Thursday, February 21, 2008

OpenLDAP vs Fedora Directory Server

I was recently coming up to speed on LDAP. Eager and ready, I got OpenLDAP version 2.4.7 and came up to speed with LDAP in general and had a server up and running fairly quickly.

While working with OpenLDAP, and editing and loading ldifs, I was quickly hoping some tool existed to manage the basic ldap tasks. I installed phpLdapAdmin which seemed to do the job. I enabled the ppolicy module and found out that trying to clear a users password inside phpLdapAdmin ( setting the text box to empty and then committing) caused OpenLDAP to exit with an assertion error. Ouch!! Determined that this was a pretty obvious bug, I found the latest source code had already fixed the issue. I installed the patch, and no longer did slapd exit when setting an empty password.

Today, I noticed 2.4.8 was released which also had the password fix, so I pulled that in and upgraded.

The next OpenLDAP task was to get multi-master replication up and going. After getting two servers set up I was able to add a single user and remove it from either server. Everything looked good. I decided to try refreshOnly syncing instead of refreshAndPersist. However, after changing the sync method on both servers, as soon as I restarted the servers and both servers connected, one would seg fault. I changed both back to refreshAndPersist, tested the single add and delete, and went to the next step--bulk loads.

I added 10 users to an ldiff. When I loaded them up, all ten would load up fine into the local server, but only one or two users from the list would get replicated to the other server. After deleting and adding several times, I could never get all 10 to replicate. I thought the computers not being ntp synced was an issue, but getting them synced up did not fix the issue.

I realize N-Way multi master has only been around since October or so. It would appear to me, it's not yet ready for production use if you are planning to do multi-master replication.

While working with OpenLDAP, I learned about the existence of Fedora Directory Server, and running Fedora myself, I got that up and going too. The experience has been completely different. The initial setup was simple ( RPMS -- no compiles ). The web-based java management tool is tons more functional than phpLdapAdmin, the documention is incredible, and it has yet to crash on me. FDS now manages my simple home network user accounts, and is now my LDAP server of choice.

Tomorrow, I will test FDS mult-master replication and report back on my findings. The multi-master replication is more mature than OpenLDAPs, so I have high expectations.


Gavin Henry said...


Did you raise any questions on the OpenLDAP lists to try and resolve these crashes?



Michael Martin said...

Hi Gavin,

I haven't posted any issues to the OpenLDAP community yet--primarily do to the lack of time to contribute. If I get some time, I'll pull in the head branch at home, try again, and post the problems with stack traces, etc. to the forums.


Gavin Henry said...

It's always best to use a release and not CVS. CVS HEAD is not guaranteed to work.

Michael Martin said...

I agree. This morning I used cvs head since using 2.4.8 was giving me issues before, and I wanted to be sure the problem wasn't already fixed. I re-ran with 2.4.8 on my home machine today. See my soon-to-be post.

rahim.virani said...


Im interested to know how your N-way replication tests went with FDS, please do post your results :)

We run openLDAP, Im looking for something that does N-way.

Kindest Regards,


Michael Martin said...


I never tested the N-Way on Fedora--just 2-Way. OpenLDAP has improved since this posting. If I were you, I would set it up and try out the N-Way with your current OpenLDAP setup. It might work just fine, and you won't have to go through any migration troubles.


Ashish said...

Hi Michael,

Did you tell me which link/reference you had follow to configure multi-master configuration? I am planing to configure in production env. what you suggest?


Ashish said...

Hi Michael,

I got these:

Seems sufficient for replication configuration. But my second question still persists.

Sen said...

Hi Michael,

Its really wonderful to look at your blog on FDS. Am also currently into FDS MultiMaster Replication, are you successful in doing that. I'm having a similar situation like I need to mirror my FDS. Could you please help me to get the things going. My requirement is to mirror the existing FDS on RHEL5, I had been provided with another RHEL5, were I need to install FDS and configure for mirroring.

Your blog seems to be promising and if you could help me to configure for my requirment, it should be of great help.