Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why nobody uses LDAP

blog.whats-your.name

Post reply on HN
Print view View original

21–30 of 38 posts

Re: Why nobody uses LDAP

#21

Post by kahawe »

buster wrote: post #15
moe wrote: post #10

As someone who has had to maintain a midsized openldap setup I can only agree wholeheartly: The day the LDAP dinosaur dies will be a happy day. LDIF is sort of bearable once you found proper tooling (ldapvi!) and overall the whole thing looks quite sensible and usable at first. For a few minutes. Right after installing slapd and adding your first organizationalPerson. A few hours later, after wiring up a few applicat…

I recently integrated my companies LDAP server with OpenSSO, which also meant integrating Suns LDAP schema and everything, and it was working just fine. Maybe it's openldap that sucks? Never used it, though. I don't know why LDAP is bad, it's quite a perfect tool for certain situations, that would be a nightmare with SQL and even more so with NoSQL. That there are a lot of RFCs is the major negative point the OP make…

I have used OpenLDAP and Sun LDAP on several occasions and while the initial learning curve for the whole "LDAP thing" might be steep for both, it was pretty obvious that OpenLDAP simply doesn't offer a lot of features that Sun's LDAP server has. And I agree with you, OpenSSO is a product where Sun really got it right and I am more than happy it got opensourced.

Re: Why nobody uses LDAP

#22

Post by buster »

kahawe wrote: post #21
buster wrote: post #15

Earlier quoted context omitted.

I recently integrated my companies LDAP server with OpenSSO, which also meant integrating Suns LDAP schema and everything, and it was working just fine. Maybe it's openldap that sucks? Never used it, though. I don't know why LDAP is bad, it's quite a perfect tool for certain situations, that would be a nightmare with SQL and even more so with NoSQL. That there are a lot of RFCs is the major negative point the OP make…

I have used OpenLDAP and Sun LDAP on several occasions and while the initial learning curve for the whole "LDAP thing" might be steep for both, it was pretty obvious that OpenLDAP simply doesn't offer a lot of features that Sun's LDAP server has. And I agree with you, OpenSSO is a product where Sun really got it right and I am more than happy it got opensourced.

Yes. But apparently Oracle abandoned the project. Looks like it is continued by ForgeRock: http://forgerock.com/openam.html

All that a few weeks after i recommended OpenSSO to a client.. sheez.. :P

Re: Why nobody uses LDAP

#24

Post by davidw »

buster wrote: post #16
davidw wrote: post #6

Earlier quoted context omitted.

It's a particularly ugly protocol, if you ask me. I hacked and slashed and swore and got it working for a company I worked for several years ago, but it was not a pleasant experience.

You probably had no experience, the wrong tools and thus a negative experience. Do you have specific things in mind?

I know my way around Unix, and am a fast learner, so "no experience" is not something that generally scares me. I know I'll make some mistakes and waste a bit of time.

That said, there are plenty of systems that I have encountered in my years that are much friendlier to a new user. Specifically, I recall awful command line queries, kind of wonky tools in general, and, generally, a fiddly feeling to the whole thing. I did get things working, but I was never really happy with the whole setup. We ended up calling in a consultant to check over my work and see if there were ways to improve it, and aside from a few things, there really weren't.

Re: Why nobody uses LDAP

#25

Post by davidw »

buster wrote: post #17
davidw wrote: post #2

Some NoSQL system might make a very interesting replacement for LDAP.

That'd be awful: LDAP is a protocol. NoSQL is a shitload of software that works extremely different and has no protocol or common data scheme. LDAP is probably most used for organizing a companies data (employees) and works quite well for that. It's proven, it has major software products that are stable and used in worldwide deployments. Just exchanging LDAP with NoSQL makes no sense and is a move only driven by "LDA…

No, more just idly wondering if it'd be possible to build something that is a less shitty experience than LDAP - see above/below. I'm not particularly interested in the NoSQL stuff, by and large, because for what I do, Postgres is more than enough, however, I'm curious enough to wonder "what could be", and think that with all the different new systems out there, whether it'd be possible to build something new and better.

I don't have the answers, I just didn't really like my experience with LDAP, and was idly wondering whether it'd be possible to build something better these days.

Re: Why nobody uses LDAP

#27

Post by buster »

davidw wrote: post #24
buster wrote: post #16

Earlier quoted context omitted.

You probably had no experience, the wrong tools and thus a negative experience. Do you have specific things in mind?

I know my way around Unix, and am a fast learner, so "no experience" is not something that generally scares me. I know I'll make some mistakes and waste a bit of time. That said, there are plenty of systems that I have encountered in my years that are much friendlier to a new user. Specifically, I recall awful command line queries, kind of wonky tools in general, and, generally, a fiddly feeling to the whole thing. I…

Yes, but honestly, in my world "a strange feeling" doesn't qualify for ojective proof that a system is bad. There are plenty of powerful tools, and if you don't like the commandline (although you say you use unix a lot, ldap commands are straight forward), you probably could've used GUIs in the most cases. My "feeling" of this thread is that people were unsatisfied with openldap and now blame a protocol. The major enterprise directories have a lot of additional commands/features/web interfaces to fiddle with. It's not the protocols problem when a specific implementation is hard to use, isn't it?

Re: Why nobody uses LDAP

#28

Post by buster »

kahawe wrote: post #18

Nobody as in "every company, small and large, I've ever worked for in the software, automotive, telco and banking industry". Also, ActiveDirectory is an LDAP at the end of the day. RedHat just started their own LDAP server with the old Netscape sources a few years ago. I agree that getting started with LDAP when you are only used to relational databases is a real pain. On top of that, a lot of software with "LDAP sup…

Exactly. My company is selling its own directory and of the telcos and other major ISPs worldwide we have as clients everyone uses LDAP. Nobody really just comes down to people coding alone in their basement. Enterprises typically have a whole, distributed, companywide infrastructure where LDAP plays an important role. And LDAP is doing the work just fine for a lot of years now.

Re: Why nobody uses LDAP

#29

Post by moe »

buster wrote: post #15
moe wrote: post #10

As someone who has had to maintain a midsized openldap setup I can only agree wholeheartly: The day the LDAP dinosaur dies will be a happy day. LDIF is sort of bearable once you found proper tooling (ldapvi!) and overall the whole thing looks quite sensible and usable at first. For a few minutes. Right after installing slapd and adding your first organizationalPerson. A few hours later, after wiring up a few applicat…

I recently integrated my companies LDAP server with OpenSSO, which also meant integrating Suns LDAP schema and everything, and it was working just fine. Maybe it's openldap that sucks? Never used it, though. I don't know why LDAP is bad, it's quite a perfect tool for certain situations, that would be a nightmare with SQL and even more so with NoSQL. That there are a lot of RFCs is the major negative point the OP make…

Could be that the Sun impl is better, but many problems seemed to be inherent. Like pretty much every app expecting a different or redundant schema.

What does that look like in your setup? Do you have ssh/kerberos, samba etc. all under one umbrella without nasty hacks?

Re: Why nobody uses LDAP

#30

Post by buster »

voxio wrote: post #26

Are there any free OpenLDAP alternatives out there worth mentioning?

Although not used myself, Suns OpenDS: http://www.opends.org/

Just for reference, other directories:

  IBM Tivoli
  Microsoft Active Directory
  Novell eDirectory
  Red Hat Directory Server
  Critical Path Directory Server
Post reply on HN