Results 1 to 7 of 7

Thread: LDAP required?

Hybrid View

  1. #1
    Join Date
    Oct 2005
    Posts
    6
    Rep Power
    10

    Default LDAP required?

    is LDAP required?

    why wouldn't I want to just cache permissions in memory from a database call?

    update- just found this from a search: http://www.zimbra.com/forums/showthread.php?t=409

    I assume the authentication layer is 'pluggable' in the next beta?

    maybe I just have a bad taste left over from past exposure to LDAP repositories, they seemed to complicate our application model when used about 2-3 years ago - of course we were building one of those 'enterprise' java apps, so everything was complicated...several 'enterprise architects' later (avg half life of about 3 months), well you know the story

    since I'm editing this post now that I found additional info from a search of the forums - and I'm done ranting- my primary questions are:
    Why would I want to use LDAP? (assuming no legacy ldap user store to worry about)...most seem to already have a database somewhere in their environment but few (?) have ldap - am I missing some justification?

    thanks.
    Last edited by debianfoo; 10-26-2005 at 05:24 AM. Reason: found additional info via search

  2. #2
    Join Date
    Aug 2005
    Location
    San Mateo, CA
    Posts
    4,789
    Rep Power
    19

    Default

    LDAP is designed for read heavy structured data. This is what we put in there. Most enterprises use LDAP to manage user data, so while you may not most do. Of course the source code is available so if you'd like to make changes for your environment then the code it there for that.

    The next beta won't have the pluggable auth framework but again it's close enough now that with a little coding you can make it so.

  3. #3
    Join Date
    Oct 2005
    Posts
    6
    Rep Power
    10

    Default clarification on LDAP?

    Thanks Kevin.

    Are there any benchmarks that actually quantify the performance benefit of LDAP? Internal from your group, or external on the web. I googled, but did not find anything compelling.

    I understand the need for trying to conform to what most enterprises already have deployed, that was our reason for using LDAP also (when I worked in software dev). But now, I am just part of a small academic group looking at email solutions - and LDAP seems like one more thing to worry about. We already have many databases that we admin.

    In my past life, I just recalled that it was one more system for admins to learn (if it was not already installed at an enterprise) - and indexing the user table in a RDBMS with an in memory cache at the app layer seemed to allow a simpler install and was more performant (for us). We were using iPlanet at the time - and had to monkey with getting the LDAP trees into memory anyway, in the end (because of performance problems).

    Thanks again for clarifying this matter. I'm far from an expert in this area, and given all of the great work that your team has done, I assumed there was likely a good reason that you were using LDAP.
    Last edited by debianfoo; 10-26-2005 at 04:50 PM. Reason: re-word

  4. #4
    Join Date
    Aug 2005
    Posts
    228
    Rep Power
    10

    Default

    LDAP provides a number of benefits:

    1. centralized configuration, good when lots of servers need access to the same data
    2. well integrated with MTAs (for mail routing)
    3. can be used for authentication
    4. can be used for a global address list/corp directory, and is supported by MUAs (Thunderbird, Outlook, etc)
    5. you can replciate the data, for high availability


    We've done our best to try and hide some of the LDAP management issues, but it is still there.

    Internally the system was designed around some Java interfaces/abstract classes (com.zimbra.cs.account.*, Provisioning.java in particular), with our implementation via LDAP (com.zimbra.cs.account.ldap.*).

    It is possible that you coulld actually back all the accounts, config, via a database like MySQL by writing a MySQL version of those interfaces. This might make sense for a small/single-node install.

    The remaining issue would be Postfix mail routing, but you could write some Perl/Java/Ruby that pulled the data out of the server and put it into dbm maps that Postfix looked at.

    Ideally someone in the community would do this work and contribute it back

    roland

  5. #5
    Join Date
    Oct 2005
    Posts
    5
    Rep Power
    10

    Default

    I had the same feelings about using ldap until I ran across a little known FREE app called Penrose, it's a virtual LDAP server that maps to fields in a backend database. It's Open Source and based on the ApacheDB, 100% java so it works on multiple platforms, and very easy on the cpu. They also provide a GUI based application for mapping the feilds in your database to the LDAP feilds. It also includes a configurable cache so it doesn't have to hit the db as much.

    Penrose - Virtual Directory Server
    http://penrose.safehaus.org/

    For those of you with content management systems like Mambo or DotNetNuke....
    I'm using Penrose to allow users who signup to our portal and after we approve their access to have an account in Zimbra. So their account is really in the portal user database. They can change their password and profile in the portal as much as they want and Zimbra stays updated. If we remove there account for whatever reason they can't access Zimbra anymore. We also provide GAL via LDAP based on the information in the database.

    The only issue I'm still working on is single logon, so when they log into the portal the are automatically logged into Zimbra. Maybe one of the Zimbra guys can help me with that one....?

    hope this helps....

  6. #6
    Join Date
    Aug 2005
    Location
    San Mateo, CA
    Posts
    4,789
    Rep Power
    19

    Default

    Quote Originally Posted by bmiddleton
    The only issue I'm still working on is single logon, so when they log into the portal the are automatically logged into Zimbra. Maybe one of the Zimbra guys can help me with that one....?
    Single sign on is easy. You just need to use our SOAP API (see ZimbraServer/docs/soap.txt in the source for full details) to get an auth token from the server using the username/password. Then set the auth token a cookie and finally redirect them to Zimbra.

    A sample SOAP request is attached.

    The Java code to set the cookie and redirect would be:

    Code:
    Cookie authCookie = new Cookie("ZM_AUTH_TOKEN", authToken);
    authCookie.setPath("/");
    res.addCookie(authCookie);
    res.sendRedirect("http://yourzimbrahost.example.com/");
    Attached Files Attached Files

  7. #7
    Join Date
    Oct 2005
    Posts
    6
    Rep Power
    10

    Default

    thanks for the great help, I'm amazed at how responsive the Zimbra team is

    penrose should do the trick

    we actually also have a small wiki/knowledgebase app for sharing docs, semi structured data, etc. - it provides a pluggable auth layer (it can use an LDAP store, etc.), and we already have a RBAC model in the db, but Penrose looks to be the simplest route to exposing this model to Zimbra - no migrations, and everything is still in the db

Similar Threads

  1. LDAP Replication Experiences
    By technikolor in forum Administrators
    Replies: 4
    Last Post: 11-11-2008, 11:52 PM
  2. Zimbra + Samba LDAP auth problems
    By fajarpri in forum Installation
    Replies: 3
    Last Post: 07-04-2007, 11:39 PM
  3. 3 testing: LDAP: 389 Failed when restore zimbra
    By victorLeong in forum Administrators
    Replies: 15
    Last Post: 05-24-2007, 06:45 AM
  4. Mac OSX install: Java errors & LDAP CA error
    By jefbear in forum Installation
    Replies: 9
    Last Post: 12-16-2006, 02:39 PM
  5. Replies: 4
    Last Post: 11-15-2006, 11:16 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •