Keycyte PAM 3.2 · Deployment Guide

High Availability

You can run more than one Keycyte PAM node so that users can keep working when one node is unavailable. The nodes use the same PostgreSQL database and are placed behind a load balancer. One node is the master node; the others are replica nodes.

Master and Replica Nodes

Every node serves users in the same way. The difference is in the scheduled jobs:

This makes sure that a scheduled job runs only once, even though all nodes share the database. A node is a replica unless it is set as master. At startup, each node writes to its log whether it runs as a master or a replica node.

The master setting is stored per node as the file master in the application directory of the node (~/keycyte/master on the host, /app/master in the PAM server container).

Requirements

All nodes must:

• connect to the same PostgreSQL database (see the database variables in Configuration Reference);
• use the same encryption key (KEYSTORE_KEY_HEX in .env, KEYCYTE_KEYSTORE_KEY_HEX in the PAM server). Otherwise a node cannot decrypt the secrets that another node stored;
• use the same session secret (SESSION_SECRET_KEY in .env, KEYCYTE_SESSION_SECRET_KEY in the PAM server). Otherwise a session cookie issued by one node is rejected by another;
• use the same service access keys;
• not set a cookie domain (KEYCYTE_SESSION_COOKIE_DOMAIN empty). The session cookie uses the __Host- prefix, which does not allow a domain.

The load balancer must:

• forward HTTPS (443) to the nodes, and, if used, SSH (2222) and RDP (3389);
• use session affinity (sticky sessions by cookie or source IP), so that all requests of one browser go to the same node.

Session affinity is required because some short-lived data is kept in the memory of each node and is not shared: connection tokens, MFA one-time passwords, active session and spectator registries. Without affinity, opening a session, MFA verification or joining a shared session can fail intermittently.

Setting the Master Node

To set a node as master:

1. Sign in to the Admin Panel of that node with the MASTER role. Use the node’s own address, not the load balancer address, so that you reach the correct node.

2. Open Settings > Replication.

   The Replication Settings card shows the Hostname, Ip Address and Mac Address of the node you are connected to.

3. Turn on the Master switch.

   The message Master mode enabled appears. The node runs the scheduled jobs from the next scheduler cycle.

To make a node a replica, turn off the Master switch on that node.

Replicated Servers

The Replicated Servers card lists other Keycyte PAM nodes. To add an entry, click Add, and fill in Type, Address, Status and Master, then click Save.