10:12 p.m.
Greetings !!
Before going for Fedora Directory Server, I thought of going
through the feature list to see what all additional features
are supported when compared to OpenLDAP.
Though the feature list and FAQ says about many features
supported by Fedora Directory Server (like multi-master
replication, nested roles, cascading using hubs etc), they
don't provide information about some common features that
are supported by OpenLDAP. Some of such features include,
support for SNMP, password hashing, support of LDAP search
filters such as presence, equality, inequality, sub-string,
approximate and boolean operators, support for consumer-
initiated replication, support for supplier-initiated
replication, support for Digital certificates, support for
XMLDAP gateway and whether the Directory server support
XML for integration with external applications. XML and
XMLDAP are not supported by OpenLDAP too, I believe.
May be most of the above features were trivial to the
Directory Server; but still, I would like to know whether
these features are supported before going for Fedora
Directory Server.
Can anyone please help ?
Note: I am not a member of this mailing list; kindly put
a CC to me.
- Dinil
9:30 a.m.
Dinil Divakaran wrote:
Greetings !!
Before going for Fedora Directory Server, I thought of going through
the feature list to see what all additional features
are supported when compared to OpenLDAP.
Though the feature list and FAQ says about many features
supported by Fedora Directory Server (like multi-master replication,
nested roles, cascading using hubs etc), they
http://directory.fedora.redhat.com/wiki/Features
don't provide information about some common features that
are supported by OpenLDAP. Some of such features include,
All of these features and more are documented here -
http://www.redhat.com/docs/manuals/dir-server/
A quick glance at the table of contents for these docs will give you a
lot of information about these and many more features.
support for SNMP,
Yes.
password hashing,
Yes - crypt, SHA, SSHA, and (new in Fedora DS) MD5.
support of LDAP search
filters such as presence, equality, inequality, sub-string,
approximate and boolean operators,
Yes.
support for consumer-
initiated replication,
Not exactly. However, Fedora DS can be configured to have a searchable
changelog (cn=changelog) which can be polled periodically. In addition,
FDS supports persistent search.
support for supplier-initiated
replication,
Yes.
support for Digital certificates,
Yes. Clients can use certificates to authenticate to FDS, and admins
can configure mapping the cert subject DN to the user's LDAP entry.
support for
XMLDAP gateway and whether the Directory server support
XML for integration with external applications.
I think you mean DSMLv2. Yes, FDS includes a DSMLv2 gateway.
XML and
XMLDAP are not supported by OpenLDAP too, I believe.
May be most of the above features were trivial to the
Directory Server; but still, I would like to know whether
these features are supported before going for Fedora Directory Server.
Can anyone please help ?
Note: I am not a member of this mailing list; kindly put
a CC to me.
- Dinil
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
10:36 a.m.
Dinil Divakaran wrote:
Greetings !!
Greetings,
Before going for Fedora Directory Server, I thought of going through
the
feature list to see what all additional features
are supported when compared to OpenLDAP.
The list is long :-)
Though the feature list and FAQ says about many features
supported by Fedora Directory Server (like multi-master replication,
nested roles, cascading using hubs etc), they
don't provide information about some common features that
are supported by OpenLDAP. Some of such features include,
support for SNMP,
Supported.
password hashing,
Supported hashes are Crypt, SHA, and Salted SHA.
support of LDAP search
filters such as presence, equality, inequality, sub-string, approximate
and boolean operators,
This is part of the LDAPv3 standard.
support for consumer-
initiated replication,
Fedora DS does not support SyncRepl, if that's what you are asking.
support for supplier-initiated
replication,
Supported in single-master and multi-master replication models.
support for Digital certificates,
Supported for 8 years already.
support for
XMLDAP gateway and whether the Directory server support
XML for integration with external applications. XML and
XMLDAP are not supported by OpenLDAP too, I believe.
DSML is the standardized markup language for LDAP, and this is supported
in Fedora DS via the included DSML gateway process (java process).
Fedora DS is a direct and immediate descendant of the Netscape DS, which
was the first commercial LDAPv2 implementation in the world. Now it's at
LDAPv3. Netscape invented most of these features, and OpenLDAP project
started in 1999 to basically try to implement the core server and some
of these Netscape features.
If you ask me, the only real benefit to using OpenLDAP today is the
abundance of strange backends, e.g. if you want to make a really special
purpose LDAP server. You can make a directory out of just about any
arbitrary data source, etc. Writing backends for Fedora DS is also
possible, but there aren't too many available at the moment.
Mike
--
LDAP Directory Consulting - http://www.netauth.com
10:50 a.m.
Fedora DS is a direct and immediate descendant of the Netscape DS,
which was the first commercial LDAPv2 implementation in the world. Now
it's at LDAPv3. Netscape invented most of these features, and OpenLDAP
project started in 1999 to basically try to implement the core server
and some of these Netscape features.
Actually OpenLDAP began with the old UMich code, which was
also the basis for the Netscape server codeine. The two share a single
common ancestor.
If you ask me, the only real benefit to using OpenLDAP today is the
abundance of strange backends, e.g. if you want to make a really
special purpose LDAP server. You can make a directory out of just
about any arbitrary data source, etc. Writing backends for Fedora DS
is also possible, but there aren't too many available at the moment.
Because of the common heritage, the back end plugin interface
is similar (but certainly not identical) to that of OpenLDAP.
So it might be not too hard to port a backend written for
OpenLDAP's server to FDS.
1 p.m.
David Boreham wrote:
Actually OpenLDAP began with the old UMich code, which was
also the basis for the Netscape server codeine. The two share a single
common ancestor.
Well, yes :-) But what I meant was that back there in 1999, the Netscape
DS package was already far more advanced than the UM snapshot that the
OpenLDAP project started with, and they still haven't quite caught up in
my opinion. They didn't even support LDAPv3 until 2002, iirc.
Because of the common heritage, the back end plugin interface
is similar (but certainly not identical) to that of OpenLDAP.
So it might be not too hard to port a backend written for
OpenLDAP's server to FDS.
Oh god, not the back-sql! I just know that somebody's itching to do it.
Actually, I remember about 3 years ago on the OL list, somebody from HP
contributed code for OL to support the Netscape plugin API.
--
Mike
10:56 a.m.
Thanks for the help guys !
So, does this mean that Fedora DS includes every feature in
Netscape DS and Redhat DS ?
I couldn't still find whether Fedora DS supports these features
too:
* automatic, on-line directory replication
* Java and C/C++ SDK
* horizontal and vertical scalability
I was actually comparing the features with SUN's DS. It has
most of the features that I require; but if everything that SUN
supports is found in Fedora DS, then why waste money :) !
- Dinil
On Mon, 20 Jun 2005, Mike Jackson wrote:
Dinil Divakaran wrote:
>
> Greetings !!
Greetings,
> Before going for Fedora Directory Server, I thought of going through the
> feature list to see what all additional features
> are supported when compared to OpenLDAP.
The list is long :-)
> Though the feature list and FAQ says about many features
> supported by Fedora Directory Server (like multi-master replication,
> nested roles, cascading using hubs etc), they
> don't provide information about some common features that
> are supported by OpenLDAP. Some of such features include,
> support for SNMP,
Supported.
> password hashing,
Supported hashes are Crypt, SHA, and Salted SHA.
> support of LDAP search
> filters such as presence, equality, inequality, sub-string, approximate
> and boolean operators,
This is part of the LDAPv3 standard.
> support for consumer-
> initiated replication,
Fedora DS does not support SyncRepl, if that's what you are asking.
> support for supplier-initiated
> replication,
Supported in single-master and multi-master replication models.
> support for Digital certificates,
Supported for 8 years already.
> support for
> XMLDAP gateway and whether the Directory server support
> XML for integration with external applications. XML and
> XMLDAP are not supported by OpenLDAP too, I believe.
DSML is the standardized markup language for LDAP, and this is supported in
Fedora DS via the included DSML gateway process (java process).
Fedora DS is a direct and immediate descendant of the Netscape DS, which was
the first commercial LDAPv2 implementation in the world. Now it's at LDAPv3.
Netscape invented most of these features, and OpenLDAP project started in
1999 to basically try to implement the core server and some of these Netscape
features.
If you ask me, the only real benefit to using OpenLDAP today is the abundance
of strange backends, e.g. if you want to make a really special purpose LDAP
server. You can make a directory out of just about any arbitrary data source,
etc. Writing backends for Fedora DS is also possible, but there aren't too
many available at the moment.
Mike
--
LDAP Directory Consulting - http://www.netauth.com
11:28 a.m.
Dinil Divakaran wrote:
Thanks for the help guys !
So, does this mean that Fedora DS includes every feature in
Netscape DS and Redhat DS ?
Yes. Red Hat bought Netscape DS and renamed it Red Hat DS. They also
released the source code and created the open source Fedora DS project.
So, for now, Netscape DS == Red Hat DS == Fedora DS. See
http://directory.fedora.redhat.com/wiki/FAQ#How_is_Fedora_Directory_Serve...
I couldn't still find whether Fedora DS supports these features
too:
* automatic, on-line directory replication
I'm not sure what you mean by this. Could you explain this more?
* Java and C/C++ SDK
Yes. The Mozilla LDAP C and Java SDKs are included with the binary
distribution, as well as PerLDAP.
* horizontal and vertical scalability
Scalability: thousands of operations per second, tens of thousands of
concurrent users, tens of millions of entries, hundreds of gigabytes of
data
I was actually comparing the features with SUN's DS. It has
most of the features that I require; but if everything that SUN
supports is found in Fedora DS, then why waste money :) !
The features of Fedora DS are very, very similar to Sun DS, because up
until late 2001 they had the same code base.
- Dinil
On Mon, 20 Jun 2005, Mike Jackson wrote:
> Dinil Divakaran wrote:
>
>>
>> Greetings !!
>
>
> Greetings,
>
>> Before going for Fedora Directory Server, I thought of going through
>> the feature list to see what all additional features
>> are supported when compared to OpenLDAP.
>
>
> The list is long :-)
>
>
>> Though the feature list and FAQ says about many features
>> supported by Fedora Directory Server (like multi-master replication,
>> nested roles, cascading using hubs etc), they
>
>
>
>> don't provide information about some common features that
>> are supported by OpenLDAP. Some of such features include,
>> support for SNMP,
>
>
> Supported.
>
>
>> password hashing,
>
>
> Supported hashes are Crypt, SHA, and Salted SHA.
>
>
>> support of LDAP search
>> filters such as presence, equality, inequality, sub-string,
>> approximate and boolean operators,
>
>
> This is part of the LDAPv3 standard.
>
>
>
>> support for consumer-
>> initiated replication,
>
>
> Fedora DS does not support SyncRepl, if that's what you are asking.
>
>
>> support for supplier-initiated
>> replication,
>
>
> Supported in single-master and multi-master replication models.
>
>
>> support for Digital certificates,
>
>
> Supported for 8 years already.
>
>
>> support for
>> XMLDAP gateway and whether the Directory server support
>> XML for integration with external applications. XML and
>> XMLDAP are not supported by OpenLDAP too, I believe.
>
>
> DSML is the standardized markup language for LDAP, and this is
> supported in Fedora DS via the included DSML gateway process (java
> process).
>
>
> Fedora DS is a direct and immediate descendant of the Netscape DS,
> which was the first commercial LDAPv2 implementation in the world.
> Now it's at LDAPv3. Netscape invented most of these features, and
> OpenLDAP project started in 1999 to basically try to implement the
> core server and some of these Netscape features.
>
> If you ask me, the only real benefit to using OpenLDAP today is the
> abundance of strange backends, e.g. if you want to make a really
> special purpose LDAP server. You can make a directory out of just
> about any arbitrary data source, etc. Writing backends for Fedora DS
> is also possible, but there aren't too many available at the moment.
>
>
> Mike
>
> --
> LDAP Directory Consulting - http://www.netauth.com
>
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
11:51 a.m.
Dinil Divakaran wrote:
>>
>> * automatic, on-line directory replication
> I'm not sure what you mean by this. Could you explain this more?
>
Basically, online replication (not backup).
Yes. Fedora DS is fully automatic and on-line. You just have to create
the replication agreement, then initialize the consumer (on-line or
off-line), then everything is fully automated from that point on. The
replication protocol is supplier initiated. The protocol is robust
despite unreliable networks - it will automatically resync after network
restoration, and the protocol has been optimized to maximize WAN network
bandwidth and latency.
11:12 p.m.
On Mon, 20 Jun 2005, Rich Megginson wrote:
> * horizontal and vertical scalability
Scalability: thousands of operations per second, tens of thousands of
concurrent users, tens of millions of entries, hundreds of gigabytes of data
and if we have hundreds of thousands of users, is it possible to
partition into multiple repositories for scalability; instead of
having just one repository ?
- Dinil
6:59 a.m.
Dinil Divakaran wrote:
On Mon, 20 Jun 2005, Rich Megginson wrote:
>> * horizontal and vertical scalability
>
>
> Scalability: thousands of operations per second, tens of thousands of
> concurrent users, tens of millions of entries, hundreds of gigabytes
> of data
>
and if we have hundreds of thousands of users, is it possible to
partition into multiple repositories for scalability; instead of
having just one repository ?
Yes. You can split up the data into different suffixes and databases on
a single server (analogous to Novell "partitions" if you are familiar
with those), or you can use chaining to have multiple servers host the
data, and you can use entry distribution to distribute the entries in a
single suffix among multiple servers.
- Dinil
5:24 p.m.
Dinil Divakaran wrote:
and if we have hundreds of thousands of users, is it possible to
partition into multiple repositories for scalability; instead of
having just one repository ?
Yes, but O(100k) users is a very small number in the context of
what we'd call a 'large deployment'. When we do performance testing
the minumim size we test is 100,000.
Typically one sees partitioning used only at the 10's of millions of
entries level.
12:02 a.m.
David Boreham wrote:
Yes, but O(100k) users is a very small number in the context of
what we'd call a 'large deployment'. When we do performance testing
the minumim size we test is 100,000.
Typically one sees partitioning used only at the 10's of millions of
entries level.
Or for reasons of geographical namespace distribution, which is very
common in multi-city / multi-country organizations.
BTW, what is the largest number of bind operations that you have been
able to accomplish against a single server in a 24 hour period?
--
mike
11:29 a.m.
Dinil Divakaran wrote:
Thanks for the help guys !
So, does this mean that Fedora DS includes every feature in
Netscape DS and Redhat DS ?
Pretty much yes. There were one or two little used
features in later Netscape DS versions that have been
removed, but nothing significant.
I couldn't still find whether Fedora DS supports these features
too:
* automatic, on-line directory replication
Yes.
* Java and C/C++ SDK
The SDK isn't per se part of the server, but
the former Netscape C and Java SDK code is
used heavily in the server. It's available from
the Mozilla Directory project (open source).
* horizontal and vertical scalability
I was actually comparing the features with SUN's DS. It has
most of the features that I require; but if everything that SUN
supports is found in Fedora DS, then why waste money :) !
Sun and Fedora DS are very similar. They were the same
product until a few years ago when the code forked.
7:09 a.m.
In the features list, its written:
"Support for most LDAPv3 features, including many common controls and
extensions."
Is there any list of LDAPv3 features that are not supported by Fedora DS ?
On Mon, 20 Jun 2005, Mike Jackson wrote:
Dinil Divakaran wrote:
>
> Greetings !!
Greetings,
> Before going for Fedora Directory Server, I thought of going through the
> feature list to see what all additional features
> are supported when compared to OpenLDAP.
The list is long :-)
> Though the feature list and FAQ says about many features
> supported by Fedora Directory Server (like multi-master replication,
> nested roles, cascading using hubs etc), they
> don't provide information about some common features that
> are supported by OpenLDAP. Some of such features include,
> support for SNMP,
Supported.
> password hashing,
Supported hashes are Crypt, SHA, and Salted SHA.
> support of LDAP search
> filters such as presence, equality, inequality, sub-string, approximate
> and boolean operators,
This is part of the LDAPv3 standard.
> support for consumer-
> initiated replication,
Fedora DS does not support SyncRepl, if that's what you are asking.
> support for supplier-initiated
> replication,
Supported in single-master and multi-master replication models.
> support for Digital certificates,
Supported for 8 years already.
> support for
> XMLDAP gateway and whether the Directory server support
> XML for integration with external applications. XML and
> XMLDAP are not supported by OpenLDAP too, I believe.
DSML is the standardized markup language for LDAP, and this is supported in
Fedora DS via the included DSML gateway process (java process).
Fedora DS is a direct and immediate descendant of the Netscape DS, which was
the first commercial LDAPv2 implementation in the world. Now it's at LDAPv3.
Netscape invented most of these features, and OpenLDAP project started in
1999 to basically try to implement the core server and some of these Netscape
features.
If you ask me, the only real benefit to using OpenLDAP today is the abundance
of strange backends, e.g. if you want to make a really special purpose LDAP
server. You can make a directory out of just about any arbitrary data source,
etc. Writing backends for Fedora DS is also possible, but there aren't too
many available at the moment.
Mike
--
LDAP Directory Consulting - http://www.netauth.com
11:08 a.m.
Dinil Divakaran wrote:
In the features list, its written:
"Support for most LDAPv3 features, including many common controls and
extensions."
Is there any list of LDAPv3 features that are not supported by Fedora DS ?
I don't know the list of unsupported features, but I guess that you
could count it on one hand, and that none of them are required features.
If the server is LDAPv3 compliant, it correctly implements all MUST,
REQUIRED, and SHALL requirements from RFC 2251.
--
mike
1:42 p.m.
On 6/22/05, Mike Jackson <mj(a)sci.fi> wrote:
Dinil Divakaran wrote:
>
> In the features list, its written:
>
> "Support for most LDAPv3 features, including many common controls and
> extensions."
>
> Is there any list of LDAPv3 features that are not supported by Fedora DS ?
I don't know the list of unsupported features, but I guess that you
could count it on one hand, and that none of them are required features.
If the server is LDAPv3 compliant, it correctly implements all MUST,
REQUIRED, and SHALL requirements from RFC 2251.
What about RFC 2829?
Sam
2:23 p.m.
Sam Tran wrote:
On 6/22/05, Mike Jackson <mj(a)sci.fi> wrote:
>If the server is LDAPv3 compliant, it correctly implements all MUST,
>REQUIRED, and SHALL requirements from RFC 2251.
>
What about RFC 2829?
A server doesn't have to implement RFC 2829 to be LDAPv3 compliant.
Anyway, FDS implements almost all of those, like Start TLS, X.509
certificate authentication, and SASL. I am guessing that the DIGEST-MD5
authentication method is not supported, but I'm not certain.
--
mike
2:33 p.m.
Mike Jackson wrote:
Sam Tran wrote:
> On 6/22/05, Mike Jackson <mj(a)sci.fi> wrote:
>
>> If the server is LDAPv3 compliant, it correctly implements all MUST,
>> REQUIRED, and SHALL requirements from RFC 2251.
>>
>
>
> What about RFC 2829?
A server doesn't have to implement RFC 2829 to be LDAPv3 compliant.
Anyway, FDS implements almost all of those, like Start TLS, X.509
certificate authentication, and SASL. I am guessing that the
DIGEST-MD5 authentication method is not supported, but I'm not certain.
Yes. DIGEST-MD5 is required. Fedora DS supports it.
--
mike
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
9:27 a.m.
Dinil Divakaran wrote:
On Mon, 20 Jun 2005, Mike Jackson wrote:
>
> Fedora DS does not support SyncRepl, if that's what you are asking.
>
Does SyncRepl mean keeping replicas in sync (say by enforcing
Replication updates) ?
SyncRepl is the OpenLDAP replication mechanism. It is strictly consumer
initiated and works like a persistent search with an update cookie.
Fedora DS does not support this, so you cannot, for example, set up
replication between OpenLDAP and Fedora DS using this mechanism.
If so, this is an important feature that need to be supported, right ?
No. Fedora DS replication provides all of the sync you need for server
to server. Fedora DS provides a legacy changelog and persistent search
for more "lightweight" client sync applications.
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
12:32 p.m.
Dinil Divakaran wrote:
Does SyncRepl mean keeping replicas in sync (say by enforcing
Replication updates) ?
It is just a new type of replication protocol, which is at the moment
only supported by OpenLDAP. It is supposed to be more resistant to
problems which occur after there has been long downtime between
replicas, and is very suitable for e.g. synchronizing directories for
offline usage (laptops).
If so, this is an important feature that need to be supported, right
?
http://www.openldap.org/doc/admin22/syncrepl.html
I would certainly like to see a compatible replication protocol between
OpenLDAP and FDS. I guess this could be implemented as a plugin...
Mike
--
LDAP Directory Consulting - http://www.netauth.com
3:24 p.m.
Note that there are a lot of issues with replicating data between
dissimilar ldap implementations, and always will be until things like
access control is standardized. Even if I could replicate my data to
openldap, it would not honor the fds aci's, which would result in
unexpected/unwanted results.
- Jeff
Mike Jackson wrote:
Dinil Divakaran wrote:
>
> Does SyncRepl mean keeping replicas in sync (say by enforcing
> Replication updates) ?
It is just a new type of replication protocol, which is at the moment
only supported by OpenLDAP. It is supposed to be more resistant to
problems which occur after there has been long downtime between
replicas, and is very suitable for e.g. synchronizing directories for
offline usage (laptops).
> If so, this is an important feature that need to be supported, right ?
http://www.openldap.org/doc/admin22/syncrepl.html
I would certainly like to see a compatible replication protocol
between OpenLDAP and FDS. I guess this could be implemented as a
plugin...
Mike
3:48 p.m.
Jeff Clowser wrote:
Note that there are a lot of issues with replicating data between
dissimilar ldap implementations, and always will be until things like
access control is standardized. Even if I could replicate my data to
openldap, it would not honor the fds aci's, which would result in
unexpected/unwanted results.
Good point. OpenLDAP does support ACIs, but it is listed as
experimental, and you have to explicitly enable it at configure time.
Still, I don't know if the ACI syntax and evaluation algorithms in OL
and FDS are similar or not.
BR,
--
mike
4:07 p.m.
Mike Jackson wrote:
Jeff Clowser wrote:
> Note that there are a lot of issues with replicating data between
> dissimilar ldap implementations, and always will be until things like
> access control is standardized. Even if I could replicate my data to
> openldap, it would not honor the fds aci's, which would result in
> unexpected/unwanted results.
Good point. OpenLDAP does support ACIs, but it is listed as
experimental, and you have to explicitly enable it at configure time.
Still, I don't know if the ACI syntax and evaluation algorithms in OL
and FDS are similar or not.
It's very different. For one, the ACI syntax is different. For
another, AFAIK, the way in-tree ACIs work with OL is that they are
stored in the cn=config tree instead of being in the aci operational
attribute in the regular tree.
BR,
--
mike
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
4:17 p.m.
Rich Megginson wrote:
It's very different. For one, the ACI syntax is different. For
another, AFAIK, the way in-tree ACIs work with OL is that they are
stored in the cn=config tree instead of being in the aci operational
attribute in the regular tree.
The OL "experimental" ACI support existed long before OL supported
cn=config (which only came in the just released 2.3 branch, afaik).
I haven't used the old ACI support with OL, but I really would have
thought that they just implemented a verbatim copy of Netscape ACI syntax.
Maybe it's time to play around a little with OL this weekend.
--
mike
4:29 p.m.
Mike Jackson wrote:
Good point. OpenLDAP does support ACIs, but it is listed as
experimental, and you have to explicitly enable it at configure time.
Still, I don't know if the ACI syntax and evaluation algorithms in OL
and FDS are similar or not.
Nope - openldap's experimental aci's are comlpetely different from fedora's.
- Jeff
6882
days inactive
6885
days old
389-users@lists.fedoraproject.org
26 comments
6 participants
participants (6)
-
David Boreham -
Dinil Divakaran -
Jeff Clowser -
Mike Jackson -
Rich Megginson -
Sam Tran