Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

System specs:
LDAP: apache-ds 2.0 M7/debian squeeze
SVN: subversion 1.6.5/debian
Apache: 2.2 mod_svn/auth_ldap mods enabled

I have successfully integrated the two systems together (LDAP and SVN). The issue that I am currently having is that once a user has been added to LDAP, Apache seems to not recongnize the addition of the user until the server has been restarted (/etc/init.d/apache2 restart).

Would apache be using some caching that has to be flushed before new changes are pulled in?

having to restart apache makes it difficult for my admins to fully manage on-boarding autonomously.

share|improve this question
    
Take a look at the Apache and LDAP logs to see what happens when logging in with newly created user? –  quanta Aug 2 '12 at 8:36

2 Answers 2

up vote 2 down vote accepted

I think you may want to change the LDAP cache settings (assuming you are using mod_ldap), also see: http://httpd.apache.org/docs/2.2/mod/mod_ldap.html

Especially:

LDAPCacheTTL Directive
(...)
Specifies the time (in seconds) that an item in the search/bind cache remains valid. The default is 600 seconds (10 minutes).

I don't have LDAP caching enabled on my servers and found that password changes propagate immediately. Though it may add a performance penalty, so perhaps just making the TTL shorter is a better option.

Actually, come to think of it, the LDAP caching shouldn't affect your particular problem because your problem happens upon creating a new user. In that case it should poll the LDAP server directly, since no entry was found in the cache.

share|improve this answer
    
I might have given the wrong example, this feels like the right direction. Thanks! –  ebt Aug 3 '12 at 15:20

Are you aware that restarting apache "gracefully" will restart but NOT abort any currently open connections? Thus you can restart, and the old connections will eventually die off. Basically, this is an option in apachectl, or my sending the process a SIGUSR1 signal.

share|improve this answer
    
I believe you are referencing reload vs restart signals. I'm more concerned about the fact that I have to reload/restart at all in order for apache to recognize changes to LDAP. –  ebt Jul 30 '12 at 20:58
    
Interesting modifications to an LDAP database, unless it is a schema change has not caused me to have to restart apache. Could this be some type of caching situation that LDAP is doing? Maybe restarting ncsd - the caching daemon could help? These are just guesses on my part. –  mdpc Jul 30 '12 at 22:37
    
yeah, its probably use error on my part somewhere. Ill update the ticket if I come up with anything. –  ebt Jul 31 '12 at 20:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.