Keeping LDAP connections between program runs

[jpfarmer]

Recently, I have found myself in a position where I need to optimize a web service that my company uses. This service is basically a web front-end an LDAP directory service. The application has increased in traffic, and so the overhead of repeated binds is starting to be a problem. As a result, I am in search of a way to use a persistant connection to the directory.

My first thought was to create a dameon that would maintain a connection to the LDAP server and then have the address book application talk to the dameon, but I don't know how reliable the dameon modules are (I was looking at Net::Daemon...is it trustworthy?) and I also don't know if Net::LDAP is threadsafe.

Is there a better way to go about this or is a daemon the way to go?

[Tanktalus]

This sounds vaguely similar to Apache::DBI's purpose in life: to cache DBI connections. So, I suppose the first question is: are you using mod_perl? The second is: can you? :-)

[jpfarmer]

I ran across that, but the LDAP connection isn't a DBI connection, so I'm not sure that would help.

I'm not using mod_perl. We don't need it for performance reasons on the web server and I don't have any experience with it, but I could learn if that's the only real solution.

[philcrow]

Even if the rest of your app doesn't need mod_perl for performance, this part may. The whole purpose of mod_perl is to save time through persistence inside an apache instance. Using mod_perl, it is easy to keep the connection open from hit to hit. And to pool connections in all sorts of ways.

Even though I haven't used LDAP, it seems from your description that it is similar in spirit to a database in that a client opens a connection to the server. Building that connection takes time and eventually becomes a bottlenck.

Apache::DBI could serve as a code modle for an Apache::LDAP if one does not already exist. Having written the last sentence, I went to search cpan and found Apache::AuthenLDAP and its cousin Apache::AuthzLDAP. These might be just what you need, or another model for your own code.

Phil

[idsfa]

I believe you want DBD::LDAP (in conjunction with Apache::DBI)

     use DBI;
     $dbh = DBI->connect("DBI:LDAP:ldapdb",'user','password')
         or die "Cannot connect as user: " . $DBI::errstr;

     $dbh = DBI->connect("DBI:LDAP:ldapdb")  #ANONYMOUS
         or die "Cannot connect as guest (readonly): " . $DBI::errstr;

Updated: You might also want to look at ResourcePool, which specifically calls out Net::LDAP connection caching as a target use.

[ghenry]

How many binds are we talking about here?

LDAP is designed for the sole purpose of high read requests, so if you are just requesting a read, be it TLS/Start_TLS or SASL, I suggest you have a word with the guys who setup the server. That could be the main problem.

Just a thought.

[jpfarmer]

At high load, about 3000 binds/hour. They're simple binds; there's a SSH tunnel between the server and the client so we could avoid the overhead of SASL.

[ghenry]

Not that many, compared to some places

Please don't tell me you are using a ldbm backend? I hope it's a bdb (if you are using OpenLDAP that is).