Thank you for the feedback. I will take a step back to review how we can engineer our setup to be efficient and manageable.

From: <389-users-bounces@lists.fedoraproject.org> on behalf of "Mayberry, Alexander" <AMayberry@west.com>
Reply-To: "389-users@lists.fedoraproject.org" <389-users@lists.fedoraproject.org>
Date: Tuesday, 3 November 2015 19:17
To: "389-users@lists.fedoraproject.org" <389-users@lists.fedoraproject.org>
Subject: Re: [389-users] DB account master integrated with LDAP

LDAP is a protocol.

Your directory is a database.

 

In your scenario, if “application 1” is used in this manner, it would become an identity management platform.  As long as this application has the ability to update your directory, you can do what you are suggesting.  I would caution you, though, with so many accounts, and no idea what your security considerations are, you may wish to take a long think on this one.  That’s a lot of potentially sensitive information.  Combining an application with your identity management platform on the same system will increase your risks.  From a complexity standpoint, if your application has the ability to act as an identity management platform, it may also have the ability to update your “application 2” system directly, and eliminate the middle-man.  Or possibly “application 2” could be configured to auth directly to “application 1”.  Depending on what type of user management features are available in “application 1”.

 

Alexander Mayberry 

Enterprise Systems Engineer

SD Group: EIT Infrastructure – OMA

Enterprise.Systems Engineering.Infrastructure

 

From: 389-users-bounces@lists.fedoraproject.org [mailto:389-users-bounces@lists.fedoraproject.org] On Behalf Of Andy Spooner
Sent: Tuesday, November 03, 2015 12:33 PM
To: 389-users@lists.fedoraproject.org
Subject: [389-users] DB account master integrated with LDAP

 

I am using ldap to share user account information across two applications. Is it possible to using 'Application 1' as the central reference instead of the LDAP server? E.g.  Application 1’ holds and maintains account information, which updates ldap periodically. 'Application 2' will look up LDAP for account informations. 'Application 1’ is the main system and will hold millions of accounts which would operate quicker from the DB without having to refer to LDAP for usernames, passwords, etc. ‘Application2’ will require a small subset of users to logon using credentials of users in the master database – which can be done via LDAP.