For about 1 year we've been using
10.04LTS for authenticating about 20 IT users and everything has been running fine (the operations on the LDAP server were basically limited to creating/removing users using apache directory studio).
More recently (6 months ago) we've also started implementing
openldap (openldap-2.4.21/debian) as an external authentication system for our website which is being migrated from an external CMS to a new platform we're developing in house using
Drupal CMS. We have a 45K-user database and things haven't been going smoothly at all. Issues that we've had are:
-ldap crashing after a backup restore, needing to be recovered.
-the ldap recover tool unable to recover the ldap database on some occassions
-slapd consuming 100% CPU while no authentication activity on the website.
Due to lack of resources and knowledge internally, all we've done so far is to find ways of keeping LDAP running without really investigating any of these issues (use
monit to restart it when it crashes,
db_recover to recover the db if needed, and
slapcat to recreate the db from scratch when
Recently we've had a round of interviews to hire a Senior infrastructure engineer to assist us with all the various infra. issues we're running into. Several candidates confirmed they've either had or heard about issues with
openldap in large production environments and never managed to come up with a single stable standalone
openldap server but instead had to come up with redundant deployments (replication, load balancing, auto-recovery/restart routines) to keep ldap running. Some candidates even said that
openldap just wasn't fit for production environments and that instead, using alternatives such as
Novel eDirectory was necessary.
Q: If you have experience in dealing with ldap in production environments with thousands of users, do you have facts to share which tend to prove that
openldap is indeed unstable for such setups and that using other ldap servers are indeed recommended?