Oracle Directory Server Enterprise Edition 11g supports Windows Server 2012

A customer called to ask if their existing Oracle Directory Server Enterprise Edition 11g can run on Windows Server 2012 R2.

A check with Oracle Directory Server Enterprise Edition 11g Certification Matrix System Certification confirms it is a 'YES'.

But do note: All components (except Directory Proxy Server) would run in 32 bits only.

.

Proper way of configuring health monitor on LB against Directory Servers

We have an issue with Sun Directory Proxy Server (DPS) recently. The IDLE connections kept building up and we needed to bounce the DPS once in a while. This is to prevent the server from running out of file descriptors.

It took us quite a while to identify what has gone wrong. The F5 load-balancer was wrongly configured by customer's system administrators.

For any enterprise load-balancer, there should be a monitor for LDAP servers. One should not use the standard TCP health check to validate the health of LDAP servers.

We found 2 good articles:

1. Best Practices for LDAP Monitoring 
2. F5 Load Balancers and Sun Directory Servers

Great stuff!

.

Solaris 10 OS and Oracle Directory Server Enterprise Edition not affected by Heartbleed

We support Solaris 10 OS and Oracle Directory Server Enterprise Edition for a big customer here in Singapore. 

Both are not affected by Heartbleed security flaw.

Oracle Solaris 10 Sparc is not vulnerable to the SSL Heartbleed vulnerability.The latest patched default OpenSSL library in Solaris 10 is version 0.9.7d, which is not affected by the vulnerability. The Heartbleed vulnerability only affects OpenSSL version 1.0.1 to 1.0.1f.

Official response from Oracle Support with regard to Oracle Directory Server Enterprise Edition below:

ODSEE do not use OpenSSL. ODSEE uses NSS for the SSL libraries. You may want to refer to this link for more understanding on the topic: ODSEE 11.1.1.7.0 Administration Guide: http://docs.oracle.com/cd/E29127_01/doc.111170/e28972/ds-security.htm#bcaul

.

OpenDJ vs OUD - Part II

I came across this comparison chart which clearly illustrates how the ForgeRock Open Identity Stack has evolved after Sun Microsystems sun-set.

The following chart attempts to compare OpenDJ against Directory Services offering from Oracle.

Oracle has 3 different directory products to choose from. The Sun OpenDS code base provides the foundation for both Oracle Unified Directory and OpenDJ which means all the advantages of the Oracle product can be found in OpenDJ as well - Internet scalability, HA, and support for use cases for the enterprise and cloud - except OpenDJ is 100% open source with an actively and rapidly contributing community and the flexibility to customize code.

Not forgetting the fact which I have mentioned in my previous blog - OpenDJ vs OUD - Which do you need? - key team members from OpenDS projects are now in ForgeRock.

So who will have the more superior product over time?

The choice is really yours...


.

OpenDJ vs OUD - Which do you need?

An old Sun DSEE Customer asked me whether they should go for OUD or OpenDJ. 

I showed them the following comparison.

Immediately, they jumped into the conclusion that they should go for OUD. Hang on!


I asked Customer the following questions and this is the response I got.

There you are … most customers only need Core Directory Service and at most, Proxy Directory Service. There's really not much demand for Virtual Directory Service (at least for this region).

Next, I shared with them the state of most Identity Products Today. See slides here - Open Identity Stack.

From my understanding, all 3 components in OpenDJ (Core, Proxy, Virtual) are/will be built from scratch and complement one another. They are built to work as a seamless stack. They are not acquired and then magically plug-and-play to sell as a bundle.

I pointed a very important fact to Customer.

I said it multiple times in my blog before. Here they are:
0. OpenDJ Roadmap
1. ForgeRock Customer Support Services
2. Commercial Open Source from ForgeRock

Now, it is also important to note that key team members from OpenDS projects are now in ForgeRock. They include Ludovic Poitou (OpenDJ Product Manager) and Matthew Swift (Chief Architect, OpenDJ).


The next thing I asked Customer to consider is cost.

Is there a way to pay less if one only needs the Core Directory Service?

Some products are sold as a bundle. You need to pay the price for the bundle, regardless of whether or not you need all the products within the bundle. Take it or leave it.


By the way, before I left,  I referred Customer to this success story which was implemented 2 years ago when OpenDJ was only at version 2.4.

3 data-centers (and different sites), and over 2.5 Million entries. Yes, it's a fact!


OpenDJ is now at 2.6.0 and so much better, with a long list of new features.


The choice is yours...


.

Replication Gateway - Part III

I blogged about OUD providing a Replication Gateway (note: this is different from Replication Server) to help replicate data two-ways from Sun DSEE to Oracle OpenDS or Unified Directory.

And I mentioned that there is in fact an alternative to replicate data from Sun DSEE to ForgeRock OpenDJ - which is using LDAP Synchronization Connector.

I was in ForgeRock Open Identity European Summit in Paris few weeks back and someone shared with me some bad experiences customers had when they used the Replication Gateway. I was told it did not work so beautifully. Strangely, directory schema was replicated!

Err… isn't the directory schema in the new OpenDS (aka OUD) not meant to be the same as the old Sun DSEE? OpenDS is supposed to be a revamp, but an upgrade for Sun DSEE.


.

Replication Gateway - Part II

I mentioned about Replication Gateway feature from OUD.

Is this the only way to replicate data from Sun Directory Server Enterprise Edition to OpenDJ or OUD?

Definitely no.

There is this free tool called LDAP Synchronization Connector.

Ldap Synchronization Connector synchronize data from any data source including databases, LDAPdirectories or files by reading, transforming and comparing these data between the source and the target referentials. These connectors can then be used to continuously synchronize a data source to a directory, for a one shot import or just to compare differences by outputting CSV or LDIF format reports.

In Azimuth Labs, we have used LSC on production sites when we migrated our customers' data from Sun Directory Server to ForgeRock OpenDJ. It works like a charm!

.

Why a Write Op on a traditional LDAP server is expensive?

I was doing some reading up on Sun Directory Server Enterprise Edition 7 (Sun DSEE) and came across a section on using a Directory Proxy Server to distribute loads, especially Writes.

The documentation went further by explaining why a Write Operation is resource intensive. I find it refreshing to revisit technical details.

Write operations are resource intensive. When a client requests a write operation, the follow sequence of events occurs on the database: 

•  The backend database is locked

•  The entry is locked in the database cache

•  The access control check plug-in is called

•  Any backend pre-operation plug-ins are called

•  The database transaction begins

•  The database files are updated

•  The old entry cache is replaced with new data

•  The database transaction is committed

•  Any backend post-operation plug-ins are called

•  The backend database is unlocked

Because of this complex procedure, an increased number of writes can have a dramatic impact on performance.

.

Sun Directory Server EOL Dates

I have a few customers who are still running Sun Java System Directory Server Enterprise Edition 6.3.x. One of them called me this morning wanting to know when will 6.3.x support ends.

I think the following information is helpful.

Note: Support for Sun DSEE 6.3.x ends on Dec 2013 and there is no extended support. Any customer who wants to continue to use Sun DSEE has to migrate to 7.x.


.

Replication over WAN

I have a customer that has a server farm of Directory Servers. These directories are deployed in multiple sites, thus WAN replication is required to keep data in-sync.

In one of the directory instances, binary data are stored. Thus resulting in huge entries (some are as huge as 20MB per attribute value).

They were using Sun Directory Server 5.x happily before they were switched to Sun DSEE 6.x due to EOL of DS 5.2. Replication starts to break for those instances with huge entries.

In this particular case, customer was trying to replicate from a Wins2k3 box to a Solaris Sparc box.

We raised a Support Case with Oracle Support and were told the following:

I would consider your customer setup as a corner case which is a mixture of all the following:

* replication over SSL
* replication over a slow WAN link
* replication of huge entries
* replication topology mixing different versions
* replication not using compression
* replication timeouts not correctly set

AFAIK, the best performance of the Directory Server is obtained with the following combination:

* DS 7.0.1
* Solaris x86
* ZFS

Oracle kept suggesting getting Professional Services people to "take a look and make suggestion".

But to the customer, the equation is so simple:
* There were no change in topology, OS, and data
* DS 5.x works
* Why would DSEE 6.x breaks? Shouldn't 6.x be a enhanced version of 5.x?

It's definitely a limitation in DSEE 6.x which Oracle refuses to admit.



By the way, we always do our own homework and below are some findings:

1. 5.2 SP6 (wins 2k) -> 5.2 SP6 (solaris sparc) ==> OK
2. 5.2 SP6 (wins 2k) -> 6.3.1 (solaris sparc) ==> NOT OK
3. 6.3.1 (windows) -> 6.3.1 (solaris sparc) ==> NOT OK
4. 6.3.1 (solaris) -> 6.3.1 (solaris sparc) ==> NOT OK
5. 7.0.1 (solaris) -> 6.3.1 (solaris sparc) ==> NOT OK
6. 7.0.1 (solaris) -> 7.0.1 (solaris sparc) ==> NOT OK


In the end, I called upon my friend (OpenDJ) for help. Looks good!

To the customer, slow is not important as long as the data is kept in-sync. Simple requirement.

The next step is to deploy a test-bed in the customer's environment to confirm replication over WAN works using OpenDJ. The past few months have been very miserable, especially talking to those people.

.

Oracle Directory Services Directory Server Enterprise Edition 11gR1

Sun Directory Server Enterprise Edition (DSEE 7.0) has now been rebranded as Oracle Directory Services Directory Server Enterprise Edition 11gR1. It is now part under the Oracle Fusion Middleware umbrella.

Read here.

.

How to disable SSL on Sun Directory Server?

I got a call from my customer asking how to manually disable the SSL on his faulty Directory Server.

Edit dse.ldif. Locate dn: cn=config:

nsslapd-security: on
nsslapd-secureport: 636

Solution:

1. Stop Directory Server

2. Remove the above 2 lines

3. Add the following line:

nsslapd-security: off

4. Start Directory Server

Done!

.

Why a Directory Consumer is not read-only? - Part II

Continue from my previous post ...

Master: ds-master.singapore.sun.com:389
Consumer: ds-slave.singapore.sun.com:1389


Let's perform a modification operation on the Consumer. I modified the entry for CLow2.

Below is what you'll observe in the access log of the Consumer:


[20/Jul/2010:02:26:28 +0800] conn=0 op=99 msgId=2098 - MOD dn="uid=CLow2,ou=People,dc=singapore,dc=sun,dc=com"
[20/Jul/2010:02:26:28 +0800] conn=0 op=99 msgId=2098 - RESULT err=10 tag=103 nentries=0 etime=0

The consumer rejects modification operation (err=10). It kicks started the referral process to redirect the MOD request to the master.

Below is what you'll observe in the access log of the Master:

[20/Jul/2010:02:26:28 +0800] conn=63 op=1 msgId=2100 - MOD dn="uid=CLow2,ou=People,dc=singapore,dc=sun,dc=com"

[20/Jul/2010:02:26:28 +0800] conn=63 op=1 msgId=2100 - RESULT err=0 tag=103 nentries=0 etime=0

The master process the modification request successfully (err=0).

Below is the dse.ldif file on the Consumer:

dn: cn="dc=singapore,dc=sun,dc=com",cn=mapping tree,cn=config

objectClass: top

objectClass: extensibleObject

objectClass: nsMappingTree

cn: "dc=singapore,dc=sun,dc=com"

nsslapd-backend: userRoot

nsslapd-referral: ldap://ds-master.singapore.sun.com:389/dc%3Dsingapore,dc%3Dsun,dc%3Dcom

nsslapd-state: referral on update

modifiersName: cn=server,cn=plugins,cn=config

modifyTimestamp: 20090923115909Z

numSubordinates: 1

Below is the dse.ldif file on the Master:

dn: cn="dc=singapore,dc=sun,dc=com",cn=mapping tree,cn=config

objectClass: top

objectClass: extensibleObject

objectClass: nsMappingTree

cn: "dc=singapore,dc=sun,dc=com"

nsslapd-state: backend

nsslapd-backend: userRoot

.

Why a Directory Consumer is not read-only?

This is an interesting question.

In my customer's environment, he has a pair of Sun Directory Servers acting as Masters. The data in the pair is kept in-sync via Multi-Master Replication (MMR).

There are 4 Sun Directory Servers acting as consumers. The data are replicated from the 2 Masters.

Recently, he found out that when he modifies entries on any of the Consumers, the modified entries are updated to the Masters!

This violates the concept of a Consumer, according to what he understands of the term.


Well, let's take a close look at the following diagram:

The diagram illustrates a Master-Consumer deployment architecture. 

Did you notice there is a dotted arrow pointing from the Consumer back to the Master? This is the Referral that is causing the "side-effect". 

Ok, it's not "side-effect". It's a product feature of Sun Directory Server. 

Whenever there is a modification request on the Consumer, the Referral will redirect the request back to the Master. The Master will be the one that actually updates the entries. The Consumer can never process a modification request, it can only perform a search request. 

.

How to reset DSCC Directory Service Manager password?

I was with a customer the other day. He has another Sun Directory Server setup by another vendor long time ago. He attempted to login to DSCC, but he was not able to remember the "admin" (Directory Service Manager) password.

Some forums I searched talked about resetting the Service Manager password via the DSCC console. What a joke! :) I can't even login, how am I able to reset password via DSCC console?

Changing password via DSCC console

There are 2 ways to resolve this issue:


1. To dismantle and initialize DSCC again

bash-3.00# ./dsccsetup dismantle
:
bash-3.00# ./dsccsetup initialize
:
Registration is on-going. Please wait...
DSCC is registered in Sun Java(TM) Web Console
:
DSCC agent has been successfully registered in Cacao.
***
Choose password for Directory Service Manager:
Confirm password for Directory Service Manager:
Creating DSCC registry...
DSCC Registry has been created successfully
***

Simple. But of course, previous configuration of registered servers are gone. You need to register again.



2. Change password via CLI

Some basic concepts first.

bash-3.00# ./dsccsetup status

***

:

DSCC Registry has been created

Path of DSCC registry is /var/opt/SUNWdsee/dscc6/dcc/ads

Port of DSCC registry is 3998

***

• DSCC configuration are stored in a LDAP database at port 3998
• Service Manager is known as cn=admin,cn=Administrators,cn=dscc in this LDAP database (see screenshot above)
• "cn=Directory Manager" credential is required to modify the Service Manager password 
• The funny thing is the default password for "cn=Directory Manager" is the same as Directory Service Manager. (see dsccsetup initialize above. the steps are so simple. it assumes both to have the same password) 

So we need to perform 2 steps:


Step 1 - Change the Directory Manager password


bash-3.00# /opt/SUNWdsee/ds6/bin/pwdhash -D /var/opt/SUNWdsee/dscc6/dcc/ads -s SHA password2
{SSHA}qFcXDQCKZ4u4GyrM8Uw4uGOHdsnVPP9MaC0WeQ==


bash-3.00# cd /var/opt/SUNWdsee/dscc6/dcc/ads/
bash-3.00# ./stop-slapd
bash-3.00# cd /var/opt/SUNWdsee/dscc6/dcc/ads/config
bash-3.00# cp dse.ldif dse.ldif.OLD
bash-3.00# vi dse.ldif
At dn: cn=config
Replace:
nsslapd-rootpw: {SSHA}guaZfnFtTHeT8EpWpBhuRlBCMLWpdgt0tBvfBw==
with:
nsslapd-rootpw: {SSHA}qFcXDQCKZ4u4GyrM8Uw4uGOHdsnVPP9MaC0WeQ==


bash-3.00# ./start-slapd



Step 2 - Change the Service Manager password

bash-3.00# ldapmodify -p 3998 -D "cn=Directory Manager"
Enter bind password:
dn: cn=admin,cn=Administrators,cn=dscc
changetype: modify
replace: userPassword
userPassword: password2 <-- Rest assured. This password will be hashed during modification.


modifying entry cn=admin,cn=Administrators,cn=dscc


Done!

.

DSCC deployment with firewall

In a production environment, there are always firewalls. This is for sure.

Below is a typical deployment of a pair of Sun Directory Servers deployed in 2 data centers. They are configured for Multi-Master Replication (MMR).

This deployment is simple. Only port 389 (bi-directional) is required to be enabled on the firewall.

Now, if the Administrators are all stationed in Data Center 1 where DS 1 is and they would like to manage all Directory Servers via DSCC (Directory Server Control Control), we have a challenge.

We need to understand how DSCC, Cacao and Directory Server works.

Basically, DSCC manages Directory Server instances through Cacao agent. On each physical server where Directory Server is installed, we need a Cacao agent installed as well. This agent runs on port 11162 by default.

Now, if we make changes to the Directory Server configuration, there is a need to update the DSCC registry. This ensures the states are kept intact. DSCC registry runs on port 3998 and 3999 (SSL) by default.

So, what do we need to configure on the firewall?

1. Port 11162 (uni-directional) from DS1 to DS2
2. Port 3998 and 2999 (uni-directional) from DS2 to DS1
3. Port 636 (bi-directional) <- for starting/stopping Directory Server via DSCC (Thanks, Teck Meng!)

.

Bind to specific IP address for Sun Directory Server

Some customers have powerful machines. It would be a waste to install a single instance of Sun Directory Server on each machine.

When you have more than 1 instance of Directory Server running, you'll end-up having the following architecture most of the time. Port 389 will be assigned to the 1st instance; while Port 1389 will be assigned to the 2nd instance.

Some application developers do not like to use port other than 389. Or corporate policy does not encourage that. I have encountered customers who dictate Directory Service to be only served via port 389, and nothing else.

So, we'll end up having to redesign the architecture to be the one shown below:

Now, the prerequisite is that the machine has to either support multi-home or have more than 1 NIC interface. This is to ensure that port 389 will not clash when both instances attempt to start.

In addition, we need to add the following entries into the dse.ldif for DS1 and DS2.

nsslapd-listenhost: ip-address-[1,2]
nsslapd-securelistenhost: ip-address-[1,2]


Remember to stop DS first; add entries; start DS.


Note: By default, both entries are missing from dse.ldif, which implies 0.0.0.0 is taken as default value.


.

Disallow anonymous access to Sun Directory Server

I received an email from my customer a week ago.

Even when a new instance is created, the default ACI allows anonymous to access this? Any ideas?

My reply below:

Yes, Sun Directory Server is built as-such. It behaves like a "Yellow Pages" sort-of. E.g. In a corporate directory server, anyone can search for anyone by default, with the exception of password.


This site from IBM explains better than me.

Searching a directory is similar to looking up a name in the white or yellow pages of a telephone directory. If the name of a particular individual object is not known, the directory can be searched for a list of objects that meet a certain requirement.

So we know that, by default, the Directory Server is accessible anonymously.


How can we disable this function?

Very easy. I did the following for another customer of mine in Thailand.

• Remove the following segment in 99user.ldif in the config/schema directory

dn: o=XXX aci: (target ="ldap:///o=XXX")(targetattr !="userPassword")
(version 3.0;acl "Anonymous read-search access"; allow (read, search, compare) (userdn = "ldap:///anyone");)

Easy. But do remember to stop/start the Directory Server.


.

Oracle Directory Server in YOG

I just received a call from my counterpart in Oracle (ex-Sun) asking for my availability in AUG to support a critical Directory Services infrastructure.

I was curious and probed further... 

... and I was told that the YOG (Youth Olympic Games) that is going to be held in Singapore is using Oracle Directory Server (aka. Sun Java System Directory Server) and my service might be required.

It's my honor definitely.

However, I have a national obligation (aka Reservist) during that period of time. If time permits and the money is right, I'll try to make myself available. I'll talk to my boss in the Army. Ha. :)


.

Sun Software Product Map - Part III

If you take a good look at the list, you'll notice that OpenDS is missing.

FYI, there is a commercial version of OpenDS - Sun OpenDS Standard Edition.

From what I know, Oracle is still defining the strategy for OpenDS. Until then, we do not know what will happen to OpenDS.

A lot of development work has been poured into OpenDS. It's a total rewrite in Java from Sun Java System Directory Server. I'm keeping my fingers crossed.


By the way, Directory Service is another strength of us. So we'll be watching closely on the development of OpenDS.


.