Page MenuHomekolab.org

Redesign of Hosted Kolab
Closed, ResolvedPublic

Description

In a hosted deployment, using the original design for multi-domain Kolab, each registered (parent) domain is assigned a separate root dn / database for its LDAP hierarchy.

This means that with thousands of domains being registered, the LDAP server spends a lot of time maintaining way too many databases, for otherwise separate legal entities that are not at all sufficiently large to justify the overhead.

A new structure for this would be to:

  • in the domain base dn for the management domain:
dn: associatedDomain=%s,ou=Domains,dc=hoster,dc=com
(...)
inetdomainbasedn: ou=%s,dc=hosted,dc=com

should result in *@%s being resolved to use ou=%s,dc=hosted,dc=com.

Additional domains (aka. alias domains) should be considered child domains -- the parent domain is the boss over it, but the child domains are aliases that can separately be given a status of active (means ownership confirmed);

  • in the domain base dn for the management domain:
dn: associatedDomain=%s,ou=Domains,dc=hoster,dc=com
(...)
objectclass: extensibleObject
inetdomainbasedn: ou=%s,dc=hosted,dc=com
inetdomainstatus: active

dn: associatedDomain=%s2,associatedDomain=%s1,ou=Domains,dc=hoster,dc=com
(...)
inetdomainbasedn: ou=%s1,dc=hosted,dc=com
inetdomainstatus: new

This structure could ultimately also allow resellers (tenants) to specify the child domain is to be administered separately:

  • in the domain base dn for the management domain:
dn: associatedDomain=%s,ou=Domains,dc=hoster,dc=com
(...)
objectclass: extensibleObject
inetdomainbasedn: ou=%s,dc=hosted,dc=com
inetdomainstatus: active

dn: associatedDomain=%s2,associatedDomain=%s1,ou=Domains,dc=hoster,dc=com
(...)
inetdomainbasedn: ou=%s2,dc=hosted,dc=com
inetdomainstatus: active

The question is how various pieces of infrastructure need to be modified in order to be able to address this new structure.

Details

Differential Revisions
D26: Update inserted hosted user types
Ticket Type
Epic

Related Objects

StatusAssignedTask
Resolvedvanmeeuwen
Resolvedvanmeeuwen
Resolvedbruederli
Resolvedbruederli
Resolvedbruederli
Resolvedbruederli
Resolvedvanmeeuwen
Resolvedmachniak
Wontfixvanmeeuwen
OpenNone
Wontfixvanmeeuwen
Wontfixvanmeeuwen
InvalidNone
Resolvedmachniak
Resolvedvanmeeuwen
Spitevanmeeuwen
Resolvedvanmeeuwen
Resolvedvanmeeuwen
Resolvedvanmeeuwen

Event Timeline

vanmeeuwen updated the task description. (Show Details)
vanmeeuwen raised the priority of this task from to 60.
vanmeeuwen changed Ticket Type from Task to Epic.
vanmeeuwen added a subscriber: vanmeeuwen.
grote moved this task from Incoming to In Triage on the Product Owners board.Apr 21 2015, 5:39 AM

This topic is interesting to TBits.net, since we have our own DomainAdmin patches, which has probably the same goal to support resellers/tenants.

grote added a subscriber: grote.Apr 23 2015, 1:14 AM
vanmeeuwen raised the priority of this task from 60 to Unbreak Now!.Jun 5 2015, 3:28 PM

This has been established to be of critical importance.

grote moved this task from In Triage to In Sprint on the Product Owners board.Jun 15 2015, 4:10 PM
matik added a subscriber: matik.Jun 19 2015, 12:04 AM
grote added a parent task: Restricted Maniphest Task.Jul 15 2015, 4:29 PM
grote removed a parent task: Restricted Maniphest Task.
grote added subtasks: Restricted Maniphest Task, Restricted Maniphest Task.Jul 15 2015, 4:33 PM
machniak closed subtask Restricted Maniphest Task as Resolved.Jul 24 2015, 2:02 PM
machniak closed subtask Restricted Maniphest Task as Resolved.Jul 27 2015, 2:40 PM