As we prepared to move forward with our project, we drew up a base set of requirements of what we felt (at the time) would be necessary for us to have an operating directory system. Below is the table that was devised to express those requirements. Note that this table has been updated as new information has become available.
Directory Migration: Choice Table
LDAP Server Software Packages
Comparison Chart
| Requirements | OpenLDAP | SunONE | DirX Server | Intrastore | eTrust | NDS | ADS |
|---|---|---|---|---|---|---|---|
| K4 (UMich) bind | yes | no | ? | ? | ? | no | no |
| LDAPv2 protocol | yes | yes | ? | ? | ? | ? | maybe |
| LDAPv3 protocol | yes | yes | yes | yes | yes | ? | yes |
| K5 bind | yes | no | ? | ? | ? | no | yes |
| SASL GSSAPI (Krb5) Auth | yes | yes | ? | ? | ? | ? | yes |
| Scalable > 200K entries | yes | yes | yes | ? | yes | ? | ? |
| Solaris 8 | yes | yes | yes | yes | yes | yes | no |
| Search limit tied to binddn | yes | ? | ? | ? | ? | ? | ? |
| Multi-Master | yes | yes | ? | ? | yes (as of rc8+) | ? | ? |
| Supports "<text>*(space)<text>" search** | no | ? | ? | ? | ? | ? | ? |
| Support avail. | yes* | yes | yes | yes | yes | yes | yes |
* Aside from an active mailing list, support can be purchased from Symas Corp., Mind NV, or Inter7.
** An example of this search is "cn=quan* mount". This should not match "cn=quantify dismount". Later learned that this is not a valid requirement as it does not meet X.500 standards.
Reviews (when available)
End of Choice Table section
As you can see from the table, there is a lot of information missing for many of the clients. This is due to the fact it is very difficult to get solid, reliable information about the different directory clients from the web pages and/or the brochures provided by the companies. There was also some difficulty getting effective information from the sales staff.
A large part of our decision tree was based off of the use of Kerberos. Stanford uses Kerberos for authentication purposes, and it was an immutable requirement that whatever directory service we went with allowed the use of Kerberos V. Our original thought was to migrate our existing Kerberos IV users of Netscape to OpenLDAP, this plan was later abandoned as the process was not simple for later reasons.
Continue on to our performance requirements
