3

System specs:
LDAP: apache-ds 2.0 M7/debian squeeze
SVN: subversion 1.6.5/debian
Apache: 2.2 mod_svn/auth_ldap mods enabled

I have successfully integrated the two systems together (LDAP and SVN). The issue that I am currently having is that once a user has been added to LDAP, Apache seems to not recongnize the addition of the user until the server has been restarted (/etc/init.d/apache2 restart).

Would apache be using some caching that has to be flushed before new changes are pulled in?

having to restart apache makes it difficult for my admins to fully manage on-boarding autonomously.

Improve this question
1
  • Take a look at the Apache and LDAP logs to see what happens when logging in with newly created user?
    – quanta
    Aug 2, 2012 at 8:36

2 Answers 2

Reset to default
2

I think you may want to change the LDAP cache settings (assuming you are using mod_ldap), also see: http://httpd.apache.org/docs/2.2/mod/mod_ldap.html

Especially:

LDAPCacheTTL Directive
(...)
Specifies the time (in seconds) that an item in the search/bind cache remains valid. The default is 600 seconds (10 minutes).

I don't have LDAP caching enabled on my servers and found that password changes propagate immediately. Though it may add a performance penalty, so perhaps just making the TTL shorter is a better option.

Actually, come to think of it, the LDAP caching shouldn't affect your particular problem because your problem happens upon creating a new user. In that case it should poll the LDAP server directly, since no entry was found in the cache.

Improve this answer
1
  • I might have given the wrong example, this feels like the right direction. Thanks!
    – ebt
    Aug 3, 2012 at 15:20
1

Are you aware that restarting apache "gracefully" will restart but NOT abort any currently open connections? Thus you can restart, and the old connections will eventually die off. Basically, this is an option in apachectl, or my sending the process a SIGUSR1 signal.

Improve this answer
3
  • I believe you are referencing reload vs restart signals. I'm more concerned about the fact that I have to reload/restart at all in order for apache to recognize changes to LDAP.
    – ebt
    Jul 30, 2012 at 20:58
  • Interesting modifications to an LDAP database, unless it is a schema change has not caused me to have to restart apache. Could this be some type of caching situation that LDAP is doing? Maybe restarting ncsd - the caching daemon could help? These are just guesses on my part.
    – mdpc
    Jul 30, 2012 at 22:37
  • yeah, its probably use error on my part somewhere. Ill update the ticket if I come up with anything.
    – ebt
    Jul 31, 2012 at 20:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .