in domain.conf
• adds HA support when establishing secure connections.

Impacts

• changed the domain.conf structure - For now the section name will always be hostname domain_id
• changed the steps when init secure connection - perform a dns query and obtain all available domain controllers, choose one to connect.

Delete branch after merge

YES

Checklist

• Document the feature
• Add OpenAPI specification
• Add unit tests
• Add acceptance tests (TestLink)

Enhancements

• allow different settings in domain.conf for each nodes in a cluster. e.g., each node has its own machine account name and password.
• supports domain controller high availibity now with a SRV query of DNS

[leonardosecci]

Hello,

I have seen the changes made, but in my opinion, they could create problems in the event that a domain controller becomes unavailable.
In fact, if such a scenario occurs, it would be queried cyclically, generating an error.
This scenario is not uncommon in a production environment, as domain controllers are often taken down for maintenance, but this is not evident just by reading the SRV record from DNS.
For example, Samba, using the net.finddc method, first retrieves the list of domain controllers reading SRV record but returns the information of the first one that passes the operational check.

Another issue that concerns me is the performance in a production environment.
I presume that because Samba is not declared compatible with multi-threading, you have implemented a lock that, in addition to atomicizing access to global variables, effectively serializes all requests.
Given my limited knowledge of Samba, it seems that there could be compatibility with a multi-process architecture. Wouldn't it be simpler to integrate a pre-fork system, similar to Gunicorn?

Best regards

[satkunas]

@leonardosecci thank you for your feedback

We currently handle fail-over, and LB - which isn't useful due to SMB single-thread.

We have multi-threading on our road-map that will monitor alive/dead of all hosts from SRV DNS and manage a pool used for multi-threaded LB.

[leonardosecci]

Thank you @satkunas, do you have an idea when the update that will monitor the health of domain controllers and for multi-threading will be released?

Best regards

[satkunas]

No ETA, but we are likely to continue to prioritizing work on Domains in the future