Comment on LDAP to UNIX user proxy
just_another_person@lemmy.world 2 months agoThen it’s the same situation. Find a box, setup an LDAP service, populate it, and you’re good to go. That’s it.
Comment on LDAP to UNIX user proxy
just_another_person@lemmy.world 2 months agoThen it’s the same situation. Find a box, setup an LDAP service, populate it, and you’re good to go. That’s it.
kevincox@lemmy.ml 2 months ago
The concern is that it would be nice if the UNIX users and LDAP is automatically in sync and managed from a version controlled source. I guess the answer is just build up a static LDAP database from my existing configs. It would be nice to have one authoritative system on the server but I guess as long as they are both built from one source of truth it shouldn’t be an issue.
just_another_person@lemmy.world 2 months ago
You’re thinking too hard about this.
There needs to be a source of truth. LDAP is just a simple protocol that can be backed by whatever. You’re worried about the LDAP server going down, but guess what? It’s all in flat files. Go ahead and set it up in a bit repo for config management service for the server/protocol portion, and backup the DB. Easy peasy.
You can also cluster your LDAP service amongst all of your nodes if you have 3+ nodes and un-even number of them to ensure consensus amongst them. You can even back LDAP with etcd if you really want to go down that road.
You’re being paranoid about what happens if LDAP goes down, so solve for that. Any consumer of LDAP should be smart enough to work on cached info, and if not, it’s badly implemented. Solve for the problem you have, not for what MIGHT happen, or else you’re going to paranoid spiral like you are now because there is no such thing as a 100% effective solution to anything.