Need Guidance on Setting up Load Balancer Between Two IQService Hosts for AD Source HA

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Community,

I’m working on setting up high availability for an Active Directory (AD) source in SailPoint IdentityNow, and I need some guidance on the IQService + Load Balancer setup.

I have the following requirement:

  • Two Windows servers, each with IQService installed and configured with TLS.
  • A load balancer needs to be configured between these two servers to provide high availability for the AD source integration.

As I’m new to this kind of setup, I have some basic questions:

  1. I understand that IQService will be installed individually on both Windows servers – that’s clear.
  2. My confusion is regarding the Load Balancer setup:
  • Where should the Load Balancer be configured?
  • If I install it on one of the two IQService servers, it would compromise high availability (in case that server goes down), so that doesn’t seem feasible.
  • Do I need a third, separate host/server to install and configure the load balancer?

My goal is to ensure a proper and resilient architecture. I’d really appreciate it if someone could help clarify the basics or even share a simple diagram or example setup.

Thanks in advance!

2

In nutshell, you need to install IQService in two or more Windows servers for HA and have loadbalancer listen on port 5050/5051 and use that in your configuration.

check this post for reference.

High Availability for IQService - Compass

3

In addition to Sunny comment, I want to append below link

IQService architecture: Network ports and firewalls - Compass

4

where to install that load balancer?

5

Where to Place the Load Balancer

You’ll place the load balancer in front of the IQService instances. Here’s a typical setup:

  1. IQService Hosts: You’ll have multiple Windows servers, each with the IQService installed.
  2. Load Balancer: The load balancer sits between these IQService hosts and the SailPoint Virtual Appliance (VA). The VA is the component that connects to ISC.
  3. Virtual Appliance (VA): The VA communicates with the load balancer, which then distributes traffic to the available IQService instances.
    Check with your team: Network or Windows team for appropriate server to install.
6

Hi @Swati,

You absolutely should NOT install a load balancer on a server hosting the IQ Service or VA.

VA (Virtual Appliance): In the context of IdentityNow, “VA” typically refers to the Virtual Appliance for IdentityNow (VA) which hosts components like the Virtual Appliance Gateway for secure communication to certain on-premise applications (e.g., AD, LDAP). You cannot and should not install a load balancer directly on an IdentityNow VA. The VAs are purpose-built, locked-down virtual machines provided by SailPoint, and any unauthorized modification or installation is unsupported and will likely break the appliance.

After Load balancer installation applications like AD, LDAP will be pointed to load balancer URL which will finally connect to on-premise applications (e.g., AD, LDAP)

Dedicated Server for Load Balancer:

  • Applies: Yes. If you are implementing a load balancer, it absolutely needs its own dedicated infrastructure (physical or virtual server, or a hardware appliance). This is standard for any load balancing solution.

Network Team Responsibility/Awareness:

  • Applies: Yes. Even more so in IDN, as network configurations are critical for connecting your on-premise resources (like AD, databases, HRIS) to the cloud-based IdentityNow service. The network team will be responsible for firewall rules, DNS, routing, and potentially the load balancer’s setup itself.
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.