Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (hermes.apache.org: local policy)
Message-ID: <42249D6C.2060103@ptc.com>
Date: Tue, 01 Mar 2005 10:50:52 -0600
From: Jess Holle <jessh@ptc.com>
User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Puzzling News
References: 
 <6.2.1.2.2.20050228142137.07737eb0@pop3.rowe-clan.net><20050228210955.23366.qmail@mail.infinology.com><opsmxerqknrf0xls@ganesha.library.cornell.edu><6.2.1.2.2.20050301000016.09d1cb70@pop3.rowe-clan.net><422413DA.50106@force-elite.com>
       <49679.67.138.149.162.1109684861.squirrel@67.138.149.162>
    <19396.196.8.104.37.1109686697.squirrel@www.sharp.fm>
    <42247D3D.2020909@ptc.com>
 <41839.196.8.104.37.1109688338.squirrel@www.sharp.fm>
In-Reply-To: <41839.196.8.104.37.1109688338.squirrel@www.sharp.fm>
Content-Type: multipart/alternative;
 boundary="------------010907010309040405070006"

This is a multi-part message in MIME format.
--------------010907010309040405070006
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Graham Leggett wrote:

>Jess Holle said:
>  
>
>>Also a module (for Apache 2, not 1.3) that could use multiple LDAP
>>repositories -- and not for failover, but for separate user communities
>>-- all for a single resource/directory would be *very* helpful.
>>    
>>
>
>Can mod_authnz_ldap not do this?
>  
>
If this capability was added in 2.1, that would be news to me.

It cannot do this in 2.0.x.

The use cases are:

   1. multiple organizations, each with their own LDAP wish to allow
      their personnel into a common site -- each has its own, separately
      administered LDAP
   2. a single organization has a read-only internal LDAP and a writable
      LDAP for external guests -- again for a common site

In both cases there are multiple LDAP directories which have no overlap, 
i.e. if the first LDAP does not contain the uid, then the second must be 
tried -- this is quite different then the multiple fail-over LDAP URLs 
allowed in auth_ldap and Apache 2.0's mod_auth_ldap.

>>Right now, you have to use arcane LDAP "standards" for
>>chaining/referral, replication, etc -- which don't hold up between
>>multiple organizations and LDAP vendors so well -- or use some expensive
>>add on.
>>    
>>
>
>Can you explain some more?
>  
>
As long as the uid's have to be combined under one LDAP URL you then 
have to tackle these use cases with LDAP technologies.  These are not 
well standardized across vendors and overall are a *lot* harder to work 
with than simply being able to specify a list of (non-overlapping, 
non-failover) LDAP URLs.

--
Jess Holle


--------------010907010309040405070006
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
  <title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Graham Leggett wrote:
<blockquote
 cite="mid41839.196.8.104.37.1109688338.squirrel@www.sharp.fm"
 type="cite">
  <pre wrap="">Jess Holle said:
  </pre>
  <blockquote type="cite">
    <pre wrap="">Also a module (for Apache 2, not 1.3) that could use multiple LDAP
repositories -- and not for failover, but for separate user communities
-- all for a single resource/directory would be *very* helpful.
    </pre>
  </blockquote>
  <pre wrap=""><!---->
Can mod_authnz_ldap not do this?
  </pre>
</blockquote>
If this capability was added in 2.1, that would be news to me.<br>
<br>
It cannot do this in 2.0.x.<br>
<br>
The use cases are:<br>
<ol>
  <li>multiple organizations, each with their own LDAP wish to allow
their personnel into a common site -- each has its own, separately
administered LDAP</li>
  <li>a single organization has a read-only internal LDAP and a
writable LDAP for external guests -- again for a common site</li>
</ol>
In both cases there are multiple LDAP directories which have no
overlap, i.e. if the first LDAP does not contain the uid, then the
second must be tried -- this is quite different then the multiple
fail-over LDAP URLs allowed in auth_ldap and Apache 2.0's mod_auth_ldap.<br>
<blockquote
 cite="mid41839.196.8.104.37.1109688338.squirrel@www.sharp.fm"
 type="cite">
  <blockquote type="cite">
    <pre wrap="">Right now, you have to use arcane LDAP "standards" for
chaining/referral, replication, etc -- which don't hold up between
multiple organizations and LDAP vendors so well -- or use some expensive
add on.
    </pre>
  </blockquote>
  <pre wrap=""><!---->
Can you explain some more?
  </pre>
</blockquote>
As long as the uid's have to be combined under one LDAP URL you then
have to tackle these use cases with LDAP technologies.&nbsp; These are not
well standardized across vendors and overall are a *lot* harder to work
with than simply being able to specify a list of (non-overlapping,
non-failover) LDAP URLs.<br>
<br>
--<br>
Jess Holle<br>
<br>
</body>
</html>

--------------010907010309040405070006--