LDAP meta directory
Sometimes you need to combine two or more LDAP directories with same suffixes to one directory or you just need to have a proxy. My first attempts to combine two OpenLDAP directories was to make replication from two different sources. This solution however has some disadvantages. First of all: to have syncprov replication your environment must be uniform, this means all source servers and proxy needs to be OpenLDAP. Second: I observed that this is not so stable, because of mentioned earlier issues with OpenLDAP replication.
When I finally decided to move larger part of my LDAP directory (about 48k entries) to OpenDJ server, I was searching for other solution, and DSEE or Oracle Virtual Directory, which is probably best proxy server was out of my scope. Then I decided to use OpenLDAP Meta Proxy.
Replication was not good solution, because each LDAP server has it’s own way to do it, for example OpenDJ is using separate port 8989. But there is something common in LDAP implementations: on 389 port each server responding for queries in LDAPv3 standard. I found then something like backend ldap (
Configuration is rather simple, one need to enable
back_ldap.la module and put few lines to configuration file.
modulepath /usr/lib/ldap moduleload back_ldap.la # other stuff, schemas etc. database ldap suffix "dc=example,dc=com" #rootdn uri ldap://192.168.1.10/ ldap://192.168.1.20/
But this is not what I searching for. This works that way, that first server will answer to query until is not available, then query will be transferred to next server from list, and if it will answer then will be moved to first place in list (according documentation). That’s OK, but if servers have the same content, but I need to join sources with different content in one Directory Information Tree (DIT). Let’s focus on meta backend (
I found in backend documentation that this can be proper solution, but configuration section there is very poor, because contains only one word: LATER.
Fortunately, configuration is not so complex:
# Load dynamic backend modules: modulepath /usr/lib/ldap moduleload back_ldap.la moduleload back_meta.la # other useful things access to dn.base="" by * read access to dn.base="cn=Subschema" by * read include /etc/ldap/acl.conf database meta suffix "dc=example,dc=com" uri "ldap://192.168.1.10/dc=example,dc=com" uri "ldap://192.168.1.20/dc=example,dc=com" lastmod off
Of course, you need to put all schemas used by source servers. Even if Metadirectory will start without this, it will be not able to serve results to client, because it will not know about attributes existed in source servers.
You should also make proper ACLs, here are included from separate file. You can also put few parameters like
rootpw or different DIT fragments in URI, like that:
database meta suffix "dc=example,dc=com" uri "ldap://192.168.1.10/ou=org-1,dc=example,dc=com" uri "ldap://192.168.1.20/ou=org-2,dc=example,dc=com" lastmod off
But personally I did not test that, so I will not describe here.