What does the certification system mean? In a hotel, it means that all new guests are offline and there is a complaint that the phone is breaking down; in a mall, it means that the customer WiFi is out of reach, many of the marketing activities relying on micro-certificate are completely disabled; and in schools, it means that the entire dormitory is turned off.WiFi web certification systemThe availability is often more important than its function.——The lack of functionality is an empirical problem and the system's hanging is a business accident.
Typical malfunctioning mode of authentication system
The system usually has several directions:
Authentication server home-page failures: hardware damage, system failure, disk space depletion, and abnormal process exits.
Database failure: The authentication system usually relies on the database to store user accounts, Ssession, logs, etc.
Network links are broken: the certification system is in a critical position in network twitching, and all new connections will fail if the chain between the authentication server and the network device is broken and the authentication request cannot reach the server.
External reliance is ineffective: SMS gateways, third-party identification interfaces and micro-public authorization interfaces, which are all failing to verify by relying on them if problems arise.
Design thinking of the main architecture
The most common high-availability option is the master architecture.——Two authentication servers are deployed, the main server normally handles all requests and is in hot state; when the primary server fails, the flow is automatically switched to the pre-positioning server.
The main architecture looks simple, and in fact there are a few details that can be easily handled:
Data synchronization problems. Data that require real-time synchronization between masters include: online user Ssession (the switcher is not kicked off), account number data (the machine needs complete account information), logs (the switcher keeps the log running). The three types of data are different, Session requires millisecond sync, account data allows second delay and log allows minute delay. The synchronisation mechanism is designed to take these differences into consideration rather than using the same sync method as all others.
Switches the accuracy of your judgement. When does a fail switch trigger? Simple."Ping's not working."It's a rough judgment.——The server is still alive but the service process is dead, and Ping is normal.
Switches the balance between speed and cost of switching. The switch is too slow, failure affects long, the switch is too fast, perhaps because network shaking causes frequent"Fake Switch", instead of creating more problems. Usually it is set to test successive failures N times to trigger the switch instead of a failure.
Locally authenticated escape routes
For some sites, there is a need for certification systems that are temporarily unavailable but still available on the network.
A compromise solution is to configure local certification for escape: when the authentication server is not reached, network equipment is downgraded"Certification equipment continues to be available and new equipment is required for certification until the certification services are restored"model. This mode relies on the local MAC list of network devices that cache certified devices, which is valid for periods when the server is not available, and the equipment in the cache remains online, while new connection requests are placed in a queue or display maintenance alert page.
This option is conditional on network equipment supporting local Session caches and not being forcibly recertified during the period of their validity.
External dependence downgrade strategy
WiFi web certification systemDependence on external services may be rendered ineffective for a variety of reasons, and downgrading strategies are key to reducing such impacts.
SMS gateways are downgraded: you can configure multiple SMS providers and switch automatically to a backup service provider when the main service provider fails.
downgrade of ID verification interface: when the I.D. interface is not available"Only mobile phone number authentication". This downgrading would lower the compliance level, but it is more reasonable than to allow users to have no access to the Internet at all.
Micromail authorization downgrades: when the micromail authorization interface is not available, Portal pages automatically hide the micro-mail authorization options to guide users to use SMS authentication. This switch should be transparent to users and should not show them a failed micro-mail authorization button.
Surveillance and alarm systems
The high-availability structure is passive, and the surveillance alert is a proactive detection. Core indicators that need to be monitored by the certification system include: authentication success rate (a sudden drop indicates a problem), certification delay (more than three seconds to indicate a system stress or malfunction), online users (an abnormal decline means that a large number of users are kicked offline) and log writing speed (stopping writing may be full of disks).
In many places, the alarm reaches the IT department’s mail group, but no one reads it in the middle of the night. It is reasonable to send a high priority to the cell phone of the duty officer and ensure that someone can respond at the first possible time after the failure.
Regular rehearsal and reinstatement of authentication
High-availability architecture is not a good thing. The logic of the main switch, if it has not been triggered for a long time, may find the switch failing or there are other problems after the transition. Regular failure exercises are necessary.——Disable the main server manually at the low peak to verify that the preservator is properly taking over, whether Session maintains and whether the logs are continuous.
The frequency of the exercises is not high, it is sufficient every quarter, but each exercise records the results and forms a history file. If a problem is discovered in a particular exercise, the restoration must be tested again, not only unrecoverable. This habit is very important in the long-term dimensions of the certification system.