Atomic RID allocation in LDAP

[Ignacio Coupeau]

Andrew Bartlett wrote:
> I've been thinking about the problem of allocating RIDs in LDAP.
> 
> We need a race-proof scheme to allocate RIDs, and I would prefer not to
> need to use a local TDB  - I would like it all 'in ldap', if at all
> possible.

yes, and is better because several PDC may share the same ldap samba 
accounts... an several sources of rids may be a bit dangerous.

> While the real solution is an LDAP server that imposes restrictions on
> attributes (like uniqueness constraints), we will have to settle for
> what we have...
> 
> Could we use LDAP DNs for this purpose?  An LDAP distinguished name must
> be unique - so why don't we have a separate 'allocation suffix'
> 
> so cn=rids,dc=example,dc=com would contain:
> 
> nextRid,cn=rids,dc=example,dc=com 
> 
> rid=1000,cn=rids,dc=example,dc=com
> rid=1001,cn=rids,dc=example,dc=com
> rid=1002,cn=rids,dc=example,dc=com
> 
> A program wanting to allocate a RID would first read nextRid, and
> attempt to add that RID.  If it succeeds, it updates nextRID.  If it
> fails, it re-reads nextRid, and if unchanged adds 1 to the RID, and
> tries again.

I read in the OpenLdap list (Kurt, Chu) that the solution is modify 
*after* delete with previous value required, this ensures the atomicity:
----
dn: cn=rids, o=smb, dc=example,dc=com
changetype: modify
delete: nextRid
nextRid: 15000
-
add: nextRid
nextRid: 15001
-----
also runs with ldap_mod and so.

Ignacio

-- 
____________________________________________________
Ignacio Coupeau, Ph.D.     e-mail: icoupeau at unav.es
CTI, Director              fax:    948 425619
University of Navarra      voice:  948 425600
Pamplona, SPAIN            http://www.unav.es/cti/