Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have an LDAP directory (OpenLDAP), which does authentication for a bunch of services running across a number of servers.

Let's say the base DN is dc=oldcompany,dc=com.

I'd now like to change that to dc=newcompany,dc=com with minimal downtime on services that depend on it.

Is there some way of setting up an "alias" or something so that my services can access the directory through both the old and new DN while I'm reconfiguring everything?

What other alternatives should I consider? Is there any good documentation around for others doing such a rename? My Google-foo is failing to find anything.

share|improve this question
    
In the past, I've had to resort to exporting the entire directory to an ldif file, performing a search-and-replace over the file, and then re-importing. Ugly, but works. I'm unsure if there's a better way. –  EEAA Aug 28 '13 at 2:47
add comment

1 Answer 1

up vote 4 down vote accepted

This kind of operation is not well-supported.

If it were me doing it, I would establish a change window, do a full export of everything using slapcat (the output will be in LDIF), use sed to rebase the data (something like sed -i 's/dc=oldcompany,dc=com/dc=newcompany,dc=com/g' backupfile), import the data to a new LDAP server, and then replace the old LDAP server with the new one.

There isn't really an equivalent to DNS's DNAME record in LDAP. Conceptually, referrals could be used to do this, but I don't see that use in the standard (RFC3296), and I'm not sure the results of having both data and a referral under a DN is defined. Moreover, even if that were to work you'd still eventually have a cutover and minimal ability to test, so you should not do this and cut over as above instead.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.