0

Let's say I'm running two OpenLDAP servers which I can use independently for authentication: ldap.example.com (a production site) and ldap.example.io (a testing site).

Is it possible to configure ldap.example.io so that if a user is not found, instead of failing authentication, an attempt is made using ldap.example.com? This way an application using the OpenLDAP server for authentication only needs to be aware of a single LDAP resource.

I imagine there are complications to consider (e.g. duplicate usernames, where do new users get added, should the grafted tree be read-only) but for now I just want to find out if such a mechanism even exists.

Improve this question

1 Answer 1

Reset to default
2

Yes, the process is called "referral" and is a pretty standard LDAP operation mode, see http://www.openldap.org/doc/admin24/referrals.html

An alternative would be chaining: http://www.openldap.org/doc/admin24/overlays.html#Chaining

Improve this answer
2
  • Does the referral and chaining work in the case where the two directories share the same DIT ? If it's for production/testing directories, it is likely that there will be the same DIT with test users in testing and production ones in production, but there will likely be no subtree for a referral
    – Esteban
    May 18, 2017 at 11:49
  • I answer to myself, the documentation states : The server uses this information [referral uri] to generate referrals for operations acting upon entries not within or subordinate to any of the naming contexts held by the server. So it should work even if the DIT is exactly the same. Never used referral without a dedicated subtree held by another directory ;)
    – Esteban
    May 18, 2017 at 13:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .