0
votes

I know that LDAP server (or directory service or directory) stores information (mostly used for storing user information) in object oriented database.

Is it just a "user store"? And can be used using LDAP API or "LDAP configuration in server" for user authentication and to get user information...

LDAP in itself provides any other functionality than storing user information? Like security configuration? policy configuration? etc.

How bad performance will be if a relational database (say Oracle) is used to store user information?

Thanks.

2
new user tip: if you find some answer helpful, you may want to upvote it :) - Piotr Wadas

2 Answers

3
votes

Actually newer versions of OpenLDAP store their configuration inside itself only, classic text configuration file is depreciated, if not removed already. This feature is called cn=config in OpenLDAP [ http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config ]. Thing you're probably thinking about is dynamic ACI ( not to be confused with ACL which is also provided ), and sure, LDAP, in general, provides much functionality like that. There are also monitor backends provided, in general LDAP likes itself, and is driven into self-managed direction. However, it's purpose is quite different than RDBMS, it's optimized for search operations, but not manipulating data and doing computations on it. Think it that way - e.g. user information, or DNS information is retrieved enormously more times than modified, and that's field in which ldap rocks. You actually rarely need suming UserID's, don't you? :) Object oriented database means, that - in contrary to RDBMS - data is organized with the way closer to OO type ( classess, attributes, inheritance etc. ). There are also SQL backends to ldap ( don't know what sense does it make though ), but I haven't heard about LDAP backends for SQL database.

Have a look on OpenLDAP Administration Guide here

http://www.openldap.org/doc/admin24/

Regarding storing custom information, you can create your own classes, objects and even attribute types, by inheritance/composing existing entities, or from scratch. Sky is the limit, man ;-)

0
votes

An LDAP directory server stores data in attributes which are grouped in entries. Which attributes are required or allowed in an entry is defined by an attribute called an objectClass. Each attribute type has an attribute definition in a schema. The attribute type definition has a syntax which defines what sort of data is allowed, possibly a matching rule and/or ordering rule defining how attribute values are compared, and other data describing the attribute. Any sort of data can be stored in a directory server database, including binary data. Most often a directory server is used for authentication and profile information. Legacy directory servers like OpenLDAP don't perform as well on updates (ADD, MOD, DELETE, MODRDN) as on authentication or searches, but more modern servers perform updates at a very high rate.