Slashdot Mirror
Red Hat Opens Netscape Directory
suezz writes " Eweek is running a story that Redhat is releasing Netscape Directory (LDAP) under the GPL - this is huge at least from my point of view. I know of at least two huge companies that have standardized on Netscape Directory for their web applications."
Red hat paid $20.5 million for this LDAP. Will they get that in return? Is it possible with this type of software?
I think this is a good thing, I'm just honestly curious, having messed around with OpenLDAP, and never really doing much with ND.
What's the major differences, feature-wise not philosophy-wise (no Free vs free vs Open vs open rants).
I don't need no instructions to know how to rock!!!!
How does this improve my user experience?
How can using ND make my life, as a user/administrator/purveyor of exotic animals, easier?
I think that is a useful question to ask any time a "new" feature is presented.
I know this story is going to prompt people wanting to know how the Netscape directory server compares with OpenLDAP. I've never used the Netscape one but what I would really love to know is how does it stack up against Novell eDirectory? eDirectory isn't open source but the licenses are damn cheap, the first 250,000 licenses are free. Any LDAP experts care to share their opinions?
I've used OpenLDAP and Netscape Directory Server. NDS is a *very very very* cool product. It's easy to use, scales like there's no tomorrow (it was the backend for a lot of the older Netscape Netcenter sign on functions) and it's nice & documented. (I still have books for it)
Red Hat releasing it under the GPL is a good thing, any way that you look at it. Cool product, "big name company" supporting it, and oodles of applications that can already use many of its functions.
Now, if someone would slurp up Netscape Calendaring Server and release *that* under the GPL..
If the Netscape SuiteSpot Server suite still existed and was under the GPL, there's your Exchange-killer right there.
Can RH possibly integrate the http://hula-project.org/ into this roll out? I would really like to have THE non-M$ directory/email/calendaring system running for my school district: single sign-on and email accounts for teachers, staff, students, parents... with Mac OS X Server directory delegation, Kerberos, etc.
A killer kombination for Open Source.
Now if they would only open source Netscape calendaring...
Isn't Sun's Directory Server based off this as well? I thought they'd acquired all the old Netscape stuff back in the Netscape/iPlanet days.
Where are the other bits of software that once was Netscape Suitespot?
Netscape Calendar was not actually developed by Netscape, but was a version of CS&T's CorporateTime system. CS&T later renamed to Steltor, and is now part of Oracle, CorporateTime forming a large part of their colloboration suite.
Both Netscape and Sun got copies of everything when iPlanet split. Sun still develops and sells them, first as Sun ONE, now as Java Enterprise System. Netscape tried to keep development going for a while, but it kind of stagnated (much in the same way that the Netscape browser stopped moving after the AOL aquisition).
Redhat also got Certificate Server and Enteprise Server (the web server) as part of their deal, see http://www.redhat.com/software/rha/netscape/ for more.
So where is the other Netscape software? I'm mostly talking about Messaging Server, which is an awesome piece of software, and Collabra Server, which .. isn't. Presumably they're still kicking around in a CVS in the depths of AOL somewhere. Anybody else know anything?
Asides from Multi master replication (OPenLDAP onyl allows a single master), Netscape directory server solves the 'OpenLDAP being fucking retarded, and holding ACLs to objects in the directory OUTSIDE the directory, therefore replicating objects before their access controls' issue.
The problem with LDAP is that adding the 'L' (lightweight) to the 'DAP' (directory access protocol) removed many features including, most noticably, proper distribution of data over multiple servers and proper chaining of requests.
Proper distribution and request chaining protools would allow Linux systems and MS systems to share a perceived common user data store. At the moment, hybrid enterprises are forced to support multiple islands of trust in the organization. It also sets the operational limits of the system to an enterprise/employee rather than a global/customer scale solution.
Still, it's a good thing that Red Hat is implementing a directory based identity management solution. It's a step in the right direction.
I feel happy about this.
I feel that this may be karmic retribution for Sun railroading us into having to use ^$@#%$&ing pkgadd, instead of those lovely tarball installs of yore, where it all installed into a single directory that I could tar up, or simply blow away if it screwed up... ah, the days of control...
But then, in the short term, the only way that I can see Netscape Directory Server making it into the enterprises that I deal with daily are if it comes bundled or as a dependency for some very well-trusted and established open source app, like maybe a CMS or something such as Bugzilla, or SVN. As an "Enterprise Directory" (ooh aah) it will be a long time before this version could compete, if ever -- everybody wants a stack, these days.
Still, it could be interesting leverage for the big Sun clients who are actually paying for the SJS Directory Server. I think this is the final stage of the commoditization of the animal that is a directory server... damn, I owe a certain Burton Group analyst a beer now...
(-:
Pixie
don't mess with those geekgrrls
Er ... my point was that lots of custom hacking would be required to do with LDAP on *NIX the things that come BUILT IN in AD. I thought it was pretty darn obvious, actually.
;-)
... what you say is probably true. On the other hand, even quite large organizations often seem to fail to deploy it correctly. A national manufacturing outfit in Australia was bought down for a while because one of their branch offices lost its connection to the WAN, their AD secondary master promoted its self to primary, then the WAN was restored and everything went *splat*. Avoidable? Probably. Need an AD black-magic wizard? Definitely. What's needed is documented somewhere? Without a doubt ... but good luck finding it and understanding it then applying it correctly. The AD admins I've spoken to have all expressed the view that AD is great, but just too damn hard to configure robustly and that it tends to be fragile if not configured exactly right.
My whole point is that you don't get anything even remotely like Group Policy under any *nix LDAP authentication scheme I'm aware of unless you do a lot of custom hacking.
AD is pretty awesome, and I'd really LIKE most of the power it offers on other platforms. As far as I'm concerned that's the biggest thing the Windows platform has going for it. That, and it's documented
As for AD problems
I would ask you to, next time, take the time to ACTUALLY READ MY MESSAGE before flaming me out too much, OK? You've been just as bad as the people you're complaining about.
In the development and staging environments it was great. As other posters mentioned you could get from zero to something usable in less than 30 minutes. Everything was as you would expect.
However... in the -production- environment, with 10's of millions of ldap objects connected to SprintPCS's provisioning systems which were making 1,000+ ldap writes --a minute-- the SunOne system absolutely blew chunks.
LDAP architects will ask what the hell we were doing with the entire database in one ldap instance rather than partition the dataset, and they'd be right, but we were acting under Sun's direction since at the time we had one of (if not) the largest LDAPs in the world.
LDAP architects would also wonder why on earth you would ask an ldap server to live under such a write intensive churn, and they'd be right again.
That being said...
-- Multimaster replication would never ever work. Most of the time the entire SprintPCS userbase was hanging off one master and less than 4 replication slaves. For several months the entire messaging system was wedged into a single point of failure nightmare. (to be fair, this wasn't all slapd's fault and had 1/2 of the root cause in Sprint Datacenter practices which produced predictable results)
-- Other posters asked for SunOne Calendar server to be opensourced. My first response is to suggest you have your head examined since that thing would die for absolutely no reason on a regular basis. We actually automated the process of detecting its death and restoring from last night's backup. If you were a SprintPCS customer and your calendar ever seemed screwy now you know why. Of course further reflection suggested opensourcing it is probably the only thing that could help at this point because...
-- We used to get hotfix builds from Sun which were missing entire sections of the binaries. Whoever was managing the code would forget to use the same compilation flags for hotfixes as original code so we would receive webmail frontend builds which couldn't talk to imap backends, or calendar backends which wouldn't accept connections from calendar front ends.
-- SOL if you wanted to run more than 4G of memory in slapd.
Dont consider this post a rant, just let any CIO's/etc. reading this know that this opensource release will probably work great for you if you dont load it heavily (unlike exchange 5x, which would grenade just sitting there)
On the other hand, if you want to push the performance envelope, pretty much expect it to take alot of time and cause a bunch of headaches -in production-. Get help from people who have pushed the performance of the tools you are considering running.
Weird mood tonight.
Not since 1999-2000. The overall shape is still similar but the internal details have all been reimplemented by the OpenLDAP Project. Today OpenLDAP is miles ahead of Netscape in terms of performance, scalability, and stability.
a p/history/index.html
See for yourself:
http://www.stanford.edu/services/directory/openld
OpenLDAP 2.0 is slow, snail's pace, frozen molasses slow. That's the release that RedHat has bundled for years, up to RH9 and even beyond. It's only in the past few months that anything from them (Fedora Core) has shipped anything newer.
OpenLDAP 2.1 is over Two Hundred Times faster than OpenLDAP 2.0 and already significantly faster than Netscape 5. OpenLDAP 2.2 is 30-50% faster than OpenLDAP 2.1 and leaves Netscape in the dust. OpenLDAP 2.3 is faster yet.
-- *My* journal is more interesting than *yours*...
Why is this even newsworthy?
i rectory-server/
IBM has licensed its enterprise-class LDAP directory server software free of charge for over 5 years now.
Yep, free. Go to ibm.com and download it for yourself. Anyone. For any purpose.
http://www-306.ibm.com/software/tivoli/products/d
It's currently under the Tivoli brand, going as the IBM Tivoli Directory Server v6.0.
Not only does it pack all the bells and whistles of other enterprise LDAP directories, such as multimaster and cascaded replication models, but instead of flat files it *includes* IBM DB2 UDB enterprise edition database (also licensed free of charge) for its data storage. I've seen the comparative test results, and nothing touches this solution for performance and scalability.
It runs on just about anything, too...including Linux on non-x86 hardware.
And they've always GIVEN it away. Free download.
So, someone explain again WHY any company of any size would PAY for an LDAP solution, or why RedHat giving away Netscape Directory is big news?
This isn't 100% correct. SUN ONE is a merge of the Netscape Code base with the Innosoft Code base they aquired in around 2001. Both Netscape and Innosoft developed their own directory servers based around the Open LDAP reference installation. What made Innosoft more advanced was its capability for several masters (it's not true multi - master in the sense of eDirectory from Novell or Active directory but that is no bad thing).
SUN aquired the Netscape Code in partnership with AOL and also bought Innosoft. SUNs Directory 4.x servers are the Netscape code, 5.x are Innosoft.
Having said that I have happily tested both servers with 4 million entries on a fairly small box and run 500K entries in production. We managed uptimes of in excess of a year on some of our 4.x servers running over a million queries a day, not so bad.
At the bottom of the page is the download link. It does appear to go to a "free" evaluation/beta copy.
I didn't download it though, so I don't know what the exact terms of use are.
The fact that there is a "Buy Now" would suggest that the eval copy is for testing but not production. Just a guess though.
I ran the Corporate Directory for a major US automaker for a number of years.
We used Netscape's Directory Server. There were hundreds of apps pointing at it, and the main Internet proxy server used it as the authentication service.
Over a million objects, hundreds of thousands of searches per day. It might crash once or twice per year, and never corrupted anything.
The management GUI sucked, but it was an outstanding product in all other respects.
DG
Want to learn about race cars? Read my Book
Because red hat is not just giving it for free - they've opensourced it. Under the GPL. This means it's really free, we can improve it, port to weird architectures, to freeBSD, etc. We can see the code, not just use it.