I have OpenLDAP configured to act as a metadirectory in front of three different backends:

database meta
uri "ldap://ldap1.example.com/ou=domain1,o=combined"
uri "ldap://ldap2.example.com/ou=domain2,o=combined"
uri "ldap://ldap3.example.com/ou=domain3,o=combined"
# ...and some suffixmap rules...

I do not have control over any of the backend directory servers.

The backends provide partially overlapping information and it is possible that someone may have an account with the same username but a different password on different backend servers.

Is it possible to enforce some sort of ordering on the backends such that (a) OpenLDAP will always query the backends in the same order and (b) return a single result (and stop searching) after finding a match? As far as I can tell, the backends are either queried in parallel or in an order that is not related to the order in which they are listed in slapd.conf.

  • You mean to say the there are duplicates of the full dn? or just the rdn? – 84104 Aug 4 '11 at 21:03
  • There are duplicates of the uid (equivalent) attribute...so neither (or not necessarily) the dn or rdn. – larsks Aug 4 '11 at 23:25

From a discussion on the OpenLDAP technical mailing list:

  • The meta database searches the referenced backend servers in parallel, so the order of returned results is non-deterministic...but you get your results faster, since a slow backend won't delay the values from other backends.

  • Multiple databases using the ldap backend will be searched sequentially. This gets you the results in a predictable order, but has a noticeable impact on the time taken to complete the request.

There does not appear to be a good way to enforce uniqueness of results across multiple backends, other than setting sizelimit 1 and using the sequential configuration.

  • Are the different result orderings documented anywhere? – maxelost May 16 '17 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.