From a906fa178a675b5961f5276adf1265fcbbb742ed Mon Sep 17 00:00:00 2001
From: Alex Bligh <alex@alex.org.uk>
Date: Sun, 11 Oct 2015 17:14:46 +0100
Subject: [PATCH] Support multiple space-separated LDAP hosts

Signed-off-by: Alex Bligh <alex@alex.org.uk>
---
 conf/ldap.toml    |  2 +-
 pkg/login/ldap.go | 23 ++++++++++++++---------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/conf/ldap.toml b/conf/ldap.toml
index 9455c8df3a1..0688b84657a 100644
--- a/conf/ldap.toml
+++ b/conf/ldap.toml
@@ -2,7 +2,7 @@
 verbose_logging = false
 
 [[servers]]
-# Ldap server host
+# Ldap server host (specify multiple hosts space separated)
 host = "127.0.0.1"
 # Default port is 389 or 636 if use_ssl = true
 port = 389
diff --git a/pkg/login/ldap.go b/pkg/login/ldap.go
index af9982e77df..1bfbd817957 100644
--- a/pkg/login/ldap.go
+++ b/pkg/login/ldap.go
@@ -24,18 +24,23 @@ func NewLdapAuthenticator(server *LdapServerConf) *ldapAuther {
 }
 
 func (a *ldapAuther) Dial() error {
-	address := fmt.Sprintf("%s:%d", a.server.Host, a.server.Port)
 	var err error
-	if a.server.UseSSL {
-		tlsCfg := &tls.Config{
-			InsecureSkipVerify: a.server.SkipVerifySSL,
-			ServerName:         a.server.Host,
+	for _, host := range strings.Split(a.server.Host, " ") {
+		address := fmt.Sprintf("%s:%d", host, a.server.Port)
+		if a.server.UseSSL {
+			tlsCfg := &tls.Config{
+				InsecureSkipVerify: a.server.SkipVerifySSL,
+				ServerName:         host,
+			}
+			a.conn, err = ldap.DialTLS("tcp", address, tlsCfg)
+		} else {
+			a.conn, err = ldap.Dial("tcp", address)
 		}
-		a.conn, err = ldap.DialTLS("tcp", address, tlsCfg)
-	} else {
-		a.conn, err = ldap.Dial("tcp", address)
-	}
 
+		if err == nil {
+			return nil
+		}
+	}
 	return err
 }