Open LDAP vs apacheDS

Question

I am working on scalable web application.I am planning to use LDAP for login authentication purpose. I am new to LDAP when I search about it I found two important implementations:

1. OpenLDAP
2. Apache Directory Studio

I search about performance comparison between two but i found very confusing benchmark results from various people. Some benchmark conclusion is performance is relatively same and few are saying openLDAP having greater performance as compare to Apache DS.

Dumpling

Answer 1

There are 4 open source implementations of LDAP directory servers :

• OpenLDAP
• Apache Directory Server
• OpenDJ
• Red Hat Directory Server

Since there is no standard for LDAP benchmark, you will always find results that are in favor of the preferred server of the person running them. Regardless, performances are so tied to the scale of the data stored in the server, and the underlying hardware, that you shouldn't be selecting a product based uniquely on past benchmark results.

Go to the four projects, look at the product features, get them and install them, run the same tests on them for your data and load.

OpenDJ for example has tools to generate sample data (very large sets) and run performance testing for authentication, searches, modifications, creation and deletion (authrate, searchrate, modrate, addrate...).

Howlond

Answer 2

OpenLDAP and ApacheDS are great solutions that work across many platforms.

OpenLDAP is much more scalable and lightweight, however, keep in mind there are not that many tools for managing LDAP servers. OpenLDAP must be configured via command line using LDIF's. This is repetitive work that you have almost certainly have to have a domain administrator doing.

ApacheDS has a client solution and their config's are separated into XML files. ApacheDS is built on Java and yes you can expect there to be garbage collection.

Both ApacheDS approach scaling and their data backends similarly. In fact, in both cases it's the more manual way of clustering. You cluster for availability or you cluster for performance.

The previous responder mentioned OpenDJ which is not free to use in commercial settings by the way. Their license requires you purchase a license from them to use it commercially.

Rowboat

I saw this article coding-dude.com/wp/java/apacheds-ldap-authentication-stay-away which cautioned us if going for ApacheDS as their backend seemed to have corruption data issues at the time. I wonder if that is resolved by now. I'm a newbie on LDAP and installed ApacheDS on my Linux box yesterday. But I would switch to OpenLDAP unless I'm made confident the issue ApacheDS used to have is something of the past. – Braxton

Apache runs an open JIRA that you can examine: issues.apache.org/jira/browse/… – Rowboat

The open-source edition of OpenDJ (i.e. the copy you built yourself from source) never required a commercial subscription. However, now that ForgeRock (the comapny that made OpenDJ) has gone closed-source, there's a 100% open-source fork called Wren:DS that people interested in an easy-to-use LDAP server should consider checking out: github.com/Wrensecurity/wrends – Hellhound

That's not entirely accurate. I had talked to ForgeRock and basically, their code was open source but as soon as you ran it there was some licensing provisions that required that you paid them. Obviously, this post is old so I can't go back and pull that license that existed back then but I'm really glad an alternative exists. – Rowboat

Answer 3

use OpenLDAP if you need an easy to install lightweight server setup, these days one can just pull a docker image that comes pre-populated.

The open source variant of RedHat Directory Server is 389 Directory Server. Documentation is decent and it supports dual master replication and the EPEL repos have a console and admin console with graphical interface that is rather convenient.

Know your ldapsearch commands first is my tip, so you understand the technology and tools better. In the past I created a chef recipe that setup a fully working 389-DS server in dual master mode, which what I needed and so became my preferred solution. To test locally I use openldap in a docker container.

Wurtz