RTFM · Healthchecks
lb.saphira.ldap: will the directory talk to strangers?
The check walks up to your directory service, introduces itself as nobody in particular, and asks for the server's own description. A successful anonymous bind and response is the fastest honest proof that the directory, not just its port, is alive.
What it proves
A real LDAP transaction: the check sends an anonymous simple bind request and requires a proper bindResponse before politely unbinding. The server must parse ASN.1/BER, run its bind path, and answer; a proxy or a hung worker pool that merely accepts TCP will fail here.
How it works
The probe engine carries the two tiny BER-encoded packets (bindRequest, unbind), a few bytes each, so the check adds essentially no load to the directory. No search is performed and no credentials are involved; sites that disable anonymous binds should expect failure here and can use sendexpect-tcp with their own bind shape instead.
Configuration
| Variable | Default | Meaning |
|---|---|---|
| LB_SAPHIRA_TIMEOUT | 3 | Transaction deadline |
| (target port) | $4, else 389 | 636 (LDAPS) exercises the TLS handshake first |
Wiring it up
# ldirectord.cf
virtual = 203.0.113.10:389
protocol = tcp
scheduler = wlc
real = 192.168.20.71:389 gate 1
real = 192.168.20.72:389 gate 1
checktype = external
checkcommand = "/var/lib/lb/saphira/lb.saphira.ldap"Run it by hand
/var/lib/lb/saphira/lb.saphira.ldap dir-pool 389 192.168.20.71 389
echo $?
# 0 = anonymous bind answered with a bindResponse
# 1 = no response, wrong response tag, or connection failureFailure modes
- Connection closed after bind; the directory accepted TCP and rejected the session: ACL or bind policy changed
- Timeout: the classic LDAP wedge: worker pool exhausted, check sees it before the phones do
Did we miss something?
If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.
Send feedback or request a new section →
Prefer not to do it yourself?
Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.