[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Openldap replication over XMPP
Peter Gietz wrote:
Hi Howard,
Am 22.07.2010 21:27, schrieb Howard Chu:
But if you're going to do something with LDAP you might as well make
it useful too. Two small projects that could be completed in a short
amount of time: implement a DirSync module for OpenLDAP to replicate
from M$AD, and implement a passwordSync module for OpenLDAP with AD.
Indeed two interesting projects. But is syncrepl the best way to do
this? Let me ask you some questions on this:
DirSync: The DIT in AD is unlikely to be the same as on the OpenLDAP
side. The same is true for the attributes. Thus we need things like we
have in the rewrite overlay. Are you thinking about syncrepl with a CSN
store on the AD side here? What about multi master (several ADs writing
to one OpenLDAP)? A more general solution IMHO would be a flexible (with
respect to DN massaging and attribute mapping) queue that send plain
LDAP operations to the OpenLDAP consumer. What about SPML? Do you think
that that is also a "gross misuse of SGML"?
DirSync is only a master/slave replication mechanism. For more sophisticated
replication, it's better to use Samba4 which implements the DRSUapi.
passwordSync: What are you thinking here? DLL that recognizes password
changes and creates apropriate hashes and syncs these into OpenLDAP, or
Yes. Bi-directionally, of course - it should also intercept LDAP
passwordModify requests and forward them to AD.
just plain syncing of the NT hashes into OpenLDAP, which could be done
via the DirSync
No.
The requirement fur such things is there since a long time and there are
a number of different solutions out there already. Something more
standardized, that could be packaged with OpenLDAP would be a nice
thing, thus I would be very happy, if this could be discussed here in
more detail.
Frankly there's not much to discuss. The scope of functionality is pretty
clear, the steps to implementation are also clear. The only time-consuming
part is because the sample Microsoft code is so poor and would need to be
completely rewritten from scratch as a slapd overlay.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/