Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-56712

MongoLDAP should advise using Global Catalog on Active Directory instances

    • Type: Icon: Task Task
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 5.1.0-rc0
    • Affects Version/s: None
    • Component/s: None
    • Labels:
      None
    • Fully Compatible
    • Security 2021-07-12, Security 2021-07-26, Security 2021-08-09

      Active Directory deployments are often composed of "forests", where multiple Active Directory instances maintain a tree of information, and delegate ownership of some subtrees to other instances. The means, when searching for information in the root, LDAP clients may receive one or more referrals to other instances that they will need to "chase", meaning they must connect to the referred server, rebind, and and re-run the query in question.

      Active Directory provides a Global Catalog, which is an eventually consistent locally cached copy of a subset of the data in the forest. Generally, it will contain all authorization state across the forest. If it stores the data a query needs, directing your LDAP queries to a local Global Catalog will allow them to execute more quickly, without needing to chase referals, establish new connections, or rebind. Avoiding referal chasing improves LDAP performance, and avoids a number of failure scenarios.

       

      When communicating with Active Directory, if mongoldap is not configured to use the Global Catalog LDAP ports, it should recommend adjusting the configuration to use them.

            Assignee:
            aldo.aguilar@mongodb.com Aldo Aguilar
            Reporter:
            spencer.jackson@mongodb.com Spencer Jackson
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: