[glue-wg] The LDAP DIT

[stephen.burke at stfc.ac.uk]

JP Navarro [mailto:navarro at mcs.anl.gov] said:
> 1) could different federation adopt our GLUE2 LDAP rendering
> specification with different DITs where users can discover information
> across federations (two separate LDAP queries)?

As long as the queries are constructed in the right way the same queries would work on any implementation with the same schema, regardless of the DIT, with the exception that you need to know the "base DN", i.e. the root of the tree within which you will find the information. That's no harder than knowing the hostname and port of the server, and indeed we often specify them all together with LDAP URLs - for example the full information for the EGI production Grid is available from (among other places) ldap://lcg-bdii.cern.ch:2170/GLUE2GroupID=grid,o=glue. Note that a server running on a different port would be equally "non-interoperable" to anything which has the port hardwired!

> 2) could these federations cross-aggregate their LDAP information given
> different DITs?  I assume they would need to know each other's DITs to
> know injection points (one perspective is that this is an operational
> issue and not a LDAP specification issue).

If you aggregated just by composition, for example you copied the entire trees from two Grids into two subtrees of a single united tree, it would be pretty much trivial. The reason Nordugrid is harder is that we're trying to integrate it at the level of individual sites (or even single services). Still it's basically just a technical issue - but you also have to understand what you expect to get at the end. For example, at the moment the top BDII has everything grouped by site (AdminDomain) so if we want to integrate an infrastructure which doesn't do that we have to make a choice, either restructure the information into that form or accept that the top BDII can have a mixed structure.

Stephen

-- 
Scanned by iCritical.