NIS<->LDAP Gateway, referrals, a distributed LDAP directory and bad headache.

[Mathias Homann]

I have to find a way to put up a LDAP tree so that each department has
a) its OWN ldap server
b) its OWN nis<->ldap gateway,
but any given user should be able to login on
ANY workstation ANYWHERE in the network;
or to put it more simple, If I did 'ypcat passwd' on ANY machine ANYWHERE I want to see all accounts from all over the company...

In theory, I'd set up smart referrals or default referrals inside the ldap tree, so that
any ldap server would point to his 'superior' when asked something he doesn't know.
But as I tried this approch, the gateway
doesn't follow those referrals at all, and it follows referrals into subtrees only
sluggishly, and not always...

As it is an experimental installation so far, all ldap servers concerned are on the same
host, running on different high ports.

I also tried the approach to set up a 'parent domain' in ypldapd.conf but that didn't help either..


any hints for me


bye,
M.Homann

[harry d brown jr]

Why not have a master ldap, and the departmental servers be slaves?

live free or die
harry

[Mathias Homann]

and then have the nis<->ldap gateways connect to the master?
been there.. done that...
boss says 'no way, no single point of failure'. Besides, the departments are NOT at the same location, so this way would make the ldap queries travel around the world via WAN lines...

bye
MH

[Mathias Homann]

besides,

even when I have the nis<->ldap gateway software connect to the topmost ldap server it doesn't follow referrals, but a shell-issued ldapsearch does...

bye
MH

[Mathias Homann]

another fact found:

hosts a and b; host a has 4 DS4 instances on different ports, built into a tree via smart referrals.

When I do ldapsearch with the ldap tools from that nis<->ldap gateway, this happens:

when I do it on the same machine that runs the DS4 instances, it follows the referrals down to the last branch.

when I do it on the other machine, it only sees entries in the top-level ldap server.