Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Fedora Directory Server 1.0 Released! 200

Posted by Zonk from the like-a-kid-with-edubuntu dept.
LnxAddct writes "NewsForge is reporting that the first official release of the Fedora Directory Server has been announced. This is good news for members of the open source community longing for an easy to use, enterprise class directory server. Fedora Directory Server is based off of Netscape Directory Server which Red Hat purchased a year ago and released as open source. Screenshots are available on their site." NewsForge is a Slashdot sister site.
This discussion has been archived. No new comments can be posted.

Fedora Directory Server 1.0 Released! More

Fedora Directory Server 1.0 Released!

Comments Filter:

  • command line (Score:5, Interesting)

    by Darkon ( 206829 ) on Sunday December 04, 2005 @06:32AM (#14177676)

    A fancy GUI [redhat.com] is all very well, but does this come with some decent command line tools to scriptify adding and removing users and the like? One of the things that's kept my department on NIS for so long is that absolute hideous unfriendliness of the OpenLDAP tools vs useradd, usermod and friends.

    • Re:command line (Score:3, Insightful)

      by Anonymous Coward
      In short: Yes.

      However, I find it interesting that you describe OpenLDAP as "absolute hideous unfriendliness" when it simply isn't that case. Granted that the ldif format isn't obvious or familiar, using the command lines tools is actually rather simple. You only need to understand how an LDAP Directory works, and how your schema of choice is laid out.

      I have personall written a front end for managing userspace in OpenLDAP via bash scripts, and I can tell you that once I spen a hour reading up on ldif, it w

      • Re:command line (Score:3, Insightful)

        by dtfinch ( 661405 ) *
        For some people, "absolute hideous unfriendliness" means you have to read documentation, as opposed to the program having a nice GUI interface that is comprehensive, intuitive, obvious, and familiar to a new user.
        • Well, LDAP, in all it's shapes and forms is absolutely hideous and unfriendly.
          Its age shows, it's software from "way back".

          LDAP is one of the architectures that would really be worth reinventing.
          Imho the main reason why we still don't have "easy" single-signon in unix-land is because
          the only available route nowadays leads through LDAP- and kerberos-land which both do their particular
          job well but are such a pain to setup, maintain and integrate with that only the bravest and most fearless
          sysadmins dare to wa
      • For those wishing an easier way to manage their userbase in their LDAP directory:

        http://phpldapadmin.sourceforge.net/ [sourceforge.net]

    • Re:command line (Score:5, Informative)

      by digitalhermit ( 113459 ) on Sunday December 04, 2005 @07:28AM (#14177790) Homepage
      The addition of a user is pretty simple... Just run ldapadd against an ldif file. To create the LDIF file is simple and you can do it with a perl script to specify username, userid and password. To create the password you can use crypt or md5. Something like:

          my @validsalt = ('a' .. 'z', 'A' .. 'Z', 0 .. 9, '.', '/');
          my $salt = $validsalt[rand(64)] . $validsalt[rand(64)];
          my $test = crypt($cleartext, $salt);

      Of course, you'd also want to do some basic validation of the inputs. Then just wrap the user inputs in an LDIF template and run. It sounds a lot more difficult than it actually is.

      The schema can actually validate that userid is unique, but you should check anyway and also validate the groups and gids.
      • The main gripe is that you have to kludge all this yourself.
        Every admin in the world must write his or her own script to add a user to the directory.

        Why can't we have ready-made programs that perform such simple tasks?
        Like useradd, for example.
        • LDAP itself is not *just* for authentication, though that's one of its more popular uses. That's probably why there are not so many specific auth related tools. It's a similar thing with the more decoupled Linux LVM versus, for example, AIX's tightly integrated LVM. There are GUI tools such as JXplorer and lots of Java based apps that can add/modify entries. JXplorer, for example, can define template screens so that you can view only auth relevant parts of the schema.

        • Re:command line (Score:3, Informative)

          by aaronl ( 43811 )
          You could use the IDEALX smbldap-tools for the scripts and all. That would give you UNIX and Samba authentication and user account information, and control over groups, as well as a simple command line tool for passwords.
    • Most scripting languages will have some kind of LDAP module available, like python has http://python-ldap.sourceforge.net/ [sourceforge.net] and perl has http://ldap.perl.org/ [perl.org].

      So even if Fedora's directory server doesn't offer any console tools (i dont know if it does), it won't be any problem making scripts manipulating its data. Take a look at this example on howto remove a record, its from the python-ldap site, and it isn't exactly overly-complex to use from the looks of it :-)

      import ldap
      try:
      l
    • You thought that those screenshots look fancy? My first thought on looking at those screenshots was 'How could they make such a butt ugly theme the default for Swing applications?'. It combines the worst apects of Motif and Windows95.
      • The answer is probably that they don't care what it looks like so long as it works and it's easy to use. It's an administration tool, not a video game.
    • Thankyou. This is the first thing I noticed too. Obviously something that hasn't changed since its netscape days when they needed to be able to show something to PHBs who made purchasing decisions. A big dumb 'START SERVER' button. Please god let them unix-ise the software in the next few versions.
    • A fancy GUI is all very well, but does this come with some decent command line tools to scriptify adding and removing users and the like? One of the things that's kept my department on NIS for so long is that absolute hideous unfriendliness of the OpenLDAP tools vs useradd, usermod and friends.

      Have you heard of ldapadd and ldapmodify? These tools are available from OpenLDAP or from pretty much any OS that is LDAP capable. I know you're probably just trolling but it's quite obvious you've never used LDAP o

  • wow (Score:5, Insightful)

    by know1 ( 854868 ) on Sunday December 04, 2005 @06:36AM (#14177681)
    redhat bought something usefull and made it open source? that's one of the most amazingly good things i've heard this week. i thought open source was all about using software made for free. it's so great to see a xcompany making a living off open source to buy something usefull the community needs and give it out for free. i'm a debian man myself, but keep up the good work redhat!

    • Re: wow (Score:5, Informative)

      by Dolda2000 ( 759023 ) <fredrik.dolda2000@com> on Sunday December 04, 2005 @07:20AM (#14177777) Homepage
      This isn't exactly the first time RedHat has done something like this. Last year, they also bought Sistina and released GFS for free. I think they have done other such things as well, but I can't remember any off the top of my head.

    • Not the first time. (Score:5, Informative)

      by ebuck ( 585470 ) on Sunday December 04, 2005 @08:31AM (#14177920)
      As another poster has already stated, it's not the first time that RedHat has bought something and then changed the license to an open-source license.

      However, this story is just a bit more complicated.

      RedHat open-sourced all of the code they could, which was quite a bit, but originally just the main directory daemon, ns-slapd, a few shared libraries and command-line tools were open source. The real news here is that the last of the "other" bits have finally been re-written under a new (open-source) license.

      That's part of the motivation for resetting the release nubmer; note that this is verison "1.0" instead of (grumbles about memory) 8 or 9?

      So now, it is a 100% open source solution, no more binary-only rpms.

    • Re:wow (Score:3, Informative)

      by TheRaven64 ( 641858 )
      As another poster pointed out, Sun have done this with other things as well. One example that I suspect a lot of /.ers are familar with is Cygwin - bought be RedHat and open sourced. They are also not the only company to do this. Sun bought a German outfit called Star Division and released their flagship product as open source, and continue to supply most of the developer time to it. You might have used that too.
      • I remember reading that Sun paid $88,000,000 for Star Office, that became Open Office. Sun still charges for support for Star Office, and my guess is that Sun has made a profit on its investment in Star Office, even though an open source version is free.

    • Re:wow (Score:5, Informative)

      by LnxAddct ( 679316 ) <sgk25@drexel.edu> on Sunday December 04, 2005 @12:10PM (#14178736)
      Heh, you severly underestimate Red Hat's contribution to the community:) Read this [fedoraproject.org] for a truncated list of contributions they've made. Some other products they've purchased and released include GFS [redhat.com], Cygwin [cygwin.com], and eCos [sourceware.org]. They also contribute more code to the kernel than any other entity and in large part maintain and extend glib and GCC (they have a few people on the GCC board and contribute huge amounts of code, in fact many of the newest features in GCC 4.0.x you can thank Red Hat for). Here [sourceware.org] is another list, but that list is only for projects hosted from that site, so its not complete either, but suffice it to say that Red Hat does a staggering amount for the community, its kind of a shame when people bash them.
      Regards,
      Steve
      • Some other products they've purchased and released include GFS, Cygwin, and eCos.

        Cygwin and eCos (and, I think the majority of GCC 2.0) were developed by Cygnus, which Red Hat subsequently bought.

        ... Red Hat does a staggering amount for the community, its kind of a shame when people bash them.

        Indeed. It's just their distributions that suck.

    • Being a Debian man too, I'm wondering how long it will be until we can apt-get install this program...

  • + Kerberos ? (Score:5, Informative)

    by ratatask ( 905257 ) on Sunday December 04, 2005 @06:50AM (#14177713)
    One of the net things is if you couple together Kerberos [mit.edu] with LDAP - much like a windows network
    with Active Directory.
    Does the Fedora DS intergrate those two neatly, single sign on is neat, but OSS provides
    no turnkey solutions for this (yet).

    • Re:+ Kerberos ? (Score:4, Insightful)

      by Dolda2000 ( 759023 ) <fredrik.dolda2000@com> on Sunday December 04, 2005 @07:35AM (#14177807) Homepage
      but OSS provides no turnkey solutions for this (yet).
      Maybe this is just me, but I've never understood why people need "turnkey solutions" for things like these. Updating your LDAP, Kerberos, NSS and PAM configs manually isn't exactly hard as it is. If you want to make it easy to set up multiple workstations with this setup, just use Kickstart (or a shell script on NFS...).

      Really, I'm not trying to troll here, I'm just really not seeing what this need to click a single button for every possible setup comes from. Rather than trying to provide every possible setup from the start, as Microsoft does (and which much of the complexity in Windows derives from), isn't it better to have a generic solution that can be tailored to one's specific need, instead?

      • I've never understood why people need "turnkey solutions" for things like these.

        It's one possible measure for the amount of care that's put in the product. You can say this doesn't go for this particular product, but lots of times adoption of a product starts with someone who has 15 minutes of spare time.

        If the product doesn't show a few nice things within those 15 minutes, it just might be possible it's not looked further into.

        I'm not saying this is the correct procedure to evaluate an important piec

      • Re:+ Kerberos ? (Score:3, Insightful)

        by CRC'99 ( 96526 )
        Maybe this is just me, but I've never understood why people need "turnkey solutions" for things like these.

        Yeah, because it's not like this is a well used 'feature' in Windows Domains in just about every large company...

      • Re:+ Kerberos ? (Score:5, Insightful)

        by moreati ( 119629 ) <alex@moreati.org.uk> on Sunday December 04, 2005 @09:00AM (#14178009) Homepage
        Maybe this is just me, but I've never understood why people need "turnkey solutions" for things like these.


        Largely, I think it boils down to - 'because they don't understand the technology as we do'. Take a simple, high level requirement: identity management. You or I might see that in terms of the components: such as a directory, an authentication service, creation & removal scripts, some means of replication, monitoring scripts etc.

        A $notnerd sees the requirement as a black box, they don't care about the internals. They've probably been told by some techie/salesman that it will address some problem they have. For this person turnkey seems perfect, $company sells $product which is billed as an 'identity managment solution'. A magic black box solution to a black box problem, their work is done - now it is IT's problem.

        Updating your LDAP, Kerberos, NSS and PAM configs manually isn't exactly hard as it is. If you want to make it easy to set up multiple workstations with this setup, just use Kickstart (or a shell script on NFS...).


        To you it isn't, but what happens when you leave? It's much easier to recruit someone to maintain a push button solution, than a partly bespoke ecology of components and scripts. Often the solution and the ecology are similar in complexity, but the solution hides that behind a GUI and glossy marketting material.

        Purchasers often chose to spend their money on specialised software (solutions), hopefully saving time. We often choose to spend our time customising general purpose software, hopefully saving money.

        Alex

        • Re:+ Kerberos ? (Score:3, Interesting)

          by Dolda2000 ( 759023 )

          A $notnerd sees the requirement as a black box, they don't care about the internals. They've probably been told by some techie/salesman that it will address some problem they have. For this person turnkey seems perfect, $company sells $product which is billed as an 'identity managment solution'. A magic black box solution to a black box problem, their work is done - now it is IT's problem.

          I agree completely with that, but my main point is that I think that this "turnkey solution" should be a separate pro

          • Ah, looks like we're both arguing the same side of the coin.

            As you say, the turnkey solution should be a customisation of general parts, possibly tweaked to integrate with one another. The trick is getting a $notnerd to see this, marketting this solution so they choose it over Active Directory or ZENWorks. Consultants choosing and recommending it one good method.

            I believe this identity solution should be delivered like any other opensource project. A source package which distributions can repackage and inte

        • Re:+ Kerberos ? (Score:4, Interesting)

          by rhinoX ( 7448 ) on Sunday December 04, 2005 @12:56PM (#14178990)
          Actually, it's not always $notnerd vs. $nerd. I am a nerd in every sense of the word. I understand the technology as well, if not better than any other nerd. I also understand that in my company, my technical talents are better used to _produce new products_ for us to sell to our clients and thus make more money. Screwing around with configuration files, etc. is a _waste of my time_. I just want a directory service that allows single sign-on so I can easily add resources and people to the organization without having to freaking script my own mgmt console around some lame-ass command line tools because someone out there thinks that you have to use a CLI to "understand technology".

          • Also agreed.

            Sorry for my poor choice of phrase. What I meant was "person who at the time is uninterested in the technology, beyond how it can further their ends". I chose $notnerd because, in my experience, it's often the case when a monolithic solution-in-a-box is chosen.

            I'm not arguing against turnkey, I'm arguing for technically sound solutions. In my eye that means both a strong GUI (for everyone doing one off tasks) and a strong scriptable interface (for automating repetitive tasks). Having a scriptabl
          • What do you mean "lame-ass command line tools". In what way are they lame? Do they not work? I find the command line tools to be very powerful and easy to work with.

        • Re:+ Kerberos ? (Score:3, Insightful)

          by hkb ( 777908 )
          Largely, I think it boils down to - 'because they don't understand the technology as we do'.

          Oh that's just egotistical rubbish! People like turnkey solutions mainly for two reasons:

          1.) They're novices and they just want something that works
          2.) They're not novices, but they're overloaded with work and they don't want to learn the complete ins and outs of yet another massive, complex software package (note I said package, not the protocols it uses, etc).
          • Sorry, I've chosen my words poorly. Again.

            I should have said 'because they don't understand or care about the technology as we do, only the results'.

            Turnkey is sometimes a good choice, such as in the cases you give. Customised packages & bespoke are sometimes a good choice sometimes.

            My argument (and I believe Dolda2000's argument), is that turnkey solutions should not be monolithic. They should be built on independant components, rather than being a take it or leave it lump.

            Any solution (eg Active Direc
        • Why is a $notnerd maintaining something as important as your directory and authentication? Any CIO who hires a button pusher to maintain something as crucial as identity servers should be fired on the spot.
          • Comment removed based on user account deletion
          • The $notnerd isn't maintaining the system. Precise meaning has really come back, to bite me on the arse in this thread.

            A non-techie most often gets the final decision about which solution to choose. They base their decision on advice from their in house techies, sales pitches and bids received etc.

            One pitfall they wish to avoid, is a system that is more expensive to maintain and customise in the long term. A solution-in-a-box is commonly held to have lower staffing overhead, because less experienced (aka ch

      • Re:+ Kerberos ? (Score:3, Insightful)

        by drsmithy ( 35869 )
        Maybe this is just me, but I've never understood why people need "turnkey solutions" for things like these.

        Because it makes deploying them easier, quicker, cheaper and less dependant on a particular individual's (or individuals') knowledge.

      • I think it's because the domain of technical knowledge is so great that it's really quite difficult to grasp it all. If you're a small or medium sized company you may not have someone who really understands Kerberos and LDAP. Your sysadmins may know everything in the world about mailservers, webservers, DNS servers, DHCP servers and database servers but very little about AAA servers, Kerberos and LDAP. Look at the security community which is still farily young. People are already starting to specialize into

      • Maybe this is just me, but I've never understood why people need "turnkey solutions" for things like these. Updating your LDAP, Kerberos, NSS and PAM configs manually isn't exactly hard as it is.

        Yes, yes it is. Now you can obviously do it. So can I - that's one of the many jobs I do, installing LDAP and Kerberos services for corporate and government clients - but it's not easy. If it was easy then these companies and agencies wouldn't need to hire me. They could do it themselves.

        Let's face it. The t

    • I set up OpenLDAP as backend for the heimdal kerberos, so i guess you can do the same with FDS even though its not an official feature.
    • I agree. Hopefully the next Fedora, RedHat ES will support this directory server out of the box for authentication and serving. LDAP is finally begining to mature to the point that it is realistic to use it to control heirarchal information for large and medium (and even small) enterprises. About 8 years ago I did a project to tied sendmail to a LDAP server for email authentication. Tha was painful in the extreme. Now Zimbra has a LDAP and Hula (which I think the two most promising future email platforms) b
    • Andrew Bartlett [samba.org] from the Samba team is a proponent of such integration, taking place in Samba 4 [samba.org]. See his paper [samba.org] on this.
  • The example they used in the screenshots [redhat.com] is the same one used here! [66.102.9.104] There must be a deeper meaning to this blatant plagiarism. I mean, even the phone number is the same... Yep, definitely a terrorist plot in the making somewhere here...

  • Gentoo package? (Score:5, Interesting)

    by nighty5 ( 615965 ) on Sunday December 04, 2005 @07:05AM (#14177748)
    Anyone know if there is a gentoo package for this? - Even if it's not the most up to date.

    I've searched used such strings as "ldap", "nss", "directory" etc - but nothing comes up too interesting.
    • My pick is is not yet ported - so you can try to contribute a ebuild! It is your chance to shine! :)

      More seriously, I will check out depencies. As I have rather big interest in this product, I will check out If I can't contribute an ebuild.
    • Not yet, [gentoo.org] but since the release of 1.0 hit slashdot, I guess it will come soon... ;)
    • Anyone know if there is a gentoo package for this?

      This isn't a toy, it's an actual useful enterprise software package people use on production servers.

      Hence, probably not very high priority to Gentoo packagers.
  • In and of itself, LDAP started off as a partial implementation of the X.500 directory services - partial being the bits that people generally found useful. The LDAP specification has changed over time, reflecting a better understanding of what people actually needed - together with the fact that as systems became more powerful, people generally needed rather more out of services.

    The first problem is that Netscape probably didn'tadd much to their Directory Service towards the end, and it is unclear how much

    • Re:Interesting, but is it Good Enough(tm)? (Score:5, Interesting)

      by Anonymous Coward on Sunday December 04, 2005 @07:31AM (#14177796)
      I'm sorry, what the hell are you talking about? That was the most mindless post I have ever seen.

      The first problem is that Netscape probably didn'tadd much to their Directory Service towards the end, and it is unclear how much Fedora has had to put resources into code cleanups and bug fixes, as opposed to adding the capabilities it is going to need.

      Red Hat / Fedora Team spent about a year cleaning it up and porting it to linux, or didn't you bother to read the summary?

      For this directory server to be of much interest to network administrators, this package absolutely must support two-way communication with Microsoft Active Directory's LDAP. It can support more - and it would be great if, for once, Open Source "embraced and extended" something from The Other Side...

      Uh? What does it need? 3-way communication with AD? 4-way? Active Directory is just a bastardized for of LDAP, and even OpenLdap includes the bits needed to work with it. What you are saying here doesn't make any sense.

      To be of interest to system admins, it needs to work with PAM and preferably one of the standard "unified" admin interfaces, like Webmin or (yes, it is still used) linuxconf, in addition to specialized tools.

      What you are saying here demostrates a complete ignorance of PAM, LDAP, and directory services in general. PAM has long supported LDAP, as has the NSS libraries. Webmin and Linuxconf are two interfaces the people have added as a layer on top of existing services. Nothing NEEDS to work with them, they support whatever they want. FDS has a great GUI and that is the point. Otherwise, an LDAP service is a usefull as the schema you load and how you implement it.

      I like Fedora's distro, it is simply that if they are neglectful of something they can do in a script and a makefile, and of mere patches they had already made public, then how confident can I be of their ability to maintain a very complex piece of software?

      Ok, seriously, get a clue. If you are looking for assurance, pony up some cash and buy the fully supported Red Hat Directory Server. Frankly, I think the entire Fedora effort is great, but I wouldn't run any substatinal business on it. For that I pay for Red Hat.

      • Hmm.. so pay = better? contribute, test, fedora = mindless? Then why the fawk do we have all those folks(meaning us all, dev, sysadmins,dba's etc) working on Fedora?
      • AD is not just a bastardised LDAP. AD is LDAP+Kerberos+Extensions which needs to be *specifically* catered for. I'm assuming this DS supports AD otherwise it's just going to get nowhere in the corporate space.

      • Re:Interesting, but is it Good Enough(tm)? (Score:4, Interesting)

        by Temkin ( 112574 ) on Sunday December 04, 2005 @09:29AM (#14178087)

        Red Hat / Fedora Team spent about a year cleaning it up and porting it to linux, or didn't you bother to read the summary?



        "Porting to Linux" is and of itself a mindless statement, since this is Netscape DS, aka iPlanet DS, which is an antique fork of Sun's current SJES DS, all of which have been running on Linux for better part of a decade.

        It will be interesting to compare Fedora DS to Sun's current offering. Sun even provides an open source tool for this called SLAMD [slamd.com].
        • "Porting to Linux" wasn't the best verbage the AC could have used, but it doesn't quite descend to the level of 'mindless statement'. The fedora developers have worked to make DS for Linux a better product. For example the 1.0 release uses apache + mod_nss instead of the ns-httpd server, and the performance improvement is impressive. Of course the non-Linux platforms for which they produce DS presumably also reap these benefits, but it seems to me that the primary motivation is to make a great Linux prod
    • The first problem is that Netscape probably didn'tadd much to their Directory Service towards the end, and it is unclear how much Fedora has had to put resources into code cleanups and bug fixes, as opposed to adding the capabilities it is going to need.

      To really understand this move by Redhat, it has to be taken into context with last weeks news about Sun open sourcing their enterprise applications, one of which is iPlanet Directory Server. iPlanet Directory Server and Redhat's both forked from the same N
      • If that is the case, it's rather worse than I expected. I've been assuming that they've kept reasonable pace with comparable products, though given all the cruft in Netscape Navigator on its release, I was partly concerned Red Hat might have been forced to lag behind, just to get the code into acceptable shape.

        My main fears were largely concerning how well they tracked highly non-standard variants that are built into key products that the corporate market simply won't do without. Because things like AD are

  • About the console (Score:2, Interesting)

    by Sk0yern ( 783174 )
    Have anyone else noticed how slow the console is on a RedHat Enterprise 3 server?
    Its like you press a button, then you have to wait for 10 seconds before anything is happening. On Enterprise 4, everything is about 50 times faster, maybe even more.
    The main difference here should be 2.4 kernel versus 2.6 kernel, but what makes the console that much faster on 2.6?
    • No, I haven't noticed this at all on RHEL 3.

      • Re:About the console (Score:2, Informative)

        by Anonymous Coward
        User error, hit any person at keyboard to continue.

        It is probably trying to do some kind of lookup, ipv6 or your nameservice, you did configure your /etc/nsswitch.conf to look at the nameserver, not the local ldap server (recursive lookups are bad ! )

    • Have anyone else noticed how slow the console is on a RedHat Enterprise 3 server?

      Hmm... my airmchair diagnosis is that you may be suffering from a PEBKAC issue.

      I keed! I keed!

  • ldap schmel-dap (Score:3, Interesting)

    by Anonymous Coward on Sunday December 04, 2005 @07:38AM (#14177821)
    My employer recently tried to "enchance" our application to authenticate to an LDAP directory rather than our traditional backend security server. Wow, is LDAP ever NOT the tool for that job.

    There are so few standards around LDAP authentication that it is impossible to support "LDAP" - you have to support MS Active Directory, Oracle Info Server, Novell eDir, etc..

    For example, there is no standard way to handle password expiration. Every directory does it differently. There is no standard location or hashing algorithm for user passwords, nor is there any sort of standard password policy (password complexity rules, maximum retries until lockout, etc)

    So we basically had to rewrite support for all these things that we already had in a modular fashion so now administrators are stuck configuring "the AD plugin", or "the OIS plugin".. ... but anyway, LDAP thinks it's all that and a bag of potato chips, but I'm here to tell you it is NOT.

    • Re:ldap schmel-dap (Score:2, Insightful)

      by deep44 ( 891922 )

      For example, there is no standard way to handle password expiration. Every directory does it differently. There is no standard location or hashing algorithm for user passwords, nor is there any sort of standard password policy (password complexity rules, maximum retries until lockout, etc)

      RFC 2307 - using LDAP to provide a Network Information Service.

      Almost everything you touched on is covered in that RFC. So the standards exist, but Microsoft/Oracle/etc chose not to adhere to them by creating their ow

    • Instead of trying to interface with all those why not create your own schema that the purchasers can import into the variouse directory types. Surely you could set it up so that you didn't have to use the proprietary protocols. Then your clients could just import that schema into their particular directory service. You could even link it into the current accounts with a little creative scripting I think. (not sure on that one though haven't messed with LDAP much yet Though I'm starting to)
    • Authentication in LDAP should be handled by a double-bind.

      First you bind as a read-only user to grab the user's DN from whatever they pass in (if they type an email address, you query that field to return their DN). Failure of this query means they entered an incorrect username/alias.

      Second, you take that DN and the password the user provided and attempt a second bind against LDAP. Failure to bind means they entered the wrong password.

      Was there a particular reason you couldn't use this method?

  • Sam Carter (Score:3, Funny)

    by Andrewkov ( 140579 ) on Sunday December 04, 2005 @09:48AM (#14178136)
    I'm Sam Carter, please stop using my name in screen shots!
  • Is a directory server something like MS ActiveDirectory?
  • I'm running Open-Xchange, an OSS groupware suite that, among other features, can transparently replace (mostly) Microsoft Exchange. OX uses OpenLDAP, though it can (in theory) use any LDAP directory server, including the FDS. OX uses Postgres as its default RDBMS for its data tier, but OpenLDAP stores its data internally. OX has some limits on its integration of directory data, because the rest of the app can't connect to the OpenLDAP storage - that means some sync issues, and some data is defacto read-only
  • This is pretty funny, since this Fedora DS looks like pre-5.2 Netscape/iPlanet/SunONE/Java Enterprise System (thank you Sun for all the naming) Directory Server... which was just announced to be released for free and open-sourced by Sun this week.

    Remember that Java Enterprise System is concurrently developed for Solaris SPARC, Solaris x86, and generic Linux ( and sometimes gets RPMS for the latest stable RH Enterprise). DS 5.1 and before had horrible problems with replication and the Java console was dog sl
    • Another post in reply to yours said much of what I was going to, but let me add another little tidd-bit.

      A few months ago, I went to a UUASC-OC meeting about directory services (which happens to be at the Sun office in Irvine, CA) and the main feature that DS 5.2 adds over 5.1 is "push" based updating when there is a change, instead of updating on a fixed schedule.
  • Any chance this thing will run on Fbsd?
  • Anyone kow of any efforts to get this working on MacOS?

    I am currently using OpenLDAP, which is fine if you're willing to make the effort to learn the details and differences of OpenLDAP. Fedora DS would be much easier to manage, extend the schema, etc.
  • Thank you Sun Microsystems!

    • Technically, it's not the sun stuff, it's Netscape, via AOL. Sun still distributes iPlanet 5.2, and it's pretty old and clunky. Sun's source cut hasn't been updated much sun took it over, and it currently only runs on RH 7.3 (with the evil 2.96 compiler).

      RedHat bought the source from AOL, and actually made some changes. It runs on AS3.0, and multiple master is up to 4 nodes. We're switching from iPlanet to FS 1.0, we have it in Dev now.
  • I'd like to see this in SuSE (Retail as well as Open). SuSE does have some LDAP management tools but it's not really an alternative to Microsoft's Active Directory yet (blasphemy, I know, but it's hard to argue against point-and-click management of a hierarchical directory service). This is something Linux sorely needs - a strong directory and centralized authentication service that is easy to deploy AND manage, and if a Windows client will work with it, it will be very, very hard to justify paying for Win
  • This project is nothing less than a breakthrough. Why? There is no "one good LDAP schema". Yet that's what virtually everybody wants.

    This project is to LDAP what the Dublin Core is to Zope. It's a common standard that a larger system can be built on (for example, providing complex functionality like Active Directory). Yes, OpenLDAP conforms to the LDAP standard, but a common, standardized LDAP schema that provides a basis for an Active Directory Killer is an even more important standard that everyb

Slashdot Top Deals

Trap full -- please empty.

Close