Internal Endpoint Sign-In Process

Before you review the benefits of a Director, it is important to first understand how an internal Lync client actually signs in. Clients default to searching DNS for service locator, or SRV, records based on the SIP address a user entered. Multiple SRV records can be returned, each with a different weight and priority so that a client can select the most preferred record. In the case of Lync 2013 the client will select the record with the lowest numeric priority and the highest numeric weight.

There is no logic in an endpoint to indicate that it is initially connecting to a Director pool and not a Front End server, meaning that the same DNS records, authentication methods, and signaling are used from the endpoint’s perspective. The Director first authenticates the user and then simply provides the user’s primary and backup registrar pools.

The client then attempts another sign-in to the primary registrar pool the Director provided, and if that pool does not respond it will attempt to register to the backup pool. The actual sign-in process looks like the following:

1. Endpoint requests DNS SRV records for automatic configuration.

2. Lowest-priority and highest-weight record returns the name of the Director pool.

3. Endpoint attempts to register to the Director pool.

4. The Director first attempts to verify the user’s credentials via certificate authentication, Kerberos, or NTLM. If the credentials are invalid, the endpoint is not authenticated and the connection is closed.

5. If the credentials are verified successfully, the Director checks for the primary and backup registrar pools assigned to the user.

6. The primary and backup registrar pool information is provided to the user in the form of a 301 Redirect SIP message.

7. The Director closes the session with the endpoint.

8. The endpoint attempts to authenticate again to the primary registrar.

9. The endpoint attempts to authenticate again to the backup registrar if the primary registrar does not respond.

After a Director authenticates an endpoint and provides the registrar information, it will be removed from the communication path. An endpoint will communicate with its own Front End pool after receiving that information, as shown in Figure 9.1.

Figure 9.1. Director relation to internal pools.

The process shown in Figure 9.1 is true for clients as long as the DNS records for lyncdiscover and lyncdiscoverinternal are not published. These records are preferred by the Lync 2013 PC client over SRV records.