Zimbra 8.0 LDAP highlights

[Quanah Gibson-Mount <quanah@zimbra.com>]

Hi folks,

I wanted to note some highlights of changes in Zimbra 8.0 in relation to 
LDAP, prompted in part by the recent discussion on this list about ldap 
performance, as some of the solutions to issues in 7.x do not apply to 8.x 
installations.

The first major change for 8.x to cover is that the java interface for 
connecting to LDAP has been replaced.  In 7.x and previous we use JNDI.  In 
8.x, we have switched to using the UnboundID SDK.  One of the significant 
differences between JNDI and the UnboundID SDK is that connection pools 
with startTLS are supported.  This means that making the following changes 
to localconfig are no longer necessary to improve performance:

ldap_common_require_tls = 0
ldap_starttls_required = false
zimbra_require_interprocess_security = 0

Another significant difference between JNDI and the UnboundID SDK is that 
the UnboundID SDK can actually count to 30 seconds, whereas JNDI would 
randomly consider the span of time from 0 seconds to 1 second to be 30 full 
seconds, causing read timeouts when configured to use a 30 second timeout. 
This timer is controlled by the ldap_read_timeout localconfig key.  It can 
now be used reliably with the UnboundID SDK.


There have also been some major changes to the LDAP server.  The old 
Berkeley DB database backend has been replaced in 8.x with the new MDB 
database backend.  MDB is a new database written by Howard Chu, who is also 
the primary OpenLDAP developer.  You can read more about MDB here if you 
are curious: <http://highlandsun.com/hyc/mdb/>

The main implication of changing to MDB is that database configuration is 
substantially less complex than with BDB.  You can compare the tuning wikis 
here:

<https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning> (7.x and 
previous tuning wiki)
<https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning_8.0> (8.x and 
later tuning wiki)

Also a quick comparison of the full tuning key wikis:

<https://wiki.zimbra.com/wiki/OpenLDAP_Tuning_Keys> (7.x and previous 
tuning keys)
<https://wiki.zimbra.com/wiki/OpenLDAP_Tuning_Keys_8.0> (8.x and later 
tuning keys)


Finally, what is likely the largest change for LDAP in ZCS 8.x, is the 
added support for multi-master replication.  If this feature interests you, 
you can check out the wiki on configuring it at 
<https://wiki.zimbra.com/wiki/LDAP_Multi_Master_Replication>

Regards,
Quanah

--

Quanah Gibson-Mount
Sr. Member of Technical Staff
Zimbra, Inc
A Division of VMware, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration