Subject: [dhcwg] LDAP Schema for DHCP

From: Markus Schabel <[email-masked]>
Date: Thu, 13 Nov 2003 16:46:41 +0100

Hello!

I'd like to store active DHCP leases in my LDAP directory. Since I
didn't like to re-invent the wheel I found the following draft:

http://www.ietf.org/proceedings/01aug/I-D/draft-ietf-dhc-ldap-schema-00.txt

As you can see it's quite old. Is there a newer version available
somewhere? And if not, are there any plans to release a newer version
or is the whole concept of storing DHCP information in LDAP put away,
and if this is so, why?

best regards
Markus Schabel

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Bernie Volz" <[email-masked]>
Date: Thu, 13 Nov 2003 10:57:35 -0500

There was some work done a while ago on this topic but it never was finished
and there has generally been a lack of interest to do it (at least in a
standardized way). One issue is that servers have very different
capabilities and therefore developing a standard limits functionality to the
"common" capabilities. There are some servers that do use LDAP or can store
information in LDAP, but I think they've generally used a proprietary
schema.

- Bernie

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Markus
Schabel
Sent: Thursday, November 13, 2003 10:47 AM
To: [email-masked]
Subject: [dhcwg] LDAP Schema for DHCP

Hello!

best regards
Markus Schabel

---

From: Leif Johansson <[email-masked]>
Date: Tue, 18 Nov 2003 15:48:18 +0100

Bernie Volz wrote:
| There was some work done a while ago on this topic but it never was
finished
| and there has generally been a lack of interest to do it (at least in a
| standardized way). One issue is that servers have very different
| capabilities and therefore developing a standard limits functionality
to the
| "common" capabilities. There are some servers that do use LDAP or can
store
| information in LDAP, but I think they've generally used a proprietary
| schema.
|

Imo that is not a correct analysis. Certainly there will be differences
and proprietary solutions but that does not imply that there cannot be a
standard information model common to all implementations. Good schema
work in the ietf depends on a common view of the underlying information
model. The draft referenced by Markus has *lots* of problems. I would be
willing to help work on this but there needs to be a clear statement of
interest from the wg.

	Cheers Leif

---

From: "Bernie Volz" <[email-masked]>
Date: Tue, 18 Nov 2003 12:27:36 -0500

It all depends on what you want to use LDAP for.

There's:
- Configuration information for the server or service (whether implemented
in one or many servers). And, there's also the "current" vs. the "next"
configuration to consider.
- Active lease information (this is, IMO, the easiest to standardize since
it is well defined based on RFC 2131/2132). Such as what client is using the
address and which options were sent to it.
- Historical lease information (what clients had what addresses when).

And, there are probably other uses that I haven't mentioned.

The Policy Framework WG has made very little progress in schemas - or, put
another way, it has taken many years to get where they are now and many
revisions of the drafts. This is not an easy space - I spent several years
trying to work in it and finally gave up. And, admittedly I haven't followed
that WG for several years now.

In addition, there are significant performance penalties paid by putting too
much into LDAP. For example, good luck being able to perform 1,000 leases
per second when using LDAP to store the active lease information. LDAP was
primarily designed for many reads, not many writes. At least, that was my
experience over the past 5 or so years.

And putting configuration information into LDAP, while possible, certainly
constrains how information is represented. Lots of servers now have
conditional expressions and the like, making the LDAP representation more
challenging.

I have no issues if you folks want to try. Just be ready for a long and
difficult road. And, personally, I'm not that interested. And, past history
has shown that there wasn't sufficient interest to make this go.

- Bernie

-----Original Message-----
From: Leif Johansson [mailto:[email-masked]] 
Sent: Tuesday, November 18, 2003 9:48 AM
To: Bernie Volz
Cc: 'Markus Schabel'; [email-masked]
Subject: Re: [dhcwg] LDAP Schema for DHCP

Bernie Volz wrote:

	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Wed, 19 Nov 2003 01:40:35 +0100

|
| The Policy Framework WG has made very little progress in schemas - or, put
| another way, it has taken many years to get where they are now and many
| revisions of the drafts. This is not an easy space - I spent several years
| trying to work in it and finally gave up. And, admittedly I haven't
followed
| that WG for several years now.
|

That is another way of saying their schemas are broken, a view shared
by many in ldap space. There are technical reasons for that (as other
schema-geeks could tell you), but the bottom line is that the schemas
are too complex by far.

| In addition, there are significant performance penalties paid by
putting too
| much into LDAP. For example, good luck being able to perform 1,000 leases
| per second when using LDAP to store the active lease information. LDAP was
| primarily designed for many reads, not many writes. At least, that was my
| experience over the past 5 or so years.
|

That is a myth. It all depends on the implementation. There is no law
which states that just because a service exposes an LDAP interface it
must be implemented as a traditional general-purpose directory server.

It is just bits on the wire together with an information model! In most
cases where (and lease-info is such a case imo) the schema has little
or no relation with traditional white-pages data (persons, groups etc)
this type of implementation is relatively easy to do (because there is
no problem exposing the data in a separate tree). For a server it would
entail implementing a small subset of core ldap in the server event-
loop for read-only operations which in itself is a relatively trivial
exercise given the right marshalling tools.

| And putting configuration information into LDAP, while possible, certainly
| constrains how information is represented. Lots of servers now have
| conditional expressions and the like, making the LDAP representation more
| challenging.

Certainly one must be careful. Never try to implement general policy
in a directory but often it is not necesary. I still think it might
be useful to represent a *subset* of the general information model where
it coincides with widely deployed schema representing hosts and groups
of hosts. This would benefit sites which have large directory driven
host-management systems.

You are quite right that before anyone tries to write schema we must
identify the use-cases correctly. Lease-information is a valid use-
case and I suspect that the performance issue isn't one.

	Cheers Leif

---

From: "Barr Hibbs" <[email-masked]>
Date: Wed, 19 Nov 2003 15:46:07 -0800

there certainly are servers capable of processing thousands of DHCP messages
per second, and I personally know of environments where the steady-state
message rate (7x24) is roughly 4-7 messages per second with peak rates in
excess of 3000 messages per second, with client populations measured in tens
or hundreds of thousands.

so before over specifying an LDAP schema, one probably should define the
problem space a bit taking into account actual usage patterns that would
have to be accommodated, rather than just devising something in the abstract
that might not be implementable.

--Barr

> From: Bernie Volz
> Sent: Tuesday, November 18, 2003 09:28
>

---

From: Ted Lemon <[email-masked]>
Date: Wed, 19 Nov 2003 18:50:33 -0600

> that might not be implementable.

On the other hand, there's no technical reason why an LDAP server can't 
handle 3k updates per second - it's just a stereotype that LDAP servers 
can't do that.   I don't even know if it's still true.   So if what's 
desired is to keep a complete lease record in LDAP, or if that's one 
part of an LDAP schema that can also be used just for configuration 
information, I think it's fine.

The real question is, is this actually something that people want?   If 
not, why not wait until people want it?   If so, do people want the 
whole thing, or just configuration information?   If they just want 
configuration information, why not define that schema now but leave 
room to add more later?

As to Bernie's point, I think you can make the case that conditional 
behavior is something that can be thought of as separate from actual 
configuration, and there are ways to write the LDAP schema so that it 
provides support for whatever conditional behavior the server offers, 
without actually encoding that behavior - that is, you don't have to 
stuff the ISC config language, python code, or whatever into the LDAP 
database - just the objects that that code manipulates.

---

From: Stig Venaas <[email-masked]>
Date: Thu, 20 Nov 2003 09:01:02 +0100

> configuration information, why not define that schema now but leave 

There's already an LDAP patch for ISC DHCP, and a schema to go with
it. I think it's for configuration only, not sure. Found it using
google a few days ago, don't have the URL at hand, but should be
easy to find. So there seems to be some that want it...

Stig

---

From: Ted Lemon <[email-masked]>
Date: Thu, 20 Nov 2003 09:51:50 -0600

> easy to find. So there seems to be some that want it...

Yup.   It's not clear that the LDAP patch in the ISC server is what the 
ISC would want to adopt, but I agree that there seems to be at least 
some demand for it.   CMU tends historically to be pretty serious about 
developing good sysadmin tools, so it's worth paying attention to what 
they're doing.

---

From: Leif Johansson <[email-masked]>
Date: Sat, 22 Nov 2003 07:31:31 +0100

Stig Venaas wrote:
| On Wed, Nov 19, 2003 at 06:50:33PM -0600, Ted Lemon wrote:
|
|>The real question is, is this actually something that people want?   If
|>not, why not wait until people want it?   If so, do people want the
|>whole thing, or just configuration information?   If they just want
|>configuration information, why not define that schema now but leave
|>room to add more later?
|
|
| There's already an LDAP patch for ISC DHCP, and a schema to go with
| it. I think it's for configuration only, not sure. Found it using
| google a few days ago, don't have the URL at hand, but should be
| easy to find. So there seems to be some that want it...

http://www.lunytune.net/isc-ldap.html.

---

From: Leif Johansson <[email-masked]>
Date: Sat, 22 Nov 2003 07:39:54 +0100

Stig Venaas wrote:

This schema is very tied to isc dhcp and imo there are better ways
to design a general configuration schema but it does show people are
interested.