• Contact Us
  • Home
  • Installation
  • Configuration

Referrals and Chaining

Learn the benefits of utilizing referrals and chaining in your professional network to expand connections and opportunities.

Written by Maryanne Normann

Updated at October 31st, 2024

  • Quick Start
  • Installation
    Best Practices Configuration Troubleshooting Design Performance Platform
  • Maintenance
    Releases Upgrade
  • Reference
+ More

Table of Contents

Chaining versus Referrals Referral Entry (rarely used) Mandatory Object Classes Chaining Overlay (more common)

Date: 08-15-2024

Chaining versus Referrals

Chaining instructs the server to redirect writes aimed at a replica / slave / consumer to the appropriate master(s)/producer(s), while Referrals instruct the client to direct writes to any specified server. This can be accomplished by adding the chaining overlay and referral to the slapd.conf on the replica / slave / consumer or by adding a referral entry in the directory itself.

Referral Entry (rarely used)

Add an entry to the directory

dn: ou=RemoteUsers,ou=system
objectClass: top
objectClass: referral
objectClass: extensibleObject
ou: RemoteUsers
ref: ldap://master1:10389/ou=users,ou=system
ref: ldap://master2:10389/ou=users,dc=example,dc=com
ref: ldap://master3:10389/ou=users,ou=system

This method allows you to specify multiple ldap servers (not necessarily in the same master cluster) with appropriate credentials to enable writes so the client can send writes to the correct server.

Mandatory Object Classes

objectClass: referral
objectClass: extensibleObject

The extensibleObject objectClass is special in that it allows us to include any attribute in this entry. We use it here to gain the ou attribute.

However, once the entry is created, it can be difficult to modify. Any ldapsearch or modify commands must include -M (enables Manage DSA IT control allowing you to override the server referral) to change the actual referral entry.

Apache Directory Studio has a checkbox that allows an override of the referral to modify the Entry.

type filter text 
> Connection 
Connection 
Network Parameter Authentication Edit Options 
Base DN 
Get base DNS from Root DSE 
Fetch Base DNS 
Base DN: 
Limits 
Aliases Dereferencing 
Count Limit: Finding Base DN 
Time Limit (s): Search 
Controls 
Use ManageDsaIT control while browsing 
Referrals Handling 
Follow Referrals manually 
o 
Follow Referrals 
automatically 
o 
Ignore Referrals 
Fetch subentries while browsing (requires additional search request) 
paged Search page Size: 1 00 Scroll Mode 

Chaining Overlay (more common)

Add the following to the global portion of the slapd.conf file on the replica/slave/consumer above any directory entry

overlay chain
chain-uri "ldap://<master1>.example.com
chain-idassert-bind        bindmethod="simple
binddn="cn=Manager,dc=example,dc=com
credentials="<secret>
mode="self
chain-tls start
chain-return-error TRUE

Add the following to the syncrepl section on the replica/slave/consumer

updateref "ldap://<master1>.example.com/" 

The chaining overlay allows writes sent to a replica/slave/consumer to be passed by the server to the specified master.

Copyright © 2020-2024 Symas Corporation. All rights reserved.
linking recommendations chaining referrals objectclass syncrepl ldapsearch modify slad.conf

Was this article helpful?

Yes
No
Give feedback about this article

Related Articles

  • Configuring PPolicy for OpenLDAP 2.4
  • Overview of TLS and LDAPS
  • PAM-Based Authentication
  • Configure Time-Based One-Time Passwords ((T)OTP)
  • Symas Blog RSS Feed
  • Symas on Facebook
  • Symas on Twitter
  • Symas Blog
  • Symas on LinkedIn
  • Symas YouTube Channel

Copyright © 2023, Symas Corporation. All rights reserved. Privacy Statement (updated July 31, 2023)

Phone:

Main Office: +1.650.963.7601
Fax: +1.650.390.6284

Email:

Sales: sales@symas.com
Support: support@symas.com

Office Hours:

8:00 AM - 5:00 PM ET

Office Location:

Symas Corporation
PO Box 391
Grand Junction, CO 81507 USA

Expand